Authenticating a cookie with distinctive signals
View Patent ↗A system, method, and apparatus are provided for using distinctive signals associated with an electronic device to authenticate or validate a cookie or other identifier issued to the device from a website or other source. When the device receives content (e.g., a web page) from the source, it also receives code for collecting the signals, which is executed when the content is rendered. The device transmits the signals to the source or other specified destination, where they may be processed (e.g., hashed) and retained. Upon subsequent access to content from the source, signals are again collected, transmitted to the source, and compared with those that were previously retained. If the current signals do not match the retained signals, the current device may be spoofing the valid/original device, and the source may take appropriate action (e.g., prevent some activity, require further authentication). Matching may be performed online and/or offline.
1. A method comprising:
during a first communication session between a first electronic device and a content source:
issuing an identifier to the first device;
delivering to the first device executable logic for collecting distinctive signals, wherein the logic executes to:
determine a first characteristic of a device on which the logic is executed; and
dynamically select the distinctive signals to collect, based on the first characteristic; and
upon execution of the logic by the first device:
receiving a first set of corresponding distinctive signals from the first device; and
storing the first set of corresponding distinctive signals;
during a second communication session between a second electronic device and the content source, initiated after the first communication session:
receiving the identifier from the second device;
delivering the executable logic to the second device; and
upon execution of the logic by the second device, receiving a second set of corresponding distinctive signals from the second device;
comparing the second set of corresponding distinctive signals to the first set of corresponding distinctive signals; and
responsive to the second set of corresponding distinctive signals not matching the first set of corresponding distinctive signals, blocking or reversing an action initiated during the second communication session.
2. The method of claim 1 , wherein the first set and the second set of corresponding distinctive signals each comprise: a time zone set on the corresponding device; and a screen size of the corresponding device.
3. The method of claim 2 , wherein the first set and the second set of corresponding distinctive signals each further comprise: a user agent on the corresponding device; and a canvas fingerprint generated on the corresponding device.
4. The method of claim 1 , wherein said comparing is performed only after termination of the second communication session.
5. The method of claim 1 , wherein said comparing is performed when one of a predetermined set of actions is attempted during the second communication session.
6. The method of claim 5 , wherein the predetermined set of actions comprises:
changing a password; and
generating a communication.
7. An apparatus, comprising:
one or more microprocessors; and
memory storing instructions that, when executed by the one or more microprocessors, cause the apparatus to:
during a first communication session between a first electronic device and a content source associated with the apparatus:
issue an identifier to the first device;
deliver to the first device executable logic for collecting distinctive signals,
wherein the logic executes to:
determine a first characteristic of a device on which the logic is executed; and
dynamically select the distinctive signals to collect, based on the first characteristic; and
upon execution of the logic by the first device:
receive a first set of corresponding distinctive signals from the first device; and
store the first set of corresponding distinctive signals;
during a second communication session between a second electronic device and the content source, initiated after the first communication session:
receive the identifier from the second device;
deliver the executable logic to the second device; and
upon execution of the logic by the second device, receive a second set of corresponding distinctive signals from the second device;
compare the second set of corresponding distinctive signals to the first set of corresponding distinctive signals; and
responsive to the second set of corresponding distinctive signals not matching the first set of corresponding distinctive signals, block or reverse an action initiated during the second communication session.
8. The apparatus of claim 7 , wherein the first set and the second set of corresponding distinctive signals each comprise: a time zone set on the corresponding device; and a screen size of the corresponding device.
9. The apparatus of claim 8 , wherein the first set and the second set of corresponding distinctive signals each further comprise: a user agent on the corresponding device; and a canvas fingerprint generated on the corresponding device.
10. The apparatus of claim 7 , wherein said comparing is performed only after termination of the second communication session.
11. The apparatus of claim 7 , wherein said comparing is performed when one of a set of predetermined actions is attempted during the second communication session.
12. The apparatus of claim 11 , wherein the set of predetermined actions comprises:
changing a password; and
generating a communication.
13. A system, comprising:
one or more microprocessors; and
a communication module comprising a non-transitory computer-readable medium storing instructions that, when executed, cause the system to:
during a first communication session between a first electronic device and a content source associated with the system:
issue an identifier to the first device; and
deliver to the first device executable logic for collecting distinctive signals, wherein the logic executes to:
determine a first characteristic of a device on which the logic is executed; and
dynamically select the distinctive signals to collect, based on the first characteristic; and
during a second communication session between a second electronic device and the content source, initiated after the first communication session:
receive the identifier from the second device; and
deliver the executable logic to the second device;
a signal collection module comprising a non-transitory computer-readable medium storing instructions that, when executed, cause the system to:
during the first communication session, upon execution of the logic by the first device:
receive a first set of corresponding distinctive signals from the first device; and
store the first set of corresponding distinctive signals; and
during the second communication session, upon execution of the logic by the second device:
receive a second set of corresponding distinctive signals from the second device; and
a signal comparison module comprising a non-transitory computer-readable medium storing instructions that, when executed, cause the system to:
compare the second set of corresponding distinctive signals to the first set of corresponding distinctive signals; and
responsive to the second set of corresponding distinctive signals not matching the first set of corresponding distinctive signals, block or reverse an action initiated during the second communication session.
14. The system of claim 13 , wherein the first set and the second set of corresponding distinctive signals each comprise: a time zone set on the corresponding device; and a screen size of the corresponding device.
15. The system of claim 14 , wherein the first set and the second set of corresponding distinctive signals each further comprise: a user agent on the corresponding device; and a canvas fingerprint generated on the corresponding device.
16. The system of claim 13 , wherein said comparing is performed only after termination of the second communication session.
17. The system of claim 13 , wherein said comparing is performed when one of a predetermined set of actions is attempted during the second communication session.
18. The method of claim 1 , further comprising at least one of:
identifying as bad actors one or both of the second device and a user associated with the second communication session; and
locking an account of the user associated with the second communication session.
19. The apparatus of claim 7 , wherein the memory further stores instructions that, when executed by the one or more microprocessors, cause the apparatus to one or more of:
identify as bad actors one or both of the second device and a user associated with the second communication session; and
lock an account of the user associated with the second communication session.
20. The system of claim 13 , wherein the non-transitory computer-readable medium of the signal comparison module further comprises instructions that, when executed, cause the system to one or more of:
identify as bad actors one or both of the second device and a user associated with the second communication session; and
lock an account of the user associated with the second communication session.