Systems and methods for detecting and preventing spoofing

• US 9,979,747 B2
• Filed: 09/04/2016
• Issued: 05/22/2018
• Est. Priority Date: 09/05/2015
• Status: Active Grant

• Current Assignee: NuData Security Inc. (MasterCard Incorporated)
• Original Assignee: Mastercard Technologies Canada ULC (MasterCard Incorporated)
• Inventors: Bailey, Christopher Everett, Lukashuk, Randy, Richardson, Gary Wayne
• Primary Examiner(s): TRAN, ELLEN C
• Application Number:
  US15/256,610
• Publication Number:
  US 20170070533A1
• Time in Patent Office: 625 Days
• CPC Class Codes: G06F 16/2255 Hash tables
• CPC Class Codes: G06F 16/24578 using ranking
• CPC Class Codes: G06F 16/285 Clustering or classification
• CPC Class Codes: G06F 16/9535 Search customisation based on user profiles and personalisation
• CPC Class Codes: G06F 21/316 by observing the pattern of computer usage, e.g. typical user behaviour
• CPC Class Codes: G06F 21/32 using biometric data, e.g. fingerprints, iris scans or voiceprints
• CPC Class Codes: G06F 21/44 Program or device authentication
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2137 Time limited access, e.g. to a computer or data
• CPC Class Codes: G06F 2221/2145 Inheriting rights or properties, e.g., propagation of permissions or restrictions within a hierarchy
• CPC Class Codes: G06F 7/08 Sorting, i.e. grouping record carriers in numerical or other ordered sequence according to the classification of at least some of the information they carry by merging two or more sets of carriers in ordered sequence G06F7/16
• CPC Class Codes: H04L 2463/144 Detection or countermeasures against botnets
• CPC Class Codes: H04L 41/20 Network management software packages
• CPC Class Codes: H04L 43/12 Network monitoring probes
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 : Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 : Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1466 : Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/02 : based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/30 : Profiles
• CPC Class Codes: H04L 67/303 : Terminal profiles
• CPC Class Codes: H04L 67/535 : Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

Techniques for detecting device type spoofing. The techniques include: receiving a communication from a client device different from the at least one computer; identifying from the communication an asserted type of the client device; and verifying the asserted type of the client device at least in part by: interacting with the client device to obtain additional information about the client device, and determining whether the additional information about the client device is consistent with the asserted type of the client device.

Claims

1. A method, performed by at least one computer, the method comprising:

receiving a communication from a client device different from the at least one computer;

identifying from the communication an asserted type of the client device; and

determining whether the client device is of the asserted type at least in part by;

interacting with the client device to measure an amount of time it takes the client device to perform a task, the interacting comprising;

providing a software program to the client device for execution by the client device; and

measuring an amount of time it takes the client device to execute the software program;

determining whether the measured amount of time it takes the client device to perform the task is consistent with the asserted type of the client device, the determining comprising;

comparing the measured amount of time for the client device to perform the task to a range of expected performance times for devices of the asserted type;

granting the client device access to a resource in response to determining that the client device is of the asserted type; and

denying the client device access to the resource in response to determining that the client device is not of the asserted type.

2. The method of claim 1,

wherein providing the software program further comprises providing, to the client device, at least one input to the software program, and

wherein measuring the amount of time it takes the client device to execute the software program comprises measuring how long it takes the client device to use the software to generate at least one output based on the at least one input.

3. The method of claim 2, further comprising:

receiving the at least one output from the client device; and

verifying that the at least one output is accurate.

4. The method of claim 1, wherein providing the software program further comprises providing, to the client device, a software program comprising a serial cumulative calculation challenge for execution by the client device.

5. The method of claim 1, wherein providing the software program further comprises providing, to the client device, a software program comprising a parallel checkpoints calculation challenge for execution by the client device.

6. The method of claim 1, wherein providing the software program further comprises providing, to the client device, a software program comprising a neural network calculation challenge for execution by the client device.

7. The method of claim 1, wherein providing the software program further comprises providing, to the client device, a software program comprising a graphics processing unit calculation challenge for execution by the client device.

8. The method of claim 1, wherein determining whether the measured amount of time it takes the client device to perform the task is consistent with how long it takes client devices of the asserted type to perform the task comprises:

accessing information indicating the range of expected performance times, associated with the task, for a population of client devices of the asserted type; and

comparing the measured amount of time with the range of expected performance times.

9. The method of claim 1,

wherein the communication indicates that the client device is asserted to be a mobile device of a certain type, and

wherein determining whether the measured amount of time it takes the client device to perform the task is consistent with the asserted type of the client device comprises determining whether the amount of time it takes the client device to perform the task is consistent with how long it takes mobile devices of the certain type to perform the task.

10. The method of claim 1, wherein interacting with the client device to measure the amount of time it takes the client device to perform the task is performed in response to receiving the communication from the client device.

11. The method of claim 1,

wherein the resource comprises a webpage.

12. The method of claim 1, wherein granting the client device access to the resource comprises granting the client device access to a service.

13. The method of claim 1, wherein the software program comprises a Javascript program.

14. A system, comprising:

at least one computer;

at least one non-transitory computer-readable medium storing processor-executable instructions that, when executed by the at least one computer, cause the at least one computer to perform;

receiving a communication from a client device different from the at least one computer;

identifying from the communication an asserted type of the client device; and

determining whether the client device is of the asserted type at least in part by;

interacting with the client device to measure an amount of time it takes the client device to perform a task, the interacting comprising;

providing a software program to the client device for execution by the client device; and

measuring an amount of time it takes the client device to execute the software program;

determining whether the measured amount of time it takes the client device to perform the task is consistent with the asserted type of the client device, the determining comprising;

comparing the measured amount of time for the client device to perform the task to a range of expected performance times for devices of the asserted type;

granting the client device access to a resource in response to determining that the client device is of the asserted type; and

denying the client device access to the resource in response to determining that the client device is not of the asserted type.

15. The system of claim 14, wherein providing the software program further comprises providing, to the client device, a software program comprising a serial cumulative calculation challenge, a parallel checkpoints calculation challenge, a neural network challenge, and/or a graphics processing unit challenge for execution by the client device.

16. The system of claim 14, wherein the processor-executable instructions, when executed by the at least one computer, further cause the at least one computer to perform:

receiving at least one output from the client device resulting from execution of the software program; and

verifying that the at least one output is accurate.

17. The system of claim 14, wherein the resource comprises a webpage.

18. At least one non-transitory computer-readable medium storing processor-executable instructions that, when executed by at least one computer, cause the at least one computer to perform:

receiving a communication from a client device different from the at least one computer;

identifying from the communication an asserted type of the client device; and

determining whether the client device is of the asserted type at least in part by;

interacting with the client device to measure an amount of time it takes the client device to perform a task, the interacting comprising;

providing a software program to the client device for execution by the client device; and

measuring an amount of time it takes the client device to execute the software program;

determining whether the measured amount of time it takes the client device to perform the task is consistent with the asserted type of the client device, the determining comprising;

comparing the measured amount of time for the client device to perform the task to a range of expected performance times for devices of the asserted type;

granting the client device access to a resource in response to determining that the client device is of the asserted type; and

denying the client device access to the resource in response to determining that the client device is not of the asserted type.

19. The at least one non-transitory computer readable storage of claim 18, wherein providing the software program further comprises providing, to the client device, a software program comprising a serial cumulative calculation challenge, a parallel checkpoints calculation challenge, a neural network challenge, and/or a graphics processing unit challenge for execution by the client device.

20. The at least one non-transitory computer readable storage medium of claim 18, wherein the resource comprises a webpage.