Client confirmation method and system

• US 10,057,230 B2
• Filed: 09/09/2015
• Issued: 08/21/2018
• Est. Priority Date: 07/09/2015
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Inventors: Petrack, Scott
• Primary Examiner(s): Hirl, Joseph P
• Assistant Examiner(s): GYORFI, THOMAS A
• Application Number:
  US14/849,124
• Publication Number:
  US 20170012955A1
• Time in Patent Office: 1,077 Days
• CPC Class Codes: H04L 45/74 Address processing for routing
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/025 for remote control or remote monitoring of applications
• CPC Class Codes: H04L 67/104 Peer-to-peer [P2P] networks
• CPC Class Codes: H04L 67/55 Push-based network services
• CPC Class Codes: H04L 67/564 Enhancement of application control based on intercepted application data

Abstract

A client confirmation method and system for identifying data traffic transmitted over a network controlled by an operator, the data traffic being associated with at least one client, the client confirmation system comprising: a client confirmation application configured to identify at least one client address; an authenticator configured to authenticate the at least one client identified by the at least one client address by analyzing data usage information generated by the at least one client, wherein the data usage information is further known to the operator; and a traffic associator configured to associate data traffic transmitted over the network with the at least one client identified by the at least one client address.

Claims

1. A client confirmation system for identifying data traffic transmitted over a first network, the data traffic being associated with a client, the client confirmation system comprising:

one or more hardware processors configured to;

obtain first data usage information for a client, the first data usage information based on a plurality of data transmissions over the first network that include a client network address of the client on the first network;

determine, based on the client network address for the first network, an identifier of a second network on which the client is operating;

determine, based on the second network identifier, an address on the first network of a client authenticating service for the second network;

obtain second data usage information for the client from the authenticating service based on the address on the first network;

compare the first data usage information to the second data usage information and authenticate the client if the second data usage information generated by the client and the first data usage information agree.

2. The client confirmation system as claimed in claim 1, wherein the one or more hardware processors are further configured to rate the data traffic associated with the client according to a defined rating associated with the client.

3. The client confirmation system as claimed in claim 1, wherein the one or more hardware processors are further configured to determine at least one of:

an internet protocol address;

port number identifier where the client is operating in a peer-to-client network; and

a port number identifier where the client is operating in a peer-to-peer network.

4. The client confirmation system as claimed in claim 1, further comprising:

a requesting client configured to generate a client confirmation request for the client identified by the at least one client address, and further configured to transmit the client confirmation request to a request handler to authenticate the client.

5. The client confirmation system as claimed in claim 4, wherein the one or more hardware processors are further configured to:

receive the client confirmation request from the requesting client device, the client confirmation request comprising the at least one client address;

determine a routing address associated with a user device hosting the request handler from a combination of the second network identifier and the at least one client address;

communicate with the user device hosting the request handler via a traffic router using the routing address to receive a response from the user device, the response being associated with the client; and

transmit the client confirmation response to the requesting client comprising the authenticator for confirming the client is a valid client based on the response from the user device.

6. The client confirmation system as claimed in claim 5, wherein the client comprises the request handler.

7. The client confirmation system as claimed in claim 6, wherein the one or more hardware processors are further configured to:

generate a routing request comprising the second network identifier and the client address;

transmit the routing request to a client register, wherein the client register identifies from the second network identifier and the client address a uniform resource identifier (URI) identifying the current routing address for the user device hosting the client; and

receive the URI identifying the current routing address for the user device hosting the client the current routing address for the user device.

8. The client confirmation system as claimed in claim 7, wherein the one or more hardware processors are further configured to:

generate a https query for the URI identifying the current routing address for the user device hosting the client, such that the query is received and forwarded to the user device hosting the client which responds to the https query with a https response identifying the validity of the client; and

receive the Imps response via the current routing address identifying the validity of the client.

9. The client confirmation system as claimed in claim 6, wherein the client confirmation response comprises the second data usage information generated by the client.

10. The client confirmation system as claimed in claim 6, herein the one or more hardware processors are further configured to:

receive from a user device hosting the client a request for configuration information for use of the network;

generate the at least one client address for the user device hosting the client; and

transmit to the user device the at least one client address and the second network identifier.

11. The client confirmation system as claimed in claim 10, wherein the one or more hardware processors are further configured to:

receive from the user device hosting the client a request for registration on the network, the request for registration comprising the client address for the user device hosting the client, the second network identifier and a URI identifying the current routing address for the user device hosting the client;

store the client address for the user device hosting the client, the second network identifier and a URI identifying the current routing address for the user device hosting the client such that user device hosting the client can be uniquely identified within the network by a combination of the second network identifier and the client address and the user device may be located via the URI identifying the current routing address for the user device hosting the client.

12. The client confirmation system as claimed in claim 1, wherein the one or more hardware processors are further configured to:

receive the second data usage information from the client;

store the second data usage information; and

transmit the second data usage information to at least one authenticator within a requesting client for authenticating the client.

13. The client confirmation system as claimed in claim 12, wherein the one or more hardware processors are further configured to transmit the first data usage information to at least one requesting client for authenticating and the client is configured to transmit the first data usage information to at least one requesting client in response to a client confirmation request from the at least one requesting client.

14. The client confirmation system as claimed in claim 12, wherein the one or more hardware processors are further configured to transmit the first data usage information to at least one requesting client for authenticating the client.

15. The client confirmation system as claimed in claim 1, wherein the first data usage information comprises a client connection list;

the client connection list comprising data flow quintuples associated with the client of {TCP or UDP, local address, local port, remote address, remote port} from a defined time.

16. The client confirmation system as claimed in claim 1, wherein the first data usage information comprises a report value, the report value comprising:

byte-counts of a measured client data transmitted and received by the user device since whichever is later from the previous midnight (0000 UTC) or the time the client last joined the network; and

a timestamp of the start time for the measured client data and the end time of the query period.

17. A method for identifying data traffic transmitted over a network controlled by an operator, the data traffic being associated with a client, the method comprising:

obtaining first data usage information for a client, the first data usage information based on a plurality of data transmissions over the first network that include a client network address of the client on the first network;

determining, based on the client network address for the first network, an identifier of a second network on which the client is operating;

determining, based on the second network identifier, an address on the first network of a client authenticating service for the second network;

obtaining second data usage information for the client from the authenticating service based on the address on the first network;

comparing the first data usage information to the second data usage information; and

authenticating the client if the second data usage information and the first data usage information agree.

18. A computer program product, the computer program product being embodied on a computer-readable storage medium and configured so as when executed on a processor of a user device within a communications architecture, to:

obtaining first data usage information for a client, the first data usage information based on a plurality of data transmissions over the first network that include a client network address of the client on the first network;

determining, based on the client network address for the first network, an identifier of a second network on which the client is operating;

determining, based on the second network identifier, an address on the first network of a client authenticating service for the second network;

obtaining second data usage information for the client from the authenticating service based on the address on the first network;

comparing the first data usage information to the second data usage information; and

authenticating the client if the second data usage information and the first data usage information agree.