US 8,621,654 B2 · Using metadata in security tokens to prevent coordinated gaming in a reputation system

Abstract

To prevent gaming of a reputation system, a security token is generated for a security module using metadata about the client observed during the registration of the security module. The registration server selects metadata for use in generating the security token. The generated security token is provided to identify the client in later transactions. A security server may conduct a transaction with the client and observe metadata about the client during the transaction. The security server also extracts metadata from the security token. The security server correlates the observed metadata during the transaction with the extracted metadata from the security token. Based on the result of the correlation, a security policy is applied. As a result, the metadata in the security token enables stateless verification of the client.

Claims18

Dependent claims

A method of using a computer to authenticate a client of a reputation system, comprising:

using the computer to perform steps comprising:
conducting a transaction with the client, the transaction comprising receiving a security token from the client;
observing metadata about the client during the transaction;
extracting metadata about physical properties of the client from the security token;
determining by the computer whether the extracted metadata indicate that the client is potentially mobile;
correlating the observed metadata with the extracted metadata to determine a degree of correlation;
and
applying a security policy to the transaction with the client determined responsive to the degree of correlation and whether the extracted metadata indicate that the client is potentially mobile.

5 more elements

A non-transitory computer-readable storage medium storing executable computer program instructions for authenticating a client of a reputation system, the computer program instructions comprising instructions for:

conducting a transaction with the client, the transaction comprising receiving a security token from the client;
observing metadata about the client during the transaction;
extracting metadata about physical properties of the client from the security token;
determining whether the extracted metadata indicate that the client is potentially mobile;
correlating the observed metadata with the extracted metadata to determine a degree of correlation;
and
applying a security policy to the transaction with the client determined responsive to the degree of correlation and whether the extracted metadata indicate that the client is potentially mobile.

4 more elements

A computer system for authenticating a client of a reputation system, comprising:

a processor for executing computer program instructions;
and
a non-transitory computer-readable storage medium storing executable computer program instructions comprising instructions for:
conducting a transaction with the client, the transaction comprising receiving a security token from the client;
observing metadata about the client during the transaction;
extracting metadata about physical properties of the client from the security token;
determining whether the extracted metadata indicate that the client is potentially mobile;
correlating the observed metadata with the extracted metadata to determine a degree of correlation;
and
applying a security policy to the transaction with the client determined responsive to the degree of correlation and whether the extracted metadata indicate that the client is potentially mobile.

7 more elements

Dependencies are inferred from the claim text.

Using metadata in security tokens to prevent coordinated gaming in a reputation system

Life of this patent

Using metadata in security tokens to prevent coordinated gaming in a reputation system

Life of this patent

Abstract

Claims18