Systems and methods for identifying and characterizing client devices

• US 9,419,852 B1
• Filed: 12/28/2012
• Issued: 08/16/2016
• Est. Priority Date: 12/30/2011
• Status: Active Grant

• Current Assignee: Akamai Technologies, Inc.
• Original Assignee: Akamai Technologies, Inc.
• Inventors: Heller, Alec, Scaffidi, Stephen R., Tetzner, Walter P., Kaufman, David H., Kobrin, Eric L.
• Primary Examiner(s): Parry, Chris
• Assistant Examiner(s): Stiltner, WeiWei
• Application Number:
  US13/730,428
• Time in Patent Office: 1,327 Days
• Field of Search: 709/227
• US Class Current: 1/1
• CPC Class Codes: G06F 16/2237 Vectors, bitmaps or matrices
• CPC Class Codes: G06F 16/24575 using context
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 51/212 using filtering or selective blocking
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/303 Terminal profiles
• CPC Class Codes: H04L 67/565 Conversion or adaptation of application format or content adding application control or application functional data H04L67/561
• CPC Class Codes: H04L 69/24 Negotiation of communication capabilities
• CPC Class Codes: H04L 9/40 Network security protocols

Abstract

The teachings herein generally relate to client-server communications and the delivery of content over computer networks to clients, and provide improved methods, systems, and apparatus for identifying and/or characterizing client devices that are requesting content from a server. For example, based on information sent in a client device'"'"'s request for content, a web server modified in accordance with the teachings hereof can identify a set of characteristics associated with that client device. Such characteristics might include the model name of the client device, the screen dimensions of the client device, information about the particular operating system or browser name/version it is running, content formats it is capable of consuming, and so on. The web server can use this information to modify and customize its response for the given client device.

Claims

1. A system, comprising:

a first computer that has circuitry forming one or more processors and memory storing instructions to be executed by the one or more processors to operate the first computer to;

(i) associate each of one or more known client devices with a set of one or more tokens;

(ii) populate a data structure such that each set of one or more tokens corresponds to a key for the data structure that points to a corresponding client device identifier;

(iii) generate a whitelist of tokens;

a second computer that has circuitry forming one or more processors and memory storing instructions to be executed by the one or more processors to operate the second computer to;

(iv) receive and store the data structure;

(v) receive a request for content from a client device;

(vi) generate particular one or more tokens from information in the request;

(vii) identify the client device as a particular one of one or more known client devices, wherein said identification step includes;

(a) creating a particular key from at least some of the particular one or more tokens that were generated from the information in the request;

(b) using the particular key to look up a particular client device identifier stored in the data structure;

(viii) wherein the executed instructions further will operate the second computer to;

receive the whitelist of tokens, and, when creating the particular key, to use only those tokens that were generated from the information the request and appear in the whitelist.

2. The system of claim 1, wherein the second computer is further operative to:

associate at least some of the particular one or more tokens generated from the information in the request with integers;

create the particular key from at least some of the particular one or more tokens that were generated from the information in the request, using the integers.

3. The system of claim 1, wherein the set of one or more tokens associated with the one or more known client devices and the particular one or more tokens from the information in the request represent portions of user-agent strings.

4. The system of claim 1, wherein the information in the request comprises information in a user-agent header field.

5. The system of claim 1, wherein the request comprises an HTTP request.

6. The system of claim 1, wherein the requesting client device is a mobile device.

7. The system of claim 1, wherein the second computer comprises an HTTP proxy server.

8. A method operable in one or more computers for identifying a client device making requests for content, the one or more computers comprising circuitry forming one or more processors and memory storing instructions to be executed by the one or more processors and thereby perform the method, the method comprising:

receiving a request for content from a client device;

generating one or more tokens from information in the request;

identifying the client device as a particular one of one or more known client devices, wherein said identification step includes;

creating a key from at least some of the tokens that were generated from the information in the request;

using the key to look up a client device identifier in a data structure previously stored in the one or more computers;

generating at least one of;

a whitelist of tokens and a blacklist of tokens;

wherein, where the whitelist of tokens is generated, only those tokens that were generated from the information in the request and appear in the whitelist are used in creating the key;

wherein, where the blacklist of tokens is generated, tokens that were generated from the information in the request but that appear in the blacklist are not used in creating the key.

9. The method of claim 8, further comprising:

generating the whitelist of tokens.

10. The method of claim 8, further comprising:

generating the blacklist of tokens.

11. The method of claim 8, further comprising:

prior to receiving the request, associating each of one or more known client devices with a set of one or more tokens;

populating the data structure such that the each set of one or more tokens is a key that points to a corresponding client device identifier;

storing the data structure in a computer that will receive the request.

12. The method of claim 8, further comprising:

associating at least some of the one or more tokens generated from the information in the request with integers;

creating the key from at least some of the tokens that were generated from the information in the request, using the integers.

13. The method of claim 8, wherein the tokens from the information in the request represent portions of user-agent strings.

14. The method of claim 8, wherein the information in the request comprises information in a user-agent header field.

15. The method of claim 8, wherein the request comprises an HTTP request.

16. The method of claim 8, wherein the requesting client device comprises a mobile device.

17. The method of claim 8, wherein the one or more computers include an HTTP proxy server.

18. A system, comprising:

a first computer that has circuitry forming one or more processors and memory storing instructions to be executed by the one or more processors to operate the first computer to;

(i) associate each of one or more known client devices with a set of one or more tokens;

(ii) populate a data structure such that each set of one or more tokens corresponds to a key for the data structure that points to a corresponding client device identifier;

(iii) generate a blacklist of tokens;

a second computer that has circuitry forming one or more processors and memory storing instructions to be executed by the one or more processors to operate the second computer to;

(iv) receive and store the data structure;

(v) receive a request for content from a client device;

(vi) generate particular one or more tokens from information in the request;

(vii) identify the client device as a particular one of one or more known client devices, wherein said identification step includes;

(a) creating a particular key from at least some of the particular one or more tokens that were generated from the information in the request;

(b) using the particular key to look up a particular client device identifier stored in the data structure;

(viii) wherein, for the first computer being operative to generate the blacklist of tokens, the executed instructions further will operate the second computer to;

receive the blacklist of tokens and, when creating the particular key, to refrain from using tokens that appear in the blacklist.

19. The system of claim 18, wherein the second computer is further operative to:

associate at least some of the particular one or more tokens generated from the information in the request with integers;

create the particular key from at least some of the particular one or more tokens that were generated from the information in the request, using the integers.

20. The system of claim 18, wherein the set of one or more tokens associated with the one or more known client devices and the particular one or more tokens from the information in the request represent portions of user-agent strings.

21. The system of claim 18, wherein the information in the request comprises information in a user-agent header field.

22. The system of claim 18, wherein the request comprises an HTTP request.

23. The system of claim 18, wherein the requesting client device is a mobile device.

24. The system of claim 18, wherein the second computer comprises an HTTP proxy server.