Patent ID: 9674195
Date: 2017-06-06
CPC Classifications: H04L

Claim:
1. A computer implemented method for automatically identifying Network Address Translation (“NAT”) systems by detecting highly authenticated operations being made by multiple users from individual Internet Protocol (“IP”) addresses, the method comprising the steps of: Authenticating users of a web service, by a computer, wherein authenticating the users further comprises authenticating the users in response to the users having successfully performed a highly authenticated operation, the highly authenticated operation being at least one of: a financial transaction, an identity proofing, and a multifactor authentication; tracking, by the computer, successful highly authenticated operations performed by the users of the web service, wherein tracking the successful highly authenticated operations further comprises tracking a specific user that performed the highly authenticated operation, an IP address from which the highly authenticated operation originated and a time at which the highly authenticated operation was performed; identifying, by the computer, a NAT system as operating in conjunction with a specific IP address, in response to a threshold number of different users successfully performing highly authenticated operations from the specific IP address within a specific amount of time; estimating, by the computer, a total plural number of users operating from behind the identified NAT system, based on a rate at which the different users successfully perform highly authenticated operations originating from the specific IP address, wherein the highly authenticated operations cannot be automatically generated to simulate multiple users behind a single IP address; and adjusting a rate limiting policy of the web service for the specific IP address by performing at least one of: increasing a rate limiting threshold for the specific IP address, using Completely Automated Public Turning test to tell Computers and Humans Apart (“CAPTCHA”) based rate limiting for the specific IP address, and disabling rate limiting for the specific IP address.