Authenticating anonymous information
A system and method comprising collecting analytics data or other types of analytics-related information from client devices in an anonymous and authenticated manner. A client device may use or provide a token or token-relation information, which may have been obtained from system servers beforehand, with a request to log the analytics data to the system servers in order to authenticate the analytics data being logged. The system servers may then authenticate the token or the token-related information, and in response to successful authentication, process the analytics data. Advantageously, the use of the token or token-related information allows the analytics data to be logged by client devices anonymously to preserve privacy, but also in a highly secure manner.
1. A computer-implemented method comprising:
receiving a payload requesting to log analytics data, the payload including a token;
authenticating the token, wherein the token is configured for multiple uses during a time period;
generating at least one pseudo-anonymous identifier associated with a user;
receiving a token request from a client device associated with the user;
verifying an identity of the user associated with the client device based on the at least one pseudo-anonymous identifier;
periodically rotating the at least one pseudo-anonymous identifier associated with the user; and
processing the request to log the analytics data in response to successful authentication of the token.
2. The method of claim 1 , wherein the authenticating of the token further comprises:
determining whether the token is valid; and
determining whether the token was previously issued.
3. The method of claim 1 , wherein the token comprises: a message authentication code (MAC) that includes a secret cryptographic hash algorithm or function.
4. The method of claim 3 , wherein authenticating the token further includes:
determining a result of the secret cryptographic hash algorithm or function using information contained in the payload; and
determining whether the result and the token match.
5. The method of claim 3 , further comprising:
sending the token to the client device associated with the user based on successful verification of the user.
6. At least one non-transitory computer-readable storage medium comprising instructions that, when executed, cause at least one processor to:
receive a payload requesting to log analytics data, the payload including a first token;
authenticate the first token, wherein the first token is configured for multiple uses during a time period;
generate at least one pseudo-anonymous identifier associated with a user;
receive a token request from a client device associated with the user;
verify an identity of the user associated with the client device based on the at least one pseudo-anonymous identifier;
periodically rotate the at least one pseudo-anonymous identifier associated with the user;
and
process the request to log the analytics data in response to successful authentication of the first token.
7. The medium of claim 6 , wherein the authentication of the first token further comprises the instructions further causing the at least one processor to:
determine whether the first token is valid; and
determine whether the first token was previously issued.
8. The medium of claim 6 , wherein the token comprises: a message authentication code (MAC) that includes a secret cryptographic hash algorithm or function.
9. The medium of claim 8 , further comprising authentication of the first token which includes the instructions causing the at least one processor to:
determine a result of the secret cryptographic hash algorithm or function using information contained in the payload; and
determine whether the result and the first token match.
10. The medium of claim 6 , the instructions further causing the at least one processor to:
send a second token to the client device based on successful verification of the user.
11. An apparatus comprising:
memory; and
at least one processor operable to execute stored instructions that, when executed, causes the at least one processor to:
receive a payload requesting to log analytics data, payload including a first token;
authenticate the first token, wherein the first token is configured for multiple uses during a time period;
generate at least one pseudo-anonymous identifier associated with a user;
receive a token request from a client device associated with the user;
verify an identity of the user associated with the client device based on the at least one pseudo-anonymous identifier;
periodically rotate the at least one pseudo-anonymous identifier associated with the user; and
process the request to log the analytics data in response to successful authentication of the first token.
12. The apparatus of claim 11 , wherein the authentication of the first token further causes the at least one processor to:
determine whether the first token is valid; and
determine whether the first token was previously issued.
13. The apparatus of claim 11 , wherein the first token comprises a message authentication code (MAC) that includes a secret cryptographic hash algorithm or function.
14. The apparatus of claim 13 , further comprising authentication of the first token which includes the instructions causing the at least one processor to:
determine a result of the secret cryptographic hash algorithm or function using information contained in the payload; and
determine whether the result and the first token-related information match.
15. The apparatus of claim 11 , the at least one processor further caused to:
send a second token to the client device based on successful verification of the user.