Generation of a targeted advertisement in an untrusted sandbox based on a psuedonym

• US 8,539,072 B1
• Filed: 05/14/2012
• Issued: 09/17/2013
• Est. Priority Date: 11/26/2008
• Status: Active Grant

• Current Assignee: Free Stream Media Corporation
• Original Assignee: Free Stream Media Corporation
• Inventors: Harrison, David A.
• Primary Examiner(s): Ibrahim, Mohamed
• Application Number:
  US13/470,814
• Time in Patent Office: 491 Days
• Field of Search: None
• US Class Current: 709/224
• CPC Class Codes: G06F 16/783 using metadata automatically derived from the content
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 3/14 Digital output to display device ; Cooperation and interconnection of the display device with other functional units
• CPC Class Codes: G06Q 30/0255 based on user history
• CPC Class Codes: G06Q 30/0269 based on user profile or attribute
• CPC Class Codes: G08C 17/02 using a radio link
• CPC Class Codes: H04L 12/18 for broadcast or conference , e.g. multicast
• CPC Class Codes: H04L 2101/668 Internet protocol [IP] address subnets
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2517 using port numbers
• CPC Class Codes: H04L 61/256 NAT traversal
• CPC Class Codes: H04L 61/2575 using address mapping retrieval, e.g. simple traversal of user datagram protocol through session traversal utilities for NAT [STUN]
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/4541 Directories for service discovery
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 65/61 : for supporting one-way streaming services, e.g. Internet radio
• CPC Class Codes: H04L 67/02 : based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 : in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/141 : Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/51 : Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04N 21/23424 : involving splicing one content stream with another content stream, e.g. for inserting or substituting an advertisement
• CPC Class Codes: H04N 21/2541 : Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/278 : Content descriptor database or directory service for end-user access details of content or meta data based information retrieval of video data in video databases G06F16/739
• CPC Class Codes: H04N 21/4126 : The peripheral being portable, e.g. PDAs or mobile phones
• CPC Class Codes: H04N 21/41407 : embedded in a portable device, e.g. video client on a mobile phone, PDA, laptop constructional details of equipment or arrangements specially adapted for portable computer application G06F1/1626; arrangements specially adapted for mobile receivers in broadcast systems H04H20/57
• CPC Class Codes: H04N 21/4147 : PVR [Personal Video Recorder] H04N5/76 takes precedence ; arrangements for broadcast with accumulation-type receivers H04H20/40
• CPC Class Codes: H04N 21/435 : Processing of additional data, e.g. decrypting of additional data, reconstructing software from modules extracted from the transport stream
• CPC Class Codes: H04N 21/4415 : using biometric characteristics of the user, e.g. by voice recognition or fingerprint scanning cryptography using biological data H04L9/3231; authentication in networks using biometric H04L63/0861
• CPC Class Codes: H04N 21/466 : Learning process for intelligent management, e.g. learning user preferences for recommending movies services using the results of monitoring in broadcast systems H04H60/61
• CPC Class Codes: H04N 21/6175 : involving transmission via Internet broadcast-related systems characterised by the transmission system being the Internet H04H60/82
• CPC Class Codes: H04N 21/64322 : IP
• CPC Class Codes: H04N 21/812 : involving advertisement data advertising per se G06Q30/02
• CPC Class Codes: H04N 21/835 : Generation of protective data, e.g. certificates protecting software against unauthorised usage in a vending or licensing environment G06F21/10
• CPC Class Codes: H04N 21/8352 : involving content or source identification data, e.g. Unique Material Identifier [UMID]
• CPC Class Codes: H04N 21/8358 : involving watermark protecting executable software by watermarking G06F21/16; image watermarking in general G06T1/0021; watermarks inserted in still images for transmission purposes H04N1/32144; inserting watermarks during video coding H04N19/467
• CPC Class Codes: H04N 21/84 : Generation or processing of descriptive data, e.g. content descriptors systems specially adapted for using meta-information in broadcast systems H04H60/73

Abstract

Particular embodiments permit a computer program running within a security sandbox to discover and communicate with networked services for example print servers, or remote control programming interfaces for TVs, stereos, and game boxes. The sandbox allows the computer program to originate unicast connections to a limited set of hosts but otherwise provides no access to the network. Particular embodiments may require no prior install, zero configuration, no account names or passwords, and yet resists spam. This is achieved by using centralized global infrastructure to coordinate the communications rather than local multicast, anycast, or datalink broadcast.

Claims

1. A method of a trusted sandbox, the method comprising:

transmitting a discovery request that includes a first public internet protocol (IP) address for a trusted sandbox to a discovery service;

receiving, from the discovery service, information about a service offered by a first device including at least one of a globally unique identifier for the service offered by the first device, a name for the service, a private address of the service and a second public IP address for the first device in response to the discovery service determining the first public IP address and the second public IP address are identical;

transmitting the name of the service offered by the first device to an untrusted sandbox;

facilitating a communication of a service request from the untrusted sandbox to the first device using the private address for the first device; and

facilitating a generation of a targeted advertisement in the untrusted sandbox based on a pseudonym derived from a hardware address of a user of the untrusted sandbox and an associated behavior of the user in communicating with the first device.

2. The method of claim 1, further comprising:

replacing the globally unique identifier for the service offered by the first device with a locally unique identifier that is local in scope to the untrusted sandbox; and

wherein transmitting the name further comprises transmitting the locally unique identifier corresponding to the service offered by the first device to the untrusted sandbox.

3. The method of claim 2, wherein the service request includes the locally unique identifier to identify the service for the trusted sandbox and a payload.

4. The method of claim 1, further comprising issuing an access token received from the first device to the untrusted sandbox that uniquely identifies the untrusted sandbox;

and

wherein service requests from the untrusted sandbox are forwarded to the first device contingent upon the service requests including the access token.

5. The method of claim 1, wherein the globally unique identifier uniquely identifies the service offered by the first device if at least one of the second public IP address and a port for the first device changes.

6. The method of claim 1, further comprising receiving permission from the service offered by the first device to communicate the arbitrary messages.

7. The method of claim 1, wherein at least one of a multicast, a multicast domain name system (MDNS), a simple service discovery protocol (SSDP) and a service location protocol (SLP) is used to discover information about the service.

8. The method of claim 1, further comprising:

forwarding the service request to a global message queue associated with the service offered by the first device that stores the service request as a message.

9. The method of claim 1, wherein a network address translator to translate the first public IP address for the trusted sandbox and to generate the second public IP address for the first device by mapping at least one first private IP address to an IP address on the network address translator'"'"'s public-facing network interface.

10. The method of claim 1, wherein the discovery request specifies a type of service.

11. The method of claim 1, further comprising querying a policy database to determine access restrictions for a first content provider website associated with the untrusted sandbox.

12. The method of claim 1, further comprising caching the information about the service offered by the first device in the trusted sandbox for reuse on a second content provider website.

13. A system for communicating arbitrary messages, the system comprising:

a processor; and

a trusted sandbox stored on a memory and executed by the processor, the trusted sandbox for transmitting a discovery request that includes a first public internet protocol (IP) address for the trusted sandbox to a discovery service for receiving, from the discovery service, information about a service offered by a first device including at least one of a globally unique identifier for the service offered by the first device, a name for the service, a private address of the service and a second public IP address for the first device in response to the discovery service determining the first public IP address and the second public IP address are identical, for transmitting the name of the service offered by the first device to an untrusted sandbox, for facilitating a communication of a service request from the untrusted sandbox to the first device using the private address for the first device and for facilitating a generation of a targeted advertisement in the untrusted sandbox based on a pseudonym derived from a hardware address of a user of the untrusted sandbox and an associated behavior of the user in communicating with the first device.

14. The system of claim 13, wherein the trusted sandbox replaces the globally unique identifier for the service offered by the first device with a locally unique identifier that is local in scope to the untrusted sandbox and transmits the name and the locally unique identifier corresponding to the service offered by the first device to the untrusted sandbox.

15. The system of claim 14, further comprising:

the untrusted sandbox that is coupled to the trusted sandbox, the untrusted sandbox for including the locally unique identifier to identify the service for the trusted sandbox and a payload in the service request.

16. The system of claim 13, wherein the trusted sandbox issues an access token received from the first device to the untrusted sandbox that uniquely identifies the untrusted sandbox and forwards service requests from the untrusted sandbox to the first device contingent upon the service requests including the access token.

17. The system of claim 13, wherein the trusted sandbox receives permission from the service offered by the first device to communicate the arbitrary messages.

18. The system of claim 13, wherein at least one of a multicast, a multicast domain name system (MDNS), a simple service discovery protocol (SSDP) and a service location protocol (SLP) is used to discover information about the service.

19. The system of claim 13, wherein the trusted sandbox forwards the service request to a global message queue associated with the service offered by the first device that stores the service request as a message.

20. A computer program product comprising a non-transitory computer useable medium including a computer readable program, wherein the computer readable program when executed on a computer causes the computer to perform steps comprising:

transmitting a discovery request that includes a first public internet protocol (IP) address for a trusted sandbox to a discovery service;

receiving, from the discovery service, information about a service offered by a first device including at least one of a globally unique identifier for the service offered by the first device, a name for the service, a private address of the service and a second public IP address for the first device in response to the discovery service determining the first public IP address and the second public IP address are identical;

transmitting the name of the service offered by the first device to an untrusted sandbox;

facilitating a communication of a service request from the untrusted sandbox to the first device using the private address for the first device; and

facilitating a generation of a targeted advertisement in the untrusted sandbox based on a pseudonym derived from a hardware address of a user of the untrusted sandbox and an associated behavior of the user in communicating with the first device.