Systems and methods for client authentication

• US 8,996,653 B1
• Filed: 10/26/2012
• Issued: 03/31/2015
• Est. Priority Date: 02/15/2007
• Status: Active Grant

• Current Assignee: Google LLC (Alphabet Inc.)
• Original Assignee: Google Inc. (Alphabet Inc.)
• Inventors: Eriksen, Bjorn Marius Aamodt, Laraki, Othman, Rennie, Jeffrey Glenn
• Primary Examiner(s): TANG, KAREN C
• Application Number:
  US13/662,366
• Time in Patent Office: 886 Days
• Field of Search: 709/217
• US Class Current: 709/217
• CPC Class Codes: H04L 2209/08 Randomization, e.g. dummy operations or using noise
• CPC Class Codes: H04L 2209/26 Testing cryptographic entity, e.g. testing integrity of encryption key or encryption algorithm
• CPC Class Codes: H04L 45/745 Address table lookup; Address filtering
• CPC Class Codes: H04L 45/7459 using Bloom filters
• CPC Class Codes: H04L 61/2567 for reachability, e.g. inquiring the address of a correspondent behind a NAT server
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/58 Caching of addresses or names
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

A server computer queries a client device using a test fingerprint that does not correspond to any document stored in the client device, and restricts access by the client device to the server computer if the query result is incorrect. In some implementations, the server selects a set of first fingerprints associated with documents stored in the client device, generates a set of test fingerprints, none of which are associated with any document stored in the client device, and queries the client device using fingerprints from the set of first fingerprints and the set of test fingerprints to produce query results. The server computer restricts access by the client device to the server computer if at least one of the query results is incorrect, and enables the client device to access the server computer if at least a predefined number of the query results are correct and none are incorrect.

Claims

1. A method, comprising:

at a server computer;

selecting a set of first fingerprints that correspond to documents stored in a client device, wherein the set of first fingerprints includes fingerprints of documents that correspond to entries in a Bloom filter;

generating a set of test fingerprints that do not correspond to any document stored in the client device;

querying the client device using fingerprints from the set of first fingerprints and the set of test fingerprints to produce a set of query results;

restricting access by the client device to the server computer if at least one of the query results is incorrect; and

enabling the client device to access the server computer if at least a predefined number of the query results are correct and none of the query results are incorrect.

2. The method of claim 1, wherein the test fingerprints are generated using a random or pseudo-random process.

3. The method of claim 1, wherein at least one of the first fingerprints is a URL fingerprint of a document cached by the client device.

4. The method of claim 1, wherein the server computer receives a client cache map from the client device in a previous session.

5. The method of claim 1, wherein restricting access includes invalidating a client cookie.

6. A server computer, comprising:

memory;

at least one processor; and

at least one program stored in the memory and executed by the at least one processor, the at least one program including instructions for;

selecting a set of first fingerprints that correspond to documents stored in a client device, wherein the set of first fingerprints includes fingerprints of documents that correspond to entries in a Bloom filter;

generating a set of test fingerprints that do not correspond to any document stored in the client device;

querying the client device using fingerprints from the set of first fingerprints and the set of test fingerprints to produce a set of query results;

restricting access by the client device to the server computer if at least one of the query results is incorrect; and

enabling the client device to access the server computer if at least a predefined number of the query results are correct and none of the query results are incorrect.

7. The server computer of claim 6, including instructions for generating the test fingerprints using a random or pseudo-random process.

8. The server computer of claim 6, wherein at least one of the first fingerprints is a URL fingerprint of a document stored at the client device.

9. The server computer of claim 6, including instructions for receiving a client cache map from the client device in a previous session.

10. The server computer of claim 6, wherein the instructions for restricting access include instructions for invalidating a client cookie.

11. A non-transitory computer readable storage medium storing one or more programs configured for execution by one or more processors of a server computer, the one or more programs comprising instructions for:

selecting a set of first fingerprints that correspond to documents stored in a client device, wherein the set of first fingerprints includes fingerprints of documents that correspond to entries in a Bloom filter;

generating a set of test fingerprints that do not correspond to any document stored in the client device;

querying the client device using fingerprints from the set of first fingerprints and the set of test fingerprints to produce a set of query results;

restricting access by the client device to the server computer if at least one of the query results is incorrect; and

enabling the client device to access the server computer if at least a predefined number of the query results are correct and none of the query results are incorrect.

12. The non-transitory computer readable storage medium of claim 11, including instructions for generating the test fingerprints using a random or pseudo-random process.

13. The non-transitory computer readable storage medium of claim 11, wherein at least one of the first fingerprints is a URL fingerprint of a document stored at the client device.

14. The non-transitory computer readable storage medium of claim 11, including instructions for receiving a client cache map from the client device in a previous session.

15. The non-transitory computer readable storage medium of claim 11, wherein the instructions for restricting access include instructions for invalidating a client cookie.