Deterministic reproduction of system state using seeded pseudo-random number generators

Abstract

Computer systems and methods for improving the security and efficiency of client computers interacting with server computers through an intermediary computer using one or more polymorphic protocols are discussed herein. In an embodiment, a computer system comprises a memory; one or more processors coupled to the memory and configured to: generate a modified identifier for a original object based on a original identifier and a nonce; render one or more instructions that include the nonce and define a modified object that corresponds to the original object and includes the modified identifier; send the one or more instructions to a client computer, wherein the one or more instructions, when executed by the client computer, are configured to cause the client computer to send a request from the client computer with the modified identifier and the nonce; receive, from the client computer, a request with a challenge identifier and a challenge nonce; generate a test identifier based on the original identifier and the challenge nonce; determine whether the test identifier matches the challenge identifier.

What is claimed is: 
     
         1 . A computer system configured to improve security of client computers interacting with server computers, comprising:
 a memory;   one or more processors coupled to the memory and configured to:   receive a first set of one or more instructions that define one or more first original objects, wherein each original object of the one or more first original objects is associated with a respective original value;   for each original object of the one or more first original objects, generate a respective modified value based on the original value associated with the original object and a first nonce;   render a second set of one or more instructions that include the first nonce and one or more modified objects, wherein each modified object of the one or more modified objects corresponds to a respective original object and is associated with the respective modified value of the respective original object, and wherein the second set of one or more instructions, when executed by a client computer, are configured to cause the client computer to include the first nonce and one or more modified object values in requests to the computer system;   send the second set of one or more instructions to the client computer;   receive, from the client computer, a first request that includes one or more first challenge values and a first challenge nonce;   generate one or more first test values based on original values associated with the one or more first original objects and the first challenge nonce;   determine whether the one or more first challenge values match the one or more first test values;   validate the first request from the client computer based on determining whether the one or more first challenge values match the one or more first test values.   
     
     
         2 . The computer system of  claim 1 , wherein determining whether the one or more first challenge values match the one or more first test values comprises determining whether each challenge value of the one or more first challenge values matches at least one test value of the one or more first test values. 
     
     
         3 . The computer system of  claim 1 , wherein the one or more first original objects are associated with a first order, wherein the one or more first challenge values are associated with a second order, and wherein the one or more processors are further configured to:
 determine whether the first order matches the second order;   wherein validating the first request is further based on determining whether the first order matches the second order.   
     
     
         4 . The computer system of  claim 1 , wherein the one or more first original objects are associated with a first set identifier, wherein the first request includes the first set identifier, and wherein the one or more processors are further configured to:
 determine the first set identifier is associated with the one or more first original objects;   wherein generating the one or more first test values is based on determining that the first set identifier is associated with the one or more first original objects.   
     
     
         5 . The computer system of  claim 4 , wherein the first set identifier comprises at least a portion of a Uniform Resource Locator. 
     
     
         6 . The computer system of  claim 4 , wherein the first set identifier comprises a HyperText Transfer Protocol verb. 
     
     
         7 . The computer system of  claim 4 , wherein the first set identifier is further associated with one or more criteria, wherein the one or more processors are further configured to:
 determine the first set identifier is associated with the one or more criteria;   determine whether the one or more first challenge values satisfy the one or more criteria;   wherein validating the first request is further based on determining whether the one or more first challenge values satisfy the one or more criteria.   
     
     
         8 . The computer system of  claim 4 , wherein a second set identifier is associated with one or more second original objects, wherein each second original object of the one or more second original objects is associated with a respective original value, wherein the original values associated with the one or more second original objects are different from the original values associated with the one or more first original objects, wherein the one or more processors are further configured to:
 receive, from the client computer, a second request that includes the second set identifier, one or more second challenge values, and a second challenge nonce;   determine the second set identifier is associated with the one or more second original values;   in response to determining the second set identifier is associated with the one or more second original objects, generate one or more second test values based on original values associated with the one or more second original objects and the second challenge nonce;   determine whether the one or more second test values match the one or more second challenge values;   validate the second request from the client computer based on determining whether the one or more second challenge values match the one or more second test values.   
     
     
         9 . The computer system of  claim 8 , wherein the first set identifier comprises at least a portion of a first Uniform Resource Locator and the second set identifier comprises at least a portion of a second Uniform Resource Location that is different than the first Uniform Resource Locator. 
     
     
         10 . The computer system of  claim 1 , wherein the one or more processors are further configured to, in response to determining that the one or more first challenge values do not match the one or more first test values, perform a negative response. 
     
     
         11 . A method for improving security of client computers interacting with server computers, comprising:
 receiving a first set of one or more instructions that define one or more first original objects, wherein each original object of the one or more first original objects is associated with a respective original value;   for each original object of the one or more first original objects, generating a respective modified value based on the original value associated with the original object and a first nonce;   rendering a second set of one or more instructions that include the first nonce and one or more modified objects, wherein each modified object of the one or more modified objects corresponds to a respective original object and is associated with the respective modified value of the respective original object, and wherein the second set of one or more instructions, when executed by a client computer, are configured to cause the client computer to include the first nonce and one or more modified object values in requests to the computer system;   sending the second set of one or more instructions to the client computer;   receiving, from the client computer, a first request that includes one or more first challenge values and a first challenge nonce;   generating one or more first test values based on original values associated with the one or more first original objects and the first challenge nonce;   determining whether the one or more first challenge values match the one or more first test values;   validating the first request from the client computer based on determining whether the one or more first challenge values match the one or more first test values.   
     
     
         12 . The method of  claim 11 , wherein determining whether the one or more first challenge values match the one or more first test values comprises determining whether each challenge value of the one or more first challenge values matches at least one test value of the one or more first test values. 
     
     
         13 . The method of  claim 11 , wherein the one or more first original objects are associated with a first order, wherein the one or more first challenge values are associated with a second order, and the method further comprising:
 determining whether the first order matches the second order;   wherein validating the first request is further based on determining whether the first order matches the second order.   
     
     
         14 . The method of  claim 11 , wherein the one or more first original objects are associated with a first set identifier, wherein the first request includes the first set identifier, and the method further comprising:
 determining the first set identifier is associated with the one or more first original objects;   wherein generating the one or more first test values is based on determining that the first set identifier is associated with the one or more first original objects.   
     
     
         15 . The method of  claim 14 , wherein the first set identifier comprises at least a portion of a Uniform Resource Locator. 
     
     
         16 . The method of  claim 14 , wherein the first set identifier comprises a HyperText Transfer Protocol verb. 
     
     
         17 . The method of  claim 14 , wherein the first set identifier is further associated with one or more criteria, the method further comprising:
 determining the first set identifier is associated with the one or more criteria;   determining whether the one or more first challenge values satisfy the one or more criteria;   wherein validating the first request is further based on determining whether the one or more first challenge values satisfy the one or more criteria.   
     
     
         18 . The method of  claim 14 , wherein a second set identifier is associated with one or more second original objects, wherein each second original object of the one or more second original objects is associated with a respective original value, wherein the original values associated with the one or more second original objects are different from the original values associated with the one or more first original objects, and the method further comprising:
 receiving, from the client computer, a second request that includes the second set identifier, one or more second challenge values, and a second challenge nonce;   determining the second set identifier is associated with the one or more second original values;   in response to determining the second set identifier is associated with the one or more second original objects, generating one or more second test values based on original values associated with the one or more second original objects and the second challenge nonce;   determining whether the one or more second test values match the one or more second challenge values;   validating the second request from the client computer based on determining whether the one or more second challenge values match the one or more second test values.   
     
     
         19 . The method of  claim 18 , wherein the first set identifier comprises at least a portion of a first Uniform Resource Locator and the second set identifier comprises at least a portion of a second Uniform Resource Location that is different than the first Uniform Resource Locator. 
     
     
         20 . The method of  claim 11 , further comprising, in response to determining that the one or more first challenge values do not match the one or more first test values, perform a negative response.