Systems and methods for detecting and preventing spoofing

1. A method, performed by at least one computer, for ascertaining legitimacy of communications received by the at least one computer during a digital interaction between the at least one computer and a client device, the method comprising:

receiving a communication;

identifying from the communication a first secured token and a request to access a web page;

processing the first secured token by:

obtaining, from the first secured token, information indicating a state of the digital interaction, wherein the information indicating the state of the digital interaction comprises a first value of a counter, the counter indicating a number of times the information indicating the state of the digital interaction has been changed by the at least one computer during the digital interaction; and

using the information indicating the state of the digital interaction to determine whether the communication is from the client device at least in part by determining whether the first value of the counter matches a value of the counter provided to the client device by the at least one computer prior to receiving the communication;

when it is determined that the communication is not from the client device, denying access to the requested web page; and

when it is determined that the communication is from the client device,

providing the client device access to the web page;

updating the information indicating the state of the digital interaction to obtain updated information indicating the state of the digital interaction, the updating comprising increasing the counter from the first value to a second value;

including the updated information indicating the state of the digital interaction in a second secure token, wherein the updated information indicating the state of the digital interaction comprises the second value of the counter; and

providing the second secured token to the client device for use in a subsequent communication during the digital interaction.

2. The method of claim 1 , further comprising:

after providing the second secured token to the client device, receiving a second communication;

identifying from the second communication a third secured token;

processing the third secured token to obtain a third value of the counter indicating the number of times the information indicating the state of the digital interaction was changed by the at least one computer; and

determining that the second communication is from the client device when the third value matches the second value.

3. The method of claim 1 , wherein processing the first secured token to determine whether the communication is from the client device comprises:

comparing the information indicating the state of the digital interaction with information about the state of the digital interaction maintained by the at least one computer.

4. The method of claim 1 ,

wherein the first secured token comprises an encrypted token,

wherein processing the first secured token comprises decrypting the encrypted token to obtain a decrypted token, and

wherein providing the second secured token comprises encrypting a token comprising the updated information indicating the state of the digital interaction.

5. The method of claim 1 , further comprising generating the second secured token.

6. The method of claim 2 , further comprising:

identifying from the second communication a request to update information,

when it is determined that the second communication is not from the client device, denying the request to update the information, and

when it is determined that the second communication is from the client device, updating or causing another computer to update the information.

7. The method of claim 2 , further comprising:

identifying from the second communication a request for a user-specified action to be committed,

when it is determined that the second communication is not from the client device, denying the request to commit the user-specified action, and

when it is determined that the second communication is from the client device, committing or causing another computer to commit the user-specified action.

8. A system for ascertaining legitimacy of communications received by the at least one computer during a communication digital interaction between at least one computer and a client device, the system comprising:

the at least one computer; and

at least one non-transitory computer-readable storage medium that storing processor-executable instructions that, when executed by the at least one computer, cause the at least one computer to perform:

receiving a communication;

identifying from the communication a first secured token and a request to access a web page;

processing the first secured token by:

obtaining, from the first secured token, information indicating a state of the digital interaction, wherein the information indicating the state of the digital interaction comprises a first value of a counter, the counter indicating a number of times the information indicating the state of the digital interaction has been changed by the at least one computer during the digital interaction; and

using the information indicating the state of the digital interaction to determine whether the communication is from the client device at least in part by determining whether the first value of the counter matches a value of the counter provided to the client device by the at least one computer prior to receiving the communication;

when it is determined that the communication is not from the client device, denying access to the requested web page; and

when it is determined that the communication is from the client device,

providing the client device access to the web page;

updating the information indicating the state of the digital interaction to obtain updated information indicating the state of the digital interaction, the updating comprising increasing the counter from the first value to a second value;

including the updated information indicating the state of the digital interaction in a second secure token, wherein the updated information indicating the state of the digital interaction comprises the second value of the counter; and

providing the second secured token to the client device for use in a subsequent communication during the digital interaction.

9. The system of claim 8 , wherein the processor-executable instructions further cause the at least one computer to perform:

after providing the second secured token to the client device, receiving a second communication;

identifying from the second communication a third secured token;

processing the third secured token to obtain a third value of the counter indicating the number of times the information indicating the state of the digital interaction was changed by the at least one computer; and

determining that the second communication is a communication from the client device when the third value matches the second value.

10. The system of claim 8 , wherein the first secured token comprises an encrypted token, wherein processing the first secured token comprises decrypting the encrypted token to obtain a decrypted token, and wherein providing the second secured token comprises encrypting a token comprising the updated information indicating the state of the digital interaction.

11. The system of claim 9 , wherein the processor-executable instructions further cause the at least one computer to perform:

identifying from the second communication a request to update information,

when it is determined that the second communication is not from the client device, denying the request to update the information; and

when it is determined that the second communication is from the client device, updating or causing another computer to update the information.

12. The system of claim 9 , wherein the processor-executable instructions further cause the at least one computer to perform:

identifying from the second communication a request for a user-specified action to be committed,

when it is determined that the second communication is not from the client device, denying the request to commit the user-specified action, and

when it is determined that the second communication is from the client device, committing or causing another computer to commit the user-specified action.

13. At least one non-transitory computer-readable storage medium that storing processor-executable instructions that, when executed by at least one computer, cause the at least one computer to perform a method for ascertaining legitimacy of communications received by the at least one computer during a communication digital interaction between at least one computer and a client device, the method comprising:

receiving a communication;

identifying from the communication a first secured token and a request to access a web page;

processing the first secured token by:

obtaining, from the first secured token, information indicating a state of the digital interaction, wherein the information indicating the state of the digital interaction comprises a first value of a counter, the counter indicating a number of times the information indicating the state of the digital interaction has been changed by the at least one computer during the digital interaction; and

using the information indicating the state of the digital interaction to determine whether the communication is from the client device at least in part by determining whether the first value of the counter matches a value of the counter provided to the client device by the at least one computer prior to receiving the communication;

when it is determined that the communication is not from the client device, denying access to the requested web page; and

when it is determined that the communication is from the client device,

providing the client device access to the web page;

updating the information indicating the state of the digital interaction to obtain updated information indicating the state of the digital interaction, the updating comprising increasing the counter from the first value to a second value;

including the updated information indicating the state of the digital interaction in a second secure token, wherein the updated information indicating the state of the digital interaction comprises the second value of the counter; and

providing a second secured token to the client device for use in a subsequent communication during the digital interaction.

14. The at least one non-transitory computer-readable storage medium of claim 13 , wherein method further comprises:

after providing the second secured token to the client device, receiving a second communication;

identifying from the second communication a third secured token;

processing the third secured token to obtain a third value of the counter indicating the number of times the information indicating the state of the digital interaction was updated by the at least one computer; and

determining that the second communication is a communication from the client device when the third value matches the second value.

15. The at least one non-transitory computer-readable storage medium of claim 13 ,

wherein the first secured token comprises an encrypted token,

wherein processing the first secured token comprises decrypting the encrypted token to obtain a decrypted token, and

wherein providing the second secured token comprises encrypting a token comprising the updated information indicating the state of the digital interaction.

16. The at least one non-transitory computer-readable storage medium of claim 14 , wherein the method further comprises:

identifying from the second communication a request to update information,

when it is determined that the second communication is not from the client device, denying the request to update the information, and

when it is determined that the second communication is from the client device, updating or causing another computer to update the information.

17. The at least one non-transitory computer-readable storage medium of claim 14 , wherein the method further comprises:

identifying from the second communication a request for a user-specified action to be committed,

when it is determined that the second communication is not from the client device, denying the request to commit the user-specified action, and

when it is determined that the second communication is from the client device, committing or causing another computer to commit the user-specified action.