A method and apparatus for fine-grained, trust-based
rate limiting of network requests distinguishes trusted network traffic from untrusted network traffic at the
granularity of an individual user /
machine combination, so that network traffic policing measures are readily implemented against untrusted and potentially hostile traffic without compromising service to trusted users. A
server establishes a user /
client pair as trusted by issuing a trust token to the
client when successfully authenticating to the
server for the first time. Subsequently, the
client provides the trust token at login. At the
server, rate policies apportion bandwidth according to type of traffic: network requests that include a valid trust token are granted highest priority. Rate policies further specify bandwidth restrictions imposed for untrusted network traffic. This scheme enables the server to
throttle untrusted
password-guessing requests from crackers without penalizing most friendly logins and only slightly penalizing the relatively few untrusted friendly logins.