Granted Patent B2

US 12,206,789 · App. 17/217,703 · Granted Jan 21, 2025

Inventors: Watson Bernard Ladd (Berkeley, CA); Alexander Andrew Davidson (Lisbon, PT); Marwan Fayed (St Andrews, GB); Armando Faz Hernández (San Francisco, CA); Sai Krishna Deepak Maram (New York, NY); Nicholas Thomas Sullivan (San Francisco, CA)

Assignee: CLOUDFLARE, INC.

H04L9/3247G06F21/32H04L9/14

Abstract

Claims (88)

1. A method, comprising:

transmitting, from a client network application of a client device, a first request for a first network resource to a server;

receiving, from the server, a second request to challenge that the first request was initiated by a human user through verifying a first physical interaction between the human user and a hardware component, the second request being received prior to the first network resource being received at the client network application;

causing a first prompt to be displayed to perform the first physical interaction with the hardware component;

receiving a first cryptographic attestation that includes a first attestation signature that is generated after confirmation that the first physical interaction was performed with the hardware component;

generating a first zero-knowledge proof of the first attestation signature at the client device;

transmitting, from the client network application to the server, the first zero-knowledge proof of the first attestation signature for verification;

receiving the first network resource responsive to the server verifying the validity of the first zero-knowledge proof of the first attestation signature;

transmitting, from the client network application of the client device, a third request for a second network resource to the server;

receiving, from the server, a fourth request to challenge that the third request was initiated by a human user through verifying a second physical interaction between the human user and the hardware component, the third request being received prior to the second network resource being received at the client network application;

causing a second prompt to be displayed to perform the second physical interaction with the hardware component;

receiving a second cryptographic attestation that includes a second attestation signature that is generated after confirmation that the second physical interaction was performed with the hardware component;

generating a second zero-knowledge proof of the second attestation signature at the client device;

transmitting, from the client network application to the server, the second zero-knowledge proof of the second attestation signature for verification;

receiving a request for the human user to participate in a CAPTCHA challenge responsive to the server determining that the second zero-knowledge proof cannot be verified as valid;

presenting the CAPTCHA challenge;

transmitting, from the client network application to the server, a response to the CAPTCHA challenge; and

receiving the second network resource responsive to the server verifying the response to the CAPTCHA challenge.

2. The method of claim 1 , wherein the first cryptographic attestation is generated by an attestation system that is coupled with the client device.

3. The method of claim 2 , wherein the first cryptographic attestation is implemented by a hardware security key that is adapted to receive a capacitive touch as the first physical interaction.

4. The method of claim 2 , wherein the first attestation signature is generated using an internal secret key of the attestation system.

5. The method of claim 1 , wherein generating the first zero-knowledge proof proves that the client device has knowledge of the first attestation signature for a public key that is on a server-provided list of a plurality of public keys without revealing which one of the plurality of public keys is the public key.

6. The method of claim 5 , wherein the server-provided list of the plurality of public keys is maintained in a least-recently used (LRU) order.

7. A method, comprising:

receiving, from a first client network application, a first request for a network resource;

determining that verification that the first request is initiated by a first human user is to be performed;

transmitting to the first client network application a second request to challenge that the first human user initiated the first request, the second request being transmitted prior to fulfilling the first request;

receiving, from the first client network application in response to the second request to challenge, a first zero-knowledge proof of a first attestation signature to attest that the first human user has performed a first physical interaction;

verifying validity of the first zero-knowledge proof;

fulfilling the first request responsive to verifying validity of the first zero-knowledge proof;

receiving from a second client network application, a third request for the network resource;

determining that verification that the third request is initiated by a second human user is to be performed;

transmitting to the second client network application a fourth request to challenge that the second human user initiated the third request;

receiving, from the second client network application in response to the fourth request to challenge, a second zero-knowledge proof of a second attestation signature to attest that the second human user has performed a second physical interaction;

determining that the second zero-knowledge proof cannot be verified as valid; and

responsive to determining that the second zero-knowledge proof cannot be verified as valid, transmitting to the second client network application a fifth request for the second human user to participate in a CAPTCHA challenge before fulfilling the third request.

8. The method of claim 7 , wherein determining that verification that the first request is initiated by the first human user includes determining that a domain of first network resource is subject to a denial-of-service attack.

9. The method of claim 7 , wherein determining that verification that the first request is initiated by the first human user includes determining that a verification configuration setting is enabled and applicable for the network resource.

10. The method of claim 7 , wherein the determining that verification that the first request is initiated by the first human user includes determining a threat score associated with the first client network application indicates it is likely the first request is from a bot.

11. The method of claim 7 , further comprising performing a rate limiting based on IP addresses included in messages including zero-knowledge proofs.

12. The method of claim 7 , wherein verifying the validity of the first zero-knowledge proof proves that the first client network application has knowledge of the first attestation signature for a public key that is on a server-provided list of a plurality of public keys without revealing which one of the plurality of public keys is the public key.

13. The method of claim 12 , wherein the server-provided list of the plurality of public keys is maintained in a least-recently used (LRU) order.

14. A client device, comprising:

a processor; and

a non-transitory machine-readable storage medium that provides instructions that, when executed by the processor, will cause the client device to perform operations comprising:

transmitting, from a client network application of the client device, a first request for a first network resource to a server;

receiving, from the server, a second request to challenge that the first request was initiated by a human user through verifying a first physical interaction between the human user and a hardware component, the second request being received prior to the first network resource being received at the client network application;

causing a first prompt to be displayed to perform the first physical interaction with the hardware component;

receiving a first cryptographic attestation that includes a first attestation signature that is generated after confirmation that the first physical interaction was performed with the hardware component;

generating a first zero-knowledge proof of the first attestation signature at the client device;

transmitting, from the client network application to the server, the first zero-knowledge proof of the first attestation signature for verification; and

receiving the first network resource responsive to the server verifying the validity of the first zero-knowledge proof of the first attestation signature;

transmitting, from the client network application of the client device, a third request for a second network resource to the server;

receiving, from the server, a fourth request to challenge that the third request was initiated by a human user through verifying a second physical interaction between the human user and the hardware component, the third request being received prior to the second network resource being received at the client network application;

causing a second prompt to be displayed to perform the second physical interaction with the hardware component;

receiving a second cryptographic attestation that includes a second attestation signature that is generated after confirmation that the second physical interaction was performed with the hardware component;

generating a second zero-knowledge proof of the second attestation signature at the client device;

transmitting, from the client network application to the server, the second zero-knowledge proof of the second attestation signature for verification;

receiving a request for the human user to participate in a CAPTCHA challenge responsive to the server determining that the second zero-knowledge proof cannot be verified as valid;

presenting the CAPTCHA challenge;

transmitting, from the client network application to the server, a response to the CAPTCHA challenge; and

receiving the second network resource responsive to the server verifying the response to the CAPTCHA challenge.

15. The client device of claim 14 , wherein the client device receives the first cryptographic attestation from an attestation system coupled with the client device.

16. The client device of claim 15 , wherein the first cryptographic attestation is implemented by a hardware security key that is adapted to receive a capacitive touch as the first physical interaction.

17. The client device of claim 15 , wherein the first attestation signature is generated using an internal secret key of the attestation system.

18. The client device of claim 14 , wherein generating the first zero-knowledge proof proves that the client device has knowledge of the first attestation signature for a public key that is on a server-provided list of a plurality of public keys without revealing which one of the plurality of public keys is the public key.

19. The client device of claim 18 , wherein the server-provided list of the plurality of public keys is maintained in a least-recently used (LRU) order.

20. A server, comprising:

a processor; and

a non-transitory machine-readable storage medium that provides instructions that, when executed by the processor, will cause the server to perform operations comprising:

receiving, from a first client network application, a first request for a network resource;

determining that verification that the first request is initiated by a first human user is to be performed;

transmitting to the first client network application a second request to challenge that the first human user initiated the first request, the second request being transmitted prior to fulfilling the first request;

receiving, from the first client network application in response to the second request to challenge, a first zero-knowledge proof of a first attestation signature to attest that a human user has performed a first physical interaction;

verifying validity of the first zero-knowledge proof;

fulfilling the first request responsive to verifying validity of the first zero-knowledge proof;

receiving from a second client network application, a third request for the network resource;

determining that verification that the third request is initiated by a second human user is to be performed;

transmitting to the second client network application a fourth request to challenge that the second human user initiated the third request;

receiving, from the second client network application in response to the fourth request to challenge, a second zero-knowledge proof of a second attestation signature to attest that the second human user has performed a second physical interaction;

determining that the second zero-knowledge proof cannot be verified as valid; and

responsive to determining that the second zero-knowledge proof cannot be verified as valid, transmitting to the second client network application a fifth request for the second human user to participate in a CAPTCHA challenge before fulfilling the third request.

21. The server of claim 20 , wherein determining that verification that the first request is initiated by the first human user includes determining that a domain of the network resource is subject to a denial-of-service attack.

22. The server of claim 20 , wherein determining that verification that the first request is initiated by the first human user includes determining that a verification configuration setting is enabled and applicable for the network resource.

23. The server of claim 20 , wherein the determining that verification that the first request is initiated by the first human user includes determining a threat score associated with the first client network application indicates it is likely the first request is from a bot.

24. The server of claim 20 , further comprising performing a rate limiting based on IP addresses included in messages including zero-knowledge proofs.

25. The server of claim 20 , wherein verifying the validity of the first zero-knowledge proof proves that the first client network application has knowledge of the first attestation signature for a public key that is on a server-provided list of a plurality of public keys without revealing which one of the plurality of public keys is the public key.

26. The server of claim 25 , wherein the server-provided list of the plurality of public keys is maintained in a least-recently used (LRU) order.

Assignments (2)

Continuity (1)

References Cited (28)

Cited By (1)

US 12,321,428