Generating mobile device-specific identifiers across native mobile applications and mobile browsers

• US 10,554,616 B1
• Filed: 12/08/2017
• Issued: 02/04/2020
• Est. Priority Date: 12/08/2017
• Status: Active Grant

• Current Assignee: Criteo Technology SAS (Criteo SA)
• Original Assignee: Criteo SA
• Inventors: Teodosiu, Dan, Roggeri, Bruno, Bourcier, Philippe Joseph Francois, Davis, Paul Bryan, Ma, Jimmy, Courtois, Baptiste Gerard Adrien Marie
• Primary Examiner(s): Dalencourt, Yves
• Application Number:
  US15/836,697
• Time in Patent Office: 788 Days
• CPC Class Codes: G06Q 30/0267 Wireless devices
• CPC Class Codes: G06Q 30/0275 Auctions
• CPC Class Codes: G06Q 30/0601 Electronic shopping [e-shopping]
• CPC Class Codes: H04L 2101/35 containing special prefixes
• CPC Class Codes: H04L 2101/604 Address structures or formats
• CPC Class Codes: H04L 2101/659 Internet protocol version 6 [IPv6] addresses
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/50 Address allocation
• CPC Class Codes: H04L 61/58 Caching of addresses or names
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 69/16 Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]
• CPC Class Codes: H04W 12/08 Access security

Abstract

Described herein are methods and systems for generating a mobile device-specific identifier usable across native mobile applications and mobile browsers with a unified opt-out mechanism. A mobile device generates a transient identifier for the mobile device and maps the transient identifier to a stable identifier of the mobile device using at least one call to a service endpoint coupled to the mobile device via a communications network. A browser application on the mobile device renders a webpage, the webpage comprising first instructions, executed by the browser application, to retrieve the stable identifier of the mobile device using at least one call to the service endpoint coupled to the mobile device via a communications network.

Claims

1. A system for generating a mobile device-specific identifier usable across native mobile applications and mobile browsers, the system comprising a mobile device that:

generates a transient identifier for the mobile device and maps the transient identifier to a stable identifier of the mobile device using at least one call to a service endpoint coupled to the mobile device via a communications network; and

renders a webpage in a browser application, the webpage comprising first instructions, executed by the browser application, to retrieve the stable identifier of the mobile device using at least one call to the service endpoint coupled to the mobile device via a communications network;

wherein said generating a transient identifier for the mobile device and mapping the transient identifier to the stable identifier of the mobile device using at least one call to a service endpoint comprises;

establishing, by the mobile device, a plurality of connections to a second service endpoint, each connection on a different subdomain, wherein when establishing the plurality of connections, the mobile device performs Domain Name System (DNS) resolution on each different subdomain to generate an IP address for the subdomain;

generating, for each DNS resolution, by a DNS server associated to each different subdomain, an IP address for the associated subdomain comprising a random subset of bits;

extracting and returning, by the second service endpoint, the random subset of bits for each of the plurality of connections;

generating, by the mobile device, the transient identifier using at least one of the returned random subsets of bits from each DNS resolution;

retrieving, by the mobile device, the stable identifier of the mobile device;

establishing, by the mobile device, a connection to the service endpoint;

sending, by the mobile device, the stable identifier of the mobile device and the transient identifier to the service endpoint; and

storing, by the service endpoint, a mapping between the transient identifier and the stable identifier of the mobile device.

2. The system of claim 1, wherein the stable identifier is an iOS™

IDFA.

3. The system of claim 1, wherein the stable identifier is an Android™

AAID.

4. The system of claim 1, wherein the retrieved stable identifier is based at least in part on a locally-stored value in the browser application.

5. The system of claim 1, wherein the webpage contains second instructions to track user activity based on the retrieved stable identifier.

6. The system of claim 5, wherein tracking user activity comprises capturing one or more attributes associated with user activity on a website in the browser application.

7. The system of claim 6, wherein user activity comprises one or more of:

a visit to a product webpage, a search for a product, a visit to a category webpage, an add-to-cart action, or a completion of a transaction.

8. The system of claim 5, wherein the website is an ecommerce retailer website.

9. The system of claim 1, wherein the webpage contains third instructions to identify the mobile device to an ad server or an RTB platform based on the retrieved stable identifier, as part of a bid request associated with at least one ad impression opportunity.

10. The system of claim 1, wherein generating a transient identifier for the mobile device and mapping the transient identifier to the stable identifier of the mobile device using at least one call to a service endpoint comprises:

retrieving, by the mobile device, the stable identifier of the mobile device;

establishing, by the mobile device, a connection to the service endpoint;

sending, by the mobile device, the stable identifier to the service endpoint;

generating, by the service endpoint, the transient identifier; and

storing, by the service endpoint, a mapping between the transient identifier and the stable identifier of the mobile device.

11. The system of claim 10, wherein establishing a connection to the service endpoint comprises:

establishing, by the mobile device, a TCP connection to the service endpoint; and

performing, by the mobile device, an HTTP request over the TCP connection.

12. The system of claim 11, wherein generating the transient identifier by the service endpoint comprises:

extracting at least one of TSval or TSecr from TCP timestamp options of at least one TCP packet received from the mobile device over the TCP connection; and

generating the transient identifier using at least one of TSval, TSecr, a clock time associated with the service endpoint, and a source IP address of the TCP connection.

13. The system of claim 12, wherein the service endpoint:

determines a latency associated with the TCP connection using TSecr and the clock time of the service endpoint; and

generates the transient identifier using a concatenation of (i) the source IP address and (ii) a difference between the clock time of the service endpoint, TSval, and the latency associated with the TCP connection.

14. The system of claim 11, wherein generating the transient identifier by the service endpoint comprises:

identifying the source IPv6 address of the TCP connection; and

generating the transient identifier using the source IPv6 address.

15. The system of claim 11, wherein the service endpoint:

identifies the source IP address of the TCP connection;

determines that the identified source IP address is included in a blacklist; and

discards one or more requests from a mobile device associated with the identified source IP address.

16. The system of claim 15, wherein the blacklist contains one or more IP addresses that generate substantial amounts of traffic with the same transient identifier.

17. The system of claim 16, wherein the one or more IP addresses in the blacklist correspond to one or more proxies, or to fraudulent traffic.

18. The system of claim 10, wherein establishing a connection to the service endpoint comprises:

establishing, by the mobile device, a TCP connection to the service endpoint; and

performing, by the mobile device, an HTTPS request over the TCP connection.

19. The system of claim 18, wherein generating the transient identifier by the service endpoint comprises:

extracting at least one of TSval or TSecr from TCP timestamp options of at least one TCP packet received from the mobile device over the TCP connection; and

generating the transient identifier using at least one of TSval, TSecr, a clock time associated with the service endpoint, and a source IP address of the TCP connection.

20. The system of claim 19, wherein the service endpoint:

determines a latency associated with the TCP connection using TSecr and the clock time of the service endpoint; and

generates the transient identifier using a concatenation of (i) the source IP address and (ii) a difference between the clock time of the service endpoint, TSval, and the latency associated with the TCP connection.

21. The system of claim 18, wherein generating the transient identifier by the service endpoint comprises:

identifying the source IPv6 address of the TCP connection; and

generating the transient identifier using the source IPv6 address.

22. The system of claim 18, wherein the service endpoint:

identifies the source IP address of the TCP connection;

determines that the identified source IP address is included in a blacklist; and

discards one or more requests from a mobile device associated with the identified source IP address.

23. The system of claim 22, wherein the blacklist contains one or more IP addresses that generate substantial amounts of traffic with the same transient identifier.

24. The system of claim 23, wherein the one or more IP addresses in the blacklist correspond to one or more proxies, or to fraudulent traffic.

25. The system of claim 10, wherein the service endpoint allocates the transient identifier to one of a plurality of buckets to generate an updated transient identifier.

26. The system of claim 25, wherein allocation to one of a plurality of buckets is achieved by dividing a value range of the transient identifier into a number of equally-sized intervals, and computing a floor of the transient identifier divided by the size of an interval.

27. The system of claim 26, wherein the number of buckets is 4096.

28. The system of claim 1, wherein retrieving the stable identifier of the mobile device using at least one call to the service endpoint comprises:

establishing, by the mobile device, a connection to the service endpoint;

generating, by the service endpoint, a first transient identifier;

retrieving, by the service endpoint, the stable identifier of the mobile device, using a mapping between the first transient identifier and the stable identifier of the mobile device; and

sending, by the service endpoint to the mobile device, the stable identifier of the mobile device.

29. The system of claim 1, wherein the service endpoint and the second service endpoint are the same.

30. The system of claim 1, wherein the plurality of connections to the second service endpoint is initiated by the mobile device.

31. The system of claim 1, wherein a first of the plurality of connections to the second service endpoint is initiated by the mobile device and the rest of the plurality of connections to the second service endpoint are controlled by the second service endpoint via redirects.

32. The system of claim 1, wherein generating the transient identifier using each of the random subsets of bits from each DNS resolution comprises:

identifying, by the second service endpoint for each connection, the IP address on which the second service endpoint is called;

extracting, by the second service endpoint for each connection, the random subset of bits from the IP address;

transmitting, by the second service endpoint for each connection, the random subset of bits to the mobile device; and

concatenating, by the mobile device, each of the random subsets of bits received from the second service endpoint to generate the transient identifier.

33. The system of claim 1, wherein generating a transient identifier for the mobile device and mapping the transient identifier to the stable identifier of the mobile device using at least one call to a service endpoint comprises:

establishing, by the mobile device, a plurality of connections to a second service endpoint, each connection on a different subdomain, wherein when establishing the plurality of connections, the mobile device performs Domain Name System (DNS) resolution on each different subdomain to generate an IP address for the subdomain;

generating, for each DNS resolution, by a DNS server associated to each different subdomain, an IP address for the associated subdomain comprising a random subset of bits;

extracting, by the second service endpoint for the first connection, the random subset of bits from the IP address;

redirecting, by the second service endpoint, to each of the other plurality of connections on a different subdomain sequentially, wherein on each redirection the second service endpoint passes the extracted random subsets of bits to the redirected connection, extracts the random subset of bits from the IP address of the redirected connection, and concatenates the extracted random subset of bits to the passed extracted random subsets of bits to form a concatenated value that forms a new extracted random subset of bits;

using, by the second service endpoint, upon a last redirection, the concatenated value as the generated transient identifier;

retrieving, by the mobile device, the stable identifier of the mobile device;

establishing, by the mobile device, a connection to the service endpoint;

sending, by the mobile device, the stable identifier of the mobile device and the transient identifier to the service endpoint; and

storing, by the second service endpoint, a mapping between the transient identifier and the stable identifier of the mobile device.

34. The system of claim 1, wherein the second service endpoint:

identifies the source IP address of each of the plurality of connections;

determines that one or more of the identified source IP addresses is included in a blacklist; and

discards one or more requests from a mobile device associated with the identified source IP addresses.

35. The system of claim 1, wherein the mobile device stores DNS resolution data comprising a mapping of each subdomain to its corresponding IP address in a DNS cache of the mobile device.

36. The system of claim 1, wherein the DNS server associated to each different subdomain sets a time-to-live (TTL) of the DNS resolution data to a predetermined value.

37. The system of claim 36, wherein the predetermined value is at least one day.

38. The system of claim 1, wherein the random subset of bits from the IP address for the associated subdomain is at least 8 bits, corresponding to a class C range of IP addresses.

39. The system of claim 1, wherein the random subset of bits from the IP address for the associated subdomain is at least 16 bits, corresponding to a class B range of IP addresses.

40. The system of claim 1, wherein the mobile device:

generates a device-specific identifier for the mobile device;

appends the device-specific identifier to each different subdomain to generate devices-pecific subdomains that are one level deeper than each different subdomain;

performs the DNS resolution using the device-specific subdomains; and

wherein the DNS server associated to each different subdomain generates, for each DNS resolution using the device-specific subdomain, an IP address for the devicespecific subdomain comprising a random subset of bits.

41. The system of claim 1, wherein at least one connection between the mobile device and second service endpoint is an HTTPS connection.

42. The system of claim 1, wherein the mobile device:

generates a device-specific identifier for the mobile device;

performs the DNS resolution using each of the different subdomains;

uses the second endpoint to generate a first transient identifier; and

appends the device-specific identifier to the first transient identifier to obtain a second transient identifier.

43. The system of claim 42, wherein the device-specific identifier for the mobile device is generated based on an IP address of the mobile device.

44. The system of claim 43, wherein the device-specific identifier for the mobile device is a hash of an IP address of the mobile device.

45. The system of claim 43, wherein the mobile device obtains the IP address of the mobile device by calling a service endpoint that returns a source IP address.

46. The system of claim 1, wherein the mobile device combines the transient identifier received from the service endpoint with another transient identifier generated by the mobile device to form an updated transient identifier.

47. The system of claim 1, wherein the mobile device combines the generated transient identifier with one or more data elements associated with the mobile device to form an updated transient identifier.

48. The system of claim 47, wherein the one or more data elements associated with the mobile device comprise at least one of:

a device model, a language setting, or a software version.

49. The system of claim 10, wherein the mapping comprises the transient identifier, the stable identifier, a mapping expiration time, and an identifier of a method used to generate the transient identifier.

50. The system of claim 49, wherein retrieving the stable identifier of the mobile device, using at least one call to the service endpoint, comprises:

retrieving, by the service endpoint, the transient identifier;

determining, by the service endpoint, whether a non-expired mapping exists between the transient identifier and the stable identifier;

transmitting, by the service endpoint, the stable identifier to the mobile device if a non-expired mapping exists; and

transmitting, by the service endpoint, a null value to the mobile device if no mapping exists or if an expired mapping exists.

51. The system of claim 1, wherein generating a transient identifier for the mobile device and mapping the transient identifier to a stable identifier of the mobile device is initiated by an SDK within a native application installed on the mobile device.

52. The system of claim 51, wherein generating a transient identifier for the mobile device and mapping the transient identifier to a stable identifier of the mobile device is initiated upon an occurrence of one or more events detected by the SDK at the mobile device.

53. The system of claim 52, wherein the one or more events comprise a reboot of the mobile device, a waking from sleep of the mobile device, a network interface change of the mobile device, a connectivity change of the mobile device, or an elapsing of a predetermined time interval.

54. The system of claim 1, wherein generating a transient identifier for the mobile device and mapping the transient identifier to a stable identifier of the mobile device is initiated by code associated with an ad impression rendered in a native application installed on the mobile device.

55. The system of claim 54, wherein the stable identifier is embedded within the code associated with the ad impression and the mobile device extracts the stable identifier for transmission to the service endpoint as part of the call to the service endpoint.

56. The system of claim 55, wherein the stable identifier is included in an URL stored in the code associated with the ad impression.

57. The system of claim 54, wherein a bid is submitted for the ad impression by an ad server based upon prior activity associated with the stable identifier of the mobile device.

58. The system of claim 57, wherein a bid is submitted for the ad impression by an ad server upon:

receiving a bid request for an ad impression in a native application installed on the

mobile device, where the bid request identifies the mobile device via its stable identifier; and

determining, by the ad server, that a mapping between the transient identifier and the stable identifier does not exist.

59. The system of claim 57, wherein a bid is submitted for the ad impression by an ad server upon:

receiving a bid request for an ad impression in a native application installed on the

mobile device, where the bid request identifies the mobile device via its stable identifier; and

determining, by the ad server, that a mapping between the transient identifier and the stable identifier has expired.

60. The system of claim 57, wherein a bid is submitted for the ad impression by an ad server upon:

receiving a bid request for an ad impression in a native application installed on the mobile device, where the bid request identifies the mobile device via its stable identifier; and

determining, by the ad server, that a mapping between the transient identifier and the

stable identifier has been invalidated by a change in network connectivity for the mobile device.

61. The system of claim 1, wherein generating a transient identifier for the mobile device and mapping the transient identifier to a stable identifier of the mobile device is initiated by a pixel called from a native application installed on the mobile device.

62. The system of claim 1, wherein executing the first instructions to retrieve the stable identifier of the mobile device comprises:

identifying, by the browser application executing the first instructions, a locally-stored value that includes a first stable identifier and extracting the first stable identifier from the locally-stored value;

calling, by the browser application executing the first instructions, the service endpoint, and passing the first stable identifier as an argument;

generating, by the service endpoint, a transient identifier;

determining, by the service endpoint, a second stable identifier of the mobile device using one or more of the transient identifier, the first stable identifier, and a mapping between the transient identifier and a third stable identifier;

receiving, by the browser application executing the first instructions, the second stable identifier from the service endpoint; and

storing, by the browser application executing the first instructions, the second stable identifier in a locally-stored value.

63. The system of claim 62, wherein the service endpoint updates a mapping between the transient identifier and the third stable identifier using the received first stable identifier.

64. The system of claim 62, wherein the locally-stored value is in one or more of:

a first-party cookie, a third-party cookie, a partitioned third-party cookie, a browser cache, a partitioned browser cache, or a local storage.

65. The system of claim 62, wherein when a locally-stored value that includes the first stable identifier is not identified:

the browser application, executing the first instructions, sets the first stable identifier to a null value.

66. The system of claim 62, wherein when the second stable identifier received from the service endpoint is a null value:

the browser application, executing the first instructions, clears the locally-stored value that includes the first stable identifier.

67. The system of claim 62, wherein when the second stable identifier received from the service endpoint is a non-null value and the locally-stored value that includes the first stable identifier is not identified:

the browser application, executing the first instructions, sets the locally-stored value that includes the second stable identifier.

68. The system of claim 62, wherein when the second stable identifier received from the service endpoint is a non-null value that is different from the first stable identifier:

the browser application updates the locally-stored value to include the second stable identifier determined by the service endpoint.

69. The system of claim 62, wherein the stable identifier included in the locally-stored value is an encrypted value derived from the stable identifier.

70. The system of claim 69, wherein the service endpoint generates the encrypted value using the second stable identifier, a timestamp, a random salt value, and a secret symmetric encryption key.

71. The system of claim 9, wherein executing the third instructions to identify the mobile device to an ad server or an RTB (real-time bidding) platform comprises:

determining, by the browser application, a locally-stored value that includes the stable identifier;

extracting, by the browser application, the stable identifier from the locally-stored value; and

passing, by the browser application, the stable identifier to the ad server or the RTB platform.

72. The system of claim 1, wherein generating a transient identifier for the mobile device and mapping the transient identifier to a stable identifier of the mobile device using at least one call to a service endpoint coupled to the mobile device comprises:

determining, by the mobile device, whether sharing of the stable identifier of the mobile device is disabled in the mobile device; and

sending, by the mobile device, a null value for the stable identifier of the mobile device when sharing of the stable identifier is disabled in the mobile device.

73. The system of claim 1, wherein retrieving the stable identifier of the mobile device using at least one call to the service endpoint comprises determining whether the service endpoint has a non-expired second mapping between the stable identifier of the mobile device and a timestamp.

74. The system of claim 73, wherein the second mapping between the stable identifier of the mobile device and a timestamp expires after a given time.

75. The system of claim 73, wherein when the service endpoint does not have a non-expired second mapping between the stable identifier of the mobile device and a timestamp, the service endpoint returns a null value for the stable identifier of the mobile device to the browser application.

76. The system of claim 71, wherein the browser application passes a null value for the stable identifier of the mobile device to the ad server or the RTB platform.

77. The system of claim 73, wherein the second mapping between the stable identifier of the mobile device and the timestamp expires after 24 hours, 48 hours, or 72 hours.

78. The system of claim 73, wherein a native application on the mobile device:

generates one or more bid requests associated with one or more ad impressions in the

native application, the one or more bid requests including the stable identifier of the mobile device;

wherein the one or more bid requests are processed by an ad server or an RTB platform and sent to at least one second remote computing device;

wherein the at least one second remote computing device extracts the stable identifier from the one or more bid requests; and

wherein the at least one second remote computing device updates the second mapping between the stable identifier of the mobile device and the timestamp with the current time.

79. The system of claim 78, wherein updating the second mapping between the stable identifier of the mobile device and the timestamp comprises creating the second mapping between the

stable identifier of the mobile device and the timestamp if the second mapping does not exist, or changing the timestamp to the current time if the second mapping exists.