Method and system to dynamically obfuscate a web services interface
The present application relates to the handling of what are generally referred to as denial of service (DoS) attacks. More specifically, the present application relates to a method and system for protecting one or more on-line Web service application servers from DoS and/or distributed DoS (DDoS) attacks.
1. A method for operating a system that uses a dynamically generated web services interface to protect a processor of service requests from attacks received via a data communication network, the method comprising:
receiving a first service request, by a first processor from a client system via the data communication network, the first service request comprising an identifier of the client system, a service identifier, and a service key;
producing, by the first processor, a client date and time by deciphering a portion of the service identifier using the identifier of the client system;
determining, by the first processor, whether the first service request is an initial service request received by the first processor from the client system;
identifying, by the first processor, a first match of the client date and time with a default date and time, if it is determined that the first service request is the initial service request received from the client system;
identifying, by the first processor, a second match of the client date and time with a date and time of receipt of a previous service request received from the client system, if it is determined that the first service request is not the initial service request received from the client system;
sending a second service request, by the first processor to a second processor, if either the first match or the second match is identified, wherein the second service request comprises a service name portion and the service key; and
forwarding, by the first processor to the client system, a response of the second processor to the second service request.
2. The method according to claim 1 , wherein the service identifier comprises a service name portion and a dynamic key portion.
3. The method according to claim 2 , wherein the service name portion identifies a service to be performed for the client system by the second processor.
4. The method according to claim 2 , wherein deciphering a portion of the service identifier comprises deciphering the dynamic key portion of the service identifier using the identifier of the client system to produce the client date and time.
5. The method according to claim 4 , wherein the particular date and time is the default date and time, if a service request sent by the client system is the initial service request sent to the first processor.
6. The method according to claim 1 , wherein the service identifier is not a valid service name portion accepted by the second processor.
7. The method according to claim 1 , further comprising:
sending an error indication, by the first processor to the client system, if both the first match and the second match are not identified.
8. The method according to claim 1 , further comprising:
discarding the first service request, by the first processor, if both the first match and the second match are not identified.
9. The method according to claim 1 , wherein sending a second service request comprises:
placing in storage coupled to the first processor, a date and time of receipt of the first service request, in association with the identifier of the client system.
10. The method according to claim 1 , wherein the first processor comprises web server circuitry.
11. The method according to claim 1 , wherein the first processor comprises web service protection circuitry that is operatively coupled to a web server.
12. The method according to claim 1 , wherein the first processor is operable to identify the client system as an authorized client system when the produced client date and time matches a default date and time.
13. The method according to claim 1 , wherein the second processor comprises application server circuitry.
14. The method according to claim 1 , wherein the first processor is operable to send an error indication to the client system if the client system is not identified as an authorized client system.
15. The method according to claim 1 , wherein the first processor is operable to discard the first service request if the client system is not identified as an authorized client system.