CREATING AND VERIFYING GLOBALLY UNIQUE DEVICE-SPECIFIC IDENTIFIERS

• US 20080104684A1
• Filed: 10/24/2007
• Published: 05/01/2008
• Est. Priority Date: 10/25/2006
• Status: Active Grant

• Current Assignee: iovation Incorporated
• Original Assignee: iovation Incorporated
• Inventors: Lulich, Daniel P., Lunde, Ron, Pierson, Greg
• Granted Patent: US 8,751,815 B2
• Time in Patent Office: Days
• US Class Current: 726/6
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 9/3213 using tickets or tokens, e.g. Kerberos network architectures or network communication protocols for entities authentication using tickets in a packet data network H04L63/0807

Abstract

Methods, apparatuses, and articles for receiving, by a server, a plurality of identifiers associated with a client device are described herein. The server may also encrypt a plurality of encoding values associated with the plurality of identifiers using a first key of a key pair of the server, and generate a token uniquely identifying the client device, a body of the token including the encrypted plurality of encoding values. In other embodiments, the server may receive a token along with the plurality of identifiers. In such embodiments, the server may further verify the validity of the received token, including attempting to decrypt a body of the received token with a key associated with a second server, the second server having generated the received token, and, if decryption succeeds, comparing ones of the plurality of identifiers with second identifiers found in the decrypted body to check for inconsistencies.

Claims

1. A method comprising:

receiving, by a server, a plurality of identifiers associated with a client device;

encrypting, by the server, a plurality of encoding values associated with the plurality of identifiers using a first key of a key pair of the server; and

generating, by the server, a token uniquely identifying the client device, a body of the token including the encrypted plurality of encoding values.

2. The method of claim 1, wherein the identifiers are received from a web server of a subscriber to services of the server, and the method further comprises transmitting, by the server, the token to the web server to facilitate the web server in providing the token to the client device.

3. The method of claim 1, further comprising transmitting, by the server, the token to the client device.

4. The method of claim 1, wherein the plurality of identifiers include at least one of a device serial number, a media access control (MAC) address, an operating system (OS) type, and OS version, a time code, a country code, or a region code.

5. The method of claim 1, further comprising generating, by the server, the encoding values by performing a hash function on the plurality of identifiers.

6. The method of claim 1, wherein the token further includes a server identifier to identify the server as a generator of the token.

7. The method of claim 1, further comprising requesting of the client device, by the server, the plurality of identifiers.

8. The method of claim 1, wherein the first key of the key pair is a private key of the server.

9. A method comprising:

receiving, by a first server, a token associated with a client device, the token acting as a unique identifier of the client device, and a plurality of first identifiers; and

verifying, by the first server, validity of the token, including

attempting to decrypt a body of the token with a key associated with a second server, the second server having generated the token, and

if decryption succeeds, comparing ones of the plurality of first identifiers with second identifiers found in the decrypted body to check for inconsistencies.

10. The method of claim 9, wherein the token and first identifiers are received from a web server of a subscriber to services of the first server.

11. The method of claim 9, wherein the first or second plurality of identifiers include at least one of a device serial number, a media access control (MAC) address, an operating system (OS) type, and OS version, a time code, a country code, or a region code.

12. The method of claim 9, wherein the key associated with the second server is the public key of the second server.

13. The method of claim 9, wherein the second identifiers are identical to the first identifiers.

14. The method of claim 9, further comprising, if token verification fails, determining, by the first server, whether to reissue the token based on one or more factors.

16. The method of claim 9, further comprising periodically reissuing the token, by the first server, regardless of whether the verifying indicates that the token is valid.

15. The method of claim 15, wherein the one or more factors include at least one of success or failure of decryption, inconsistencies between ones of the first and second identifiers, presence of a device identifier of the client device on a list of suspect devices, a count of a number of times the token has been received, association of the client device to evidence of fraud, or a level of risk associated with the client device.

17. A first server comprising:

a processor; and

logic to be operated by the processor to

receive a token associated with a client device, the token acting as a unique identifier of the client device, and a plurality of first identifiers, and

verify validity of the token, including

attempting to decrypt a body of the token with a key associated with a second server, the second server having generated the token, and

if decryption succeeds, comparing ones of the plurality of first identifiers with second identifiers found in the decrypted body to check for inconsistencies.

18. The first server of claim 17, wherein the logic is further to, if token verification fails, determine whether to reissue the token based on one or more rules or policies.

19. The first server of claim 18, wherein the one or more rules or policies include at least one of success or failure of decryption, inconsistencies between ones of the first and second identifiers, presence of a device identifier of the client device on a list of suspect devices, a count of a number of times the token has been received, association of the client device to evidence of fraud, or a level of risk associated with the client device.

20. An article of manufacture comprising:

a storage medium; and

a plurality of programming instructions stored on the storage medium and configured to program a server to

receive a plurality of identifiers associated with a client device,

encrypt a plurality of encoding values associated with the plurality of identifiers using a private key of the server, and

generate a token uniquely identifying the client device, a body of the token including the encrypted plurality of encoding values.

21. The article of claim 20, wherein the programming instructions are further configured to program the server to provide client logic to the client device, directly or indirectly, to enable the client device to recognize and use the token.

22. The article of claim 21, wherein the plurality of identifiers include at least one of a device serial number, a media access control (MAC) address, an operating system (OS) type, and OS version, a time code, a country code, or a region code.

23. The article of claim 21, wherein the token further includes a server identifier to identify the server as a generator of the token.