Abstract: A challenge-response method and apparatus to defend a system against Denial of service (DOS)/Distributed Denial of Service (DDOS) attacks, especially resource consumption attack, the method including: before committing resources to a client, throwing a challenge to the client, verifying a result generated by the client, and committing resources only if the verification is successful. When the client mounts an attack against a server by throwing multiple requests, the server will throw multiple challenges to the client and the client will get overloaded in resolving challenges thrown by the server as the server is able to control a cost of the challenge and verify responses generated for the challenge by investing minimal resources. Thus, the server's resources are free for legitimate users.