Statistical security for anonymous mesh-up oriented online services
Web pages and applications commonly consume functionality provided by services to provide users with a rich experience. For example, a backend mapping service may provide access to these services. However, the users and application consuming the services may be anonymous and unverified. Accordingly, a two ticket validation technique is provided to validate service execution requests from anonymous applications. In particular, a user is provided with a client ticket comprising a reputation. The reputation may be adjusted over time based upon how the user consumes services. An application may request access to a service by providing the client ticket and an application ticket for validation. The reputation of the user may be used to determine an access level at which the application may access the service. Users with a high reputation may receive high quality access to the service, while users with a low reputation may receive lower quality access.
1. A system for validating service execution requests, comprising:
one or more processing units; and
memory comprising instructions that when executed by at least some of the one or more processing units perform operations, comprising:
providing, to an anonymous user, a client ticket comprising a reputation for the anonymous user that is automatically determined based upon user interaction with one or more services through one or more applications;
receiving a service execution request from an application with which the anonymous user is engaged, the service execution request comprising:
the client ticket;
an application ticket comprising an application identification (ID) identifying the application; and
a request for execution of a service;
identifying a service policy corresponding to the service;
determining, from the service policy, a set of reputation thresholds based upon the application ID;
comparing the reputation, comprised within the client ticket, to the set of reputation thresholds to determine an access level provided to the application by the service; and
providing the application with access to the service according to the access level.
2. The system of claim 1 , the set of reputation thresholds comprising:
one or more reputation thresholds, a reputation threshold associated with a corresponding access level for the service.
3. The system of claim 2 , the operations comprising:
adjusting at least some of the one or more reputation thresholds based upon monitored service execution.
4. The system of claim 3 , the adjusting comprising:
increasing the at least some of the one or more reputation thresholds based upon detecting an attack.
5. The system of claim 1 , the operations comprising:
accessing the application ticket using information comprised within the client ticket.
6. The system of claim 1 , the operations comprising:
validating the service execution request based upon validating the application ID.
7. The system of claim 1 , the operations comprising:
providing a reputation challenge to the anonymous user;
receiving a reputation challenge answer from the anonymous user; and
updating the reputation based upon the reputation challenge answer.
8. The system of claim 1 , the operations comprising:
decreasing the reputation based upon at least one of:
monitored service execution indicative of abuse;
monitored service execution indicative of service spamming; or
monitored service execution indicative of non-humanistic behavior.
9. The system of claim 1 , the operations comprising:
increasing the reputation based upon at least one of:
human validation;
patterns of humanistic behavior indicative of non-abuse; or
matching monitored service execution of the anonymous user with statistical pattern access models.
10. The system of claim 1 , the operations comprising:
storing the client ticket as a cookie on a computer device with which the anonymous user is engaged.
11. The system of claim 1 , the operations comprising:
updating the reputation to indicate user denial of access to at least some of the one or more services.
12. The system of claim 1 , the client ticket comprising:
encrypted data of at least one of a client ID, reputation information, one or more state parameters of a client trusted platform, or a unique application ticket key.
13. The system of claim 1 , the application ticket comprising at least one of:
a copy of the client ticket without a one-time application ticket key; or
encrypted data of at least one of the application ID, application ticket expiration information, or state parameters of a client trusted platform using a unique application ticket-key.
14. A method for validating server execution requests from anonymous applications, comprising:
receiving a service execution request from an application with which an anonymous user is engaged, the service execution request comprising:
a client ticket comprising a reputation for the anonymous user that is automatically determined based upon user interaction with one or more services through one or more applications;
an application ticket comprising an application identification (ID) identifying the application; and
a request for execution of a service;
identifying a service policy corresponding to the service;
determining, from the service policy, a set of reputation thresholds based upon the application ID;
comparing the reputation, comprised within the client ticket, to the set of reputation thresholds to determine an access level provided to the application by the service; and
providing the application with access to the service according to the access level.
15. The method of claim 14 , the comparing comprising:
determining whether the reputation falls within a reputation threshold of the set of reputation thresholds; and
determining the access level based upon the reputation threshold.
16. The method of claim 14 , comprising:
decreasing the reputation based upon a detected abusive access pattern.
17. The method of claim 14 , comprising:
monitoring access patterns of one or more services for attack; and
upon detecting an attack, increasing one or more reputation thresholds of the set of reputation thresholds.
18. The method of claim 14 , the providing comprising:
denying the application access to the service based upon determining the reputation falls within a low reputation threshold of the set of reputation thresholds.
19. A computer-readable medium comprising processor-executable instructions that when executed perform a method for validating service execution requests, comprising:
receiving a service execution request from an application with which an anonymous user is engaged, the service execution request comprising:
a client ticket comprising a reputation for the anonymous user;
an application ticket comprising an application (ID) identifying the application; and
a request for execution of a service;
identifying a service policy corresponding to the service;
determining, from the service policy, a set of reputation thresholds based upon the application ID;
comparing the reputation, comprised within the client ticket, to the set of reputation thresholds to determine an access level provided to the application by the service; and
providing the application with access to the service according to the access level.
20. The computer-readable medium of claim 19 , the comparing comprising:
determining whether the reputation falls within a reputation threshold of the set of reputation thresholds; and
determining the access level based upon the reputation threshold.