Web form protection

Inventors: Nicholas Thomas Sullivan (San Francisco, CA); Zi Lin (San Francisco, CA); Rajeev Devendra Sharma (San Francisco, CA)

Assignee: CLOUDFLARE, INC.

H04L63/0435 G06F17/3089 H04L9/0819 H04L9/14 H04L63/0281 H04L63/061 H04L63/10 H04L67/2842 H04L63/168 H04L2209/24

View Patent ↗

Loading inventors, assignments & file history…

Monitor This Case

Get email alerts when status or documents change.

Order Certified Copies

Most orders are placed with the USPTO same day — all within 24 business hours.

Order via The Patent Place →

Pre-filled with this patent's details

Quick Facts

Patent No.: US 9,843,565
App. No.: 15/219,139
Granted: Dec 12, 2017
Kind: B2

External Links

USPTO Patent Center↗ Full Patent PDF↗

Abstract

A request for a web page is received and the requested web page is retrieved. The web page is modified to obfuscate a set of form attribute values into a corresponding set of obfuscated form attribute values. The modified web page is transmitted to the requesting device. The modified web page does not include the set of form attribute values in their original form. Form data for the set of obfuscated form attribute values is received from the requesting device. The set of obfuscated form attribute values is deobfuscated thereby revealing the original set of form attribute values. The form data for the set of original form attribute values is further processed.

Claims (84)

1. A method in a proxy server that is coupled with an origin server, comprising;

receiving, from a requesting device, a request for a web page of the origin server;

retrieving the requested web page;

determining that the retrieved web page includes a web form that includes a set of one or more form attribute values for obfuscation;

modifying the retrieved web page including obfuscating the set of form attribute values into a corresponding set of one more obfuscated form attribute values, wherein obfuscating the set of form attribute values includes performing the following:

determining a first set of one or more values of a set of one or more characteristics of the requesting device,

deriving a first symmetric key from at least the first set of values and a first current time of the obfuscation rounded to a particular time unit, and

encrypting the set of form attribute values using the first symmetric key;

transmitting the modified web page to the requesting device, wherein the set of form attribute values in their original form is not included in the modified web page;

receiving, from the requesting device, form data for the set of obfuscated form attribute values;

deobfuscating the set of obfuscated form attribute values thereby revealing the set of form attribute values, wherein deobfuscating the set of obfuscated form attribute values includes performing the following:

determining a second set of one or more values of the set of characteristics of the requesting device,

deriving a second symmetric key from at least the second set of values and a second current time of the deobfuscation rounded to the particular time unit, and

attempting to decrypt the set of obfuscated form attribute values using the second symmetric key; and

responsive to the deobfuscation, transmitting the form data with the set of form attribute values to the origin server.

2. The method of claim 1 , wherein retrieving the requested web page includes transmitting a request for the web page to the origin server and receiving a response from the origin server that includes the requested web page.

3. The method of claim 1 , wherein retrieving the requested web page includes accessing the requested web page from a cache that is available to the proxy server.

4. The method of claim 1 , wherein modifying the retrieved web page further includes:

modifying a reference to at least one of the set of form attribute values for obfuscation to refer to the corresponding obfuscated form attribute value instead of that at least one of the set of form attribute values for obfuscation.

5. The method of claim 1 , wherein the set of form attribute values includes one or more of the following:

a name form attribute value;

an id form attribute value; and

a class name form attribute value.

6. The method of claim 1 , further comprising:

wherein deobfuscating the set of obfuscated form attribute values further includes performing the following:

responsive to determining that the decryption of the set of obfuscated form attribute values using the second symmetric key was not successful, performing the following a threshold number of times, wherein the threshold number of times is greater than or equal to one:

deriving another symmetric key from at least the second set of values and a most previous time period from a most previous attempt at decrypting the set of obfuscated form attribute values, and

attempting to decrypt the set of obfuscated form attribute values using the another symmetric key.

7. A non-transitory machine-readable storage medium that provides instructions that, when executed by a processor of a proxy server, cause said processor to perform operations comprising:

receiving, from a requesting device, a request for a web page of an origin server;