Granted Patent B1

US 12,407,720 · App. 18/112,987 · Granted Sep 2, 2025

Inventors: Yaniv Shemesh (Sammanish, WA); David Stav (Mountain View, CA)

Assignee: F5, Inc.

H04L63/1458H04L63/1416

Abstract

Claims (16)

1. A method for preventing D/DOS attack on a web resource, the method implemented by a network traffic management system comprising one or more network traffic apparatuses, client devices, or server devices, the method comprising:

receiving a request for a web resource from a client, wherein the request comprises referrer header information;

determining whether the domain in the referrer header information is one of a subdomain, a cross domain, or a related external domain;

in response to determining the domain is not one of the subdomain, the cross domain, or the related external domain, determining the received referrer header information comprises a known domain and a valid cookie associated with the known domain to designate the received header information as validated referral header information; and

preventing a distributed denial of service attack by providing a proactive challenge to the requesting client then the determination indicates the received referrer header information is the validated referrer header information, wherein the proactive challenge comprises:

injecting an obtained obfuscated JavaScript in a URL; and

transmitting the URL to the client.

2. The method as set forth in claim 1 further comprising providing the requested web resource when the received referrer header information is determined to include the known domain and the valid cookie associated with the known domain.

3. The method as set forth in claim 1 further comprising determining when the received referrer header information comprises a subdomain, a cross domain or, a related external domain when the received referrer header information is determined not to include the known domain.

4. The method as set forth in claim 1 further comprising:

determining when there is the valid cookie associated with the subdomain, the cross domain or, the related external domain when the received referrer header information is determined to include the subdomain, the cross domain or, the related external domain; and

preventing the distributed denial of service attack by providing the proactive challenge to the requesting client when cookie is not determined to be valid.

5. The method as set forth in claim 1 wherein the preventing further comprises:

receiving a response for the proactive challenge from the client;

determining when the received response is accurate by comparing the received response with a stored response; and

providing access to the requested web resource when the received response is determined to be accurate.

Continuity (2)

References Cited (142)