EXHIBIT	A

Case 2:23-cv-00418-JRG-RSP Document 1-1 Filed 09/15/23 Page 1 of 16 PageID #: 60
US010594823B1 

( 12 ) United States Patent ( 10 ) Patent No .: US 10,594,823 B1 

Jakobsson et al . ( 45 ) Date of Patent : * Mar . 17 , 2020 

( 54 ) METHOD AND APPARATUS FOR STORING 

INFORMATION IN A BROWSER STORAGE 

AREA OF A CLIENT DEVICE 

( 58 ) Field of Classification Search 

??? H04L 67 / 00_42 ; G06F 17 / 30–30861 ; G06F 

16 / 95–9574 

See application file for complete search history . 

( 56 ) References Cited ( 71 ) Applicant : RavenWhite Security , Inc. , Menlo 

Park , CA ( US ) 

U.S. PATENT DOCUMENTS ( 72 ) Inventors : Bjorn Markus Jakobsson , Portola 

Valley , CA ( US ) ; Ari Juels , Brookline , MA ( US ) 4,691,299 A 

6,314,492 B1 

9/1987 Rivest 

11/2001 Allen 

( Continued ) ( 73 ) Assignee : RavenWhite Security , Inc. , Menlo 

Park , CA ( US ) OTHER PUBLICATIONS 

( * ) Notice : 9 

Subject to any disclaimer , the term of this 

patent is extended or adjusted under 35 

U.S.C. 154 ( b ) by 0 days . 

This patent is subject to a terminal dis 

claimer . 

Electronic Privacy Information Center , “ Local Shared Objects * Flash Cookies ” ” , Jul . 21 , 2005 , https://epic.org/privacy/cookies/ 

flash.html , pp . 1-3 ( Year : 2005 ) . * 

( Continued ) 

Primary Examiner Clayton R Williams 

( 74 ) Attorney , Agent , or Firm — Van Pelt , Yi & James 

LLP ( 21 ) Appl . No .: 15 / 706,556 

( 22 ) Filed : Sep. 15 , 2017 

( 63 ) 

Related U.S. Application Data 

Continuation of application No. 14 / 560,906 , filed on 

Dec. 4 , 2014 , which is a continuation of application 

( Continued ) 

( 51 ) 

( 57 ) ABSTRACT 

Disclosed is a method and apparatus for performing steps to 

cause encoded information to be stored at a client device 

during a first network session between a server and the client 

device . To cause encoded information to be stored at a client 

device , the server first determines a set of network resource 

requests that encode the information . These network 

resource requests may include requests for one or more 

specific URLs and / or requests for one or more files . The 

server then causes the client device to initiate the network 

resource requests . The server may cause this initiation by , for example , redirecting the client device to the network 

resources . The client device initiating the network resource 

requests causes data representative of the network resource 

requests to be stored at the client device . 

10 Claims , 4 Drawing Sheets 

Int . Cl . H04L 29/08 ( 2006.01 ) 

H04L 29/06 ( 2006.01 ) 

( Continued ) 

U.S. CI . 

CPC H04L 67/2842 ( 2013.01 ) ; G06F 16/9566 

( 2019.01 ) ; G06F 16/9574 ( 2019.01 ) ; H04L 

67/02 ( 2013.01 ) ; H04L 67/42 ( 2013.01 ) 

( 52 ) 

ESTABLISH A FIRST NETWORK SESSION WITH 

ASSOCIATE INFORMATION WITH 

DETERMINE A SET OF NOIWORK RESOURCE 

NETWORK RESOURCE REQUESTS , RESULTING 

* READ " DATA STORED AT CUENT DEVICE 

Case 2:23-cv-00418-JRG-RSP Document 1-1 Filed 09/15/23 Page 2 of 16 PageID #: 61
US 10,594,823 B1 

Page 2 

2004/0111621 A1 * 6/2004 Himberger 

2004/0181598 Al * 9/2004 Paya 

Related U.S. Application Data 

No. 13 / 964,988 , filed on Aug. 12 , 2013 , now Pat . No. 

8,930,549 , which is a continuation of application No. 

11 / 590,083 , filed on Oct. 31 , 2006 , now Pat . No. 

8,533,350 . 

HO4L 63/083 

713/182 

G06F 17/30902 

709/227 

GO6F 21/41 

705/50 

2004/0260651 A1 * 12/2004 Chan 

2005/0022203 A1 

2005/0235155 Al * 

1/2005 Zisapel 10/2005 Lopatin ( 60 ) Provisional application No. 60 / 732,025 , filed on Nov. 

1 , 2005 . 

G06F 21/6263 

713/182 

H04L 29/06 

719/315 

2005/0240940 A1 * 10/2005 Quinet 

2006/0056618 Al 3/2006 Aggarwal ( 51 ) Int . Cl . GOOF 16/955 

GOOF 16/957 

( 2019.01 ) 

( 2019.01 ) OTHER PUBLICATIONS 

( 56 ) References Cited 

U.S. PATENT DOCUMENTS 

6,405,239 B1 

6,687,792 B2 

7,107,535 B2 

7,200,665 B2 

7,237,118 B2 * 

6/2002 Addington 2/2004 Beyda 9/2006 Cohen 

4/2007 Eshghi 6/2007 Himberger 

Christopher Kings - Lynne , Implementing Cross - Domain Cookies , Nov. 29 , 2000 , Phpbuilder , pp . 1-6 ( Year : 2000 ) . * Agarwal , R. et al . , “ Privacy - Preserving Data Mining ” , ACM SIGMOD 

Conference on Management of Data ( 2000 ) , ACM Press , pp . 439-450 . Clover's , “ Timing Attacks on Web Privacy ” , Report of Feb. 20 , 2002 , referenced 2006 at http://www.securiteam.com/securityreviews/ 5GP020A6LG.html , downloaded on Oct. 9 , 2006 . Felton , E. W. et al . , “ Timing Attacks on Web Privacy ” , ACM 

Conference on Computer and Communication Security ( 2000 ) , ACM Press , pp . 25-32 . 

HO4L 63/083 

709/227 2002/0164058 A1 

2004/0003351 A1 

2004/0073566 Al 

11/2002 Aggarwal 1/2004 Sommerer 

4/2004 Trivedi * cited by examiner 

Case 2:23-cv-00418-JRG-RSP Document 1-1 Filed 09/15/23 Page 3 of 16 PageID #: 62
U.S. Patent Mar. 17 , 2020 Sheet 1 of 4 US 10,594,823 B1 

FIG . 14 

sple Na 

sus ****** popuri 

BROWSER 

Case 2:23-cv-00418-JRG-RSP Document 1-1 Filed 09/15/23 Page 4 of 16 PageID #: 63
U.S. Patent Mar. 17 , 2020 Sheet 2 of 4 US 10,594,823 B1 

FIG . 18 

wwwwwwwwww 

NEIWORK RESOURCE REQUESTS , RESULTING 

WWW 

* READ " DATA STORED AT CUENT DEVICE 

Case 2:23-cv-00418-JRG-RSP Document 1-1 Filed 09/15/23 Page 5 of 16 PageID #: 64
U.S. Patent Mar. 17 , 2 2020 Sheet 3 of 4 US 10,594,823 B1 

FIG . 2 

1 

2 208 

cox 

: 

HISTORY CACHE 

Case 2:23-cv-00418-JRG-RSP Document 1-1 Filed 09/15/23 Page 6 of 16 PageID #: 65
U.S. Patent Mar. 17 , 2020 Sheet 4 of 4 US 10,594,823 B1 

FIG . 3 

ST 

wi 

FIG . 4 

INTERFACE 

Irelan 

PROCESSOR 

mos 

Case 2:23-cv-00418-JRG-RSP Document 1-1 Filed 09/15/23 Page 7 of 16 PageID #: 66
1 

5 

30 

US 10,594,823 B1 

2 

METHOD AND APPARATUS FOR STORING for a particular product of interest . This may increase the 

INFORMATION IN A BROWSER STORAGE user's satisfaction with the Web page and , as a result , the 

AREA OF A CLIENT DEVICE user may return to the e - commerce Web site at a later time 

when the user wants to purchase something else . CROSS REFERENCE TO OTHER Further , the identification of a user may provide security 

APPLICATIONS benefits . For example , a Web page does not want to display information associated with a particular user to another , different user . Cookies enable the Web page to display This application is a continuation of co - pending U.S. specific information ( e.g. , username , password , or home patent application Ser . No. 14 / 560,906 , entitled METHOD address ) about a user to the user and not to other users . AND APPARATUS FOR STORING INFORMATION IN A 10 Despite the benefits associated with customizing a Web BROWSER STORAGE AREA OF A CLIENT DEVICE page , cookies also present drawbacks . One drawback asso filed Dec. 4 , 2014 , which is incorporated herein by reference ciated with cookies relates to privacy . Cookies are typically in its entirety for all purposes , which is a continuation of stored in a user's computer without the user's consent . U.S. patent application Ser . No. 13 / 964,988 , entitled Cookies are then transmitted to a Web server when the user 

METHOD AND APPARATUS FOR STORING INFOR- 15 revisits a Web site , again without the user's consent . This 

MATION IN A BROWSER STORAGE AREA OF A CLI lack of consent may raise concerns about a user's privacy ENT DEVICE filed Aug. 12 , 2013 , now U.S. Pat . No. because information about a user is being stored and trans 

8,930,549 , which is incorporated herein by reference in its mitted without the user's permission . It is also possible for entirety for all purposes , which is a continuation of U.S. servers to share information about a user that was obtained 

patent application Ser . No. 11 / 590,083 , entitled METHOD 20 from a third - party cookie . Thus , a user's personal informa 

AND APPARATUS FOR STORING INFORMATION IN A tion , such as a user's name , interests , address , credit card 

BROWSER STORAGE AREA OF A CLIENT DEVICE number , etc. may be shared between different companies 

filed Oct. 31 , 20 now U.S. Pat . No. 8,533,350 , which is without the user consenting to this information sharing . incorporated herein by reference in its entirety for all pur As a result , some people block or clear cookies . Most 

poses , which claims the benefit of U.S. Provisional Appli- 25 browsers have this ability via one or more software controls . cation No. 60 / 732,025 filed Nov. 1 , 2005 , which is incor Further , common spyware programs typically treat cookies 

porated herein by reference in its entirety for all purposes . as spyware and delete the cookies . Although a user's infor 

mation can no longer be retrieved by a Web server after its 

BACKGROUND OF THE INVENTION cookies are removed or blocked , the Web server cannot then 

provide a user with a customized Web page . Organizations , such as e - commerce organizations , may lose business The present invention relates generally to client - server because a user may become dissatisfied with the user's communications and more specifically to causing a browser experience on the organization's Web site . Further , financial to store information in a browser storage area of a client institutions such as banks may use cookies as a way to device . authenticate a user . If a user blocks or clears cookies , the 

A user typically uses a Web browser , such as Microsoft’s 35 bank may be forced to rely on the user's username and 

Internet Explorer , to access a Web page over the Internet . password to identify the user . Without cookies being stored 

The information needed to display the Web page via the on a user's browser , the banks lose another technique to 

browser is transmitted by a ( Web ) server over the Internet . identify the user . This may result in issues when someone 

A Web page ( e.g. , associated with an e - commerce Web who is not a particular user is fraudulently acting as the user site or a financial institution ) may request user information 40 by using the particular user's username and password . from the user when the user first accesses the page , such as Therefore , there remains a need to identify a client device 

a user's name , password , address , interests , etc. When the when the user ( i.e. , browser ) accesses a Web page that the 

user accesses the same Web page at a later time , the server user has previously visited without many of the privacy 

may use the information previously entered by the user to issues associated with cookies . 

customize the Web page for the user . BRIEF DESCRIPTION OF THE DRAWINGS This customization of a Web page is typically the result of 

cookies . A cookie is a message transmitted to a browser by FIG . 1A is a block diagram of a communication network a server . The message can include user - specific identifiers or having a first and second server communicating with a client personal information about the user . The browser typically device in accordance with an embodiment of the present stores the message in a text file . The message ( i.e. , cookie ) 50 invention ; is then sent back to the server each time the browser requests FIG . 1B is a flowchart showing the steps performed by the 

a Web page from the server . first ( or second ) server in accordance with an embodiment of For example , when Alice visits the Web site X , the server the present invention ; 

for X may transmit a cookie to Alice's computer that FIG . 2 shows a high level block diagram of a browser contains an encoding of the identifier “ Alice ” . When Alice 55 storage area of the client device which may be used in an visits X again at a later time , her browser releases this embodiment of the invention ; 

cookie , enabling the server to identify Alice automatically . FIG . 3 shows a tree structure that may be used to identify This may result in X addressing Alice by her name rather a client device in accordance with an embodiment of the than a generic " Hello " string . invention ; and 

The customization of a Web page for a user often 60 FIG . 4 shows a high level block diagram of a computer increases a user's satisfaction with a Web page and may system which may be used in an embodiment of the inven 

decrease the time needed for a user to locate a particular item tion . on the Web page . For example , the same e - commerce Web 

page can display different products at the top of the site for DETAILED DESCRIPTION 

different users . The products displayed may be based on the 65 

user's interests or past behavior . This customization may To circumvent many of the privacy issues associated with 

shorten the time that the user needs to browse the Web page traditional cookies , one or more servers instead “ write ” and 

45 

Case 2:23-cv-00418-JRG-RSP Document 1-1 Filed 09/15/23 Page 8 of 16 PageID #: 67
US 10,594,823 B1 

3 4 

“ read ” a cache cookie to and from a browser storage area device 108 include a desktop computer , a laptop , a personal associated with a browser requesting a Web page from the digital assistant , a smartphone , etc. The client device 108 

server ( s ) . The browser storage area may include a history includes a browser 116 for downloading network resources 

cache and / or a Temporary Internet Files ( TIFs ) area . ( e.g. , Web pages or files ) via the network 112 ( e.g. , for 

In accordance with an aspect of the present invention , a 5 displaying , executing , or storing on the client device 108 ) . server performs steps to cause encoded information to be The browser 116 is well known in the art , for example stored at a client device during a first network session Microsoft Internet Explorer . The connection between the 

between the server and the client device . During a second client device 108 and the server 104 may be made using any network session between the server and the client device , the well known data network communication protocol , for 

server can perform steps to determine whether the encoded 10 example the well known Hyper Text Transfer Protocol 

information is stored at the client device . The server can use ( HTTP ) or HTTPS , which is a secured version of HTTP in 

this information to identify ( e.g. , recognize or authenticate ) which the payload is end - to - end encrypted . Both HTTP and 

a client device . The server that determines whether the HTTPS are well known for Internet communications . encoded information is stored at the client device may be the The first server 104 ( also referred to below as server 104 ) 

same server or a different server than the server that causes 15 is any device or devices that can serve a network resource to 

encoded information to be stored at the client device . the client device 108 over the network 112 . 

Further , the server ( s ) that perform these functions may In accordance with an embodiment of the present inven 

include one or more servers . tion , the user of the client device 108 uses its browser 116 

To cause encoded information to be stored at a client to establish a first network session with the server 104. For 

device , the server first determines a set of network resource 20 example , the user uses browser 116 to request a Web page requests ( zero or more network resource requests ) that from the server 104. The server 104 establishes a first 

encode the information . These network resource requests network session with the client device 108 in step 150. In 

may include requests for one or more specific URLs and / or one embodiment , the user provides login information ( e.g. , requests for one or more files . The server then causes the username and / or password ) to the server 104 to establish the 

client device to initiate the network resource requests . The 25 first network session . server may cause this initiation by , for example , redirecting During this first network session , the server 104 associ 

the client device to the network resources . The client device ates information with the client device 108 in step 155. The 

initiating the network resource requests causes data repre information may alternatively be associated with the user 

sentative of the network resource requests to be stored at the using the client device 108. The information may be one or 

client device . 30 more string , bit sequence , number , etc. In one embodiment , In one embodiment , to determine the data representative the server is associating the information with the client 

of the network requests , the server transmits a sequence of device 108 ( or user ) in order to identify the client device 108 

messages , each message in the sequence causing zero or ( or user ) at a later time . The information may be generated 

more network resource requests for data . The server then in any fashion ( e.g. , chosen from a list , randomly generated , determines , from the zero or more network resource requests 35 pseudo - randomly generated , etc. ) . for data , the encoded information . In one embodiment , one The server 104 then determines , in step 160 , a set of 

or more servers in a plurality of servers determines a portion network resource requests that encode the information . of the encoded information . Examples of network resource requests include specific 

In another embodiment , the server causes elements asso requests for one or more Web pages or specific requests for 

ciated with a graph structure to be stored . In one embodi- 40 one or more files ( e.g. , TIFs ) . The server 104 then causes the 

ment , the graph structure is a tree structure that includes client device 108 to initiate the network resource requests in 

nodes as the elements . The nodes can be stored in the 

browser storage area . In one embodiment , each node corre In one embodiment , the server 104 provides the requested sponds to a resource identifier ( e.g. , secret key ) stored at a Web page to the client device 108. For example , the server 

secret address ( e.g. , secret naming ) . 45 104 can transmit the instructions ( e.g. , hyper text markup In another embodiment , a plurality of addresses are language ( HTML ) ) that the browser 116 interprets to display caused to be designated in the browser storage area , where the requested Web page . As described in more detail below , each of the addresses is associated with a time epoch . A first the server 104 may cause the client device 108 to initiate the 

pseudonym for a user of the client device is maintained for set of network resource requests by redirecting the browser 

each time epoch . The server can then determine whether a 50 116 to the network resources via the HTML code . The client 

second pseudonym exists at an address of the browser device 108 initiating the network resource requests causes 

storage area . If the second pseudonym exists , the server can data ( e.g. , URL name or TIF ) representative of the network 

identify the user and cause the first pseudonym to be stored resource requests to be stored at the client device . As 

at the address in place of the second pseudonym at the described in more detail below , this data is stored in a 

expiration of the time epoch . 55 browser storage area 170 ( e.g. , browser cache ) . These and other advantages of the invention will be The following is a brief background of the browser 

apparent to those of ordinary skill in the art by reference to storage area 170 and how a browser typically uses its 

the following detailed description and the accompanying browser storage area 170. An embodiment of the structure of drawings . browser storage area 170 is described in greater detail below 

FIG . 1A is a block diagram of an embodiment of a 60 with respect to FIG . 2. When a browser displays a Web page communication network 100 having a first server 104 com for the first time , the browser typically downloads one or municating with a client device 108 over a network 112 such more files ( e.g. , images , text , style sheets , etc. ) to its browser 

as the Internet . FIG . 1B is a flowchart showing the steps storage area ( e.g. , browser cache ) . The browser then uses 

performed by the first server 104 in accordance with an these files to display the Web page . The stored files represent embodiment of the invention . 65 the “ cached copy ” of the Web page , which is local to the 

The client device 108 can be any device that can access client device associated with the browser . The next time the 

another computer via network 112. Examples of a client browser visits the same Web page , the browser determines 

step 165 . 

Case 2:23-cv-00418-JRG-RSP Document 1-1 Filed 09/15/23 Page 9 of 16 PageID #: 68
US 10,594,823 B1 

5 6 

what is stored in its browser storage area and displays the client device . Server roles may change dynamically , using local copy of the files rather than downloading the same files techniques for load balancing well known in the art . again . This often enables more efficient Web browsing for a Browser Storage Area 

user of the browser . For example , if the user presses the FIG . 2 shows an embodiment of a browser storage area 

“ Back ” button to instruct the Web browser to load the 5 200. The browser storage area 200 may include a history previously loaded Web page , the previously loaded Web cache 204 that contains Uniform Resource Locators ( URLs ) 

page typically appears almost instantly because the browser 208 recently visited by the browser ( also called browser does not have to download all of the files associated with the history ) . The first part of the URL indicates the protocol to Web page again . use , and the second part specifies the IP address or the Referring again to FIGS . 1A and 1B , the data stored in the 10 domain name ( referred to below as domain ) where the browser storage area 170 that is representative of the net network resource is located . For example , the URL http : // work resource requests is referred to herein as a cache 

cookie 174. As described in more detail below , the cache www.server.com/page1.html identifies to the browser that 

cookie 174 is not an explicit browser feature but rather a the protocol is HTTP and that the requested network 

form of persistent state in the browser 116 that the server 104 15 resource is the HTML document having the name 

can access . Like a traditional cookie , a cache cookie 174 can page1.html and located at a server in the domain identified 

be used by the server 104 to identify ( e.g. , recognize or by www.server.com . The history cache 204 contains a list of 

authenticate ) the client device 108. Unlike traditional cook URLs to which the client device has connected over some 

ies , which can be blocked or cleared ( e.g. , via spyware or via prior time period . The time period is generally adjustable by 

a browser setting to block or remove cookies ) , the cache 20 the user . As an example , the history cache 204 may store cookie 174 typically cannot be blocked or cleared via URLs visited by the browser during a period of 9 days . spyware or a browser setting . As a result , the cache cookie A server can “ write ” any of a wide variety of cache 

174 eliminates some of the drawbacks associated with cookies in the history cache 204 to , for instance , facilitate 

traditional cookies described above . the identification of a client device ( or user ) . One way a 

The browser 116 and server 104 end the first network 25 server can " write ” to the client's history cache 204 is by session ( step 180 ) . For example , the user closes the browser redirecting the user to other URLs ( within or external to the 

116 that was displaying the requested Web page to end the server's domain space ) . For example , a server operating the 

first network session . domain www.server.com can redirect a browser to a URL of 

At some later point in time , the browser 116 establishes a the form “ www.server.com?Z ” for any desired value of Z 

second network session with the server 104 in step 185 , for 30 when the browser visits www.server.com , thereby inserting example by requesting the same Web page previously “ www.server.com?Z ” into the history cache 204 of the 

requested in the first network session . During the second client . In one embodiment , the redirection of the user's 

network session , the server 104 “ reads ” the data ( the cache browser to another Web page ( e.g. , page Z ) is invisible to the 

cookie 174 ) , for instance to identify the client device 108 , in user . The server redirects the user's browser to another Web 

step 190. In one embodiment , the server 104 “ reads ” the data 35 page ( e.g. , page Z ) for the purpose of “ writing ” that URL in step 190 by transmitting a sequence of messages to the ( e.g. , “ www.server.com?Z ” ) in the browser's history cache 

client device 108. Each message can cause the client device 204. The server may also redirect the browser to any number 

108 to make zero or more network resource requests for data of other Web pages ( with or without the user recognizing the 

to the server . The exact collection of the network resource redirection ( s ) ) . As a result , the URLs written to the history 

requests indicate the data stored at the client device ( in step 40 cache 204 by the server are an embodiment of the cache 

165 ) . From this data , the server 104 can derive what infor cookies . mation was encoded and stored in the client device 108 . At some later point in time , when the user revisits 

In another embodiment , the server that indirectly “ writes ” www.server.com , the server can “ read ” the history cache 204 

the data to the client device 108 ( step 165 ) is different than of the client device to determine what Web pages the 

the server that “ reads ” the data in step 190. For example , the 45 browser has recently visited . The server may recognize that 

first server 104 may “ write ” the data while a second server the browser has visited the Web pages that the browser was 

195 ( shown with dashed lines ) may “ read ” the data from the previously redirected to by the server . The server can use the 

client device 108. Thus , the two network sessions may be pattern of URLs stored in the browser's history cache 204 to , created between the client device 108 and different servers e.g. , identify the client device ( or user ) . Even if the browser 

( e.g. , first server 104 and second server 195 ) . Also , the two 50 is blocking cookies ( or has deleted its cookies after its first 

servers 104 , 195 may or may not be in communication with visit to www.server.com ) , the history cache 204 still contains 

each other . Further , the first server 104 and / or the second the cache cookies that the server can use to identify the client 

server 195 may each include one server or a plurality of device ( or user ) . servers . In one embodiment , the first server 104 includes a The browser storage area 200 can also include a Tempo first plurality of servers and the second server 195 includes 55 rary Internet Files ( TIFs ) area 212 for storing TIFs 216 ( e.g. , a second plurality of servers , where the first plurality of TIF A , TIF B , and TIF C ) . TIFs are files containing infor 

servers and the second plurality of servers have one or more mation embedded in Web pages . For example , a Web page 

servers in common . may display particular graphics ( e.g. , one or more icons ) 

Further , the first server may transmit a first message to the ( e.g. , .JPG file ) that are downloaded by a browser when the 

client device , the first message causing the client device to 60 browser requests the Web page . To speed up the display of 

initiate a first network resource request to the second server . the Web page on the browser , the browser may store these 

The first network resource request may result in the second objects responsible for the graphic ( s ) ( e.g. , icons ) in one or 

server transmitting a second message to the client device , more TIFs after downloading the objects ( e.g. , the first time which may cause the client device to initiate a second that the user visits the Web page ) . TIFs typically have no 

network resource request ( to the second server or another 65 expiration they persist indefinitely ( as long as the browser 

server ) . Thus , different servers may be designated to deter doesn't delete a TIF to maintain its memory cap on the 

mine different portions of an identifier associated with a amount of disk space devoted to TIFs ) . 

Case 2:23-cv-00418-JRG-RSP Document 1-1 Filed 09/15/23 Page 10 of 16 PageID #: 69
US 10,594,823 B1 

7 8 

In order to place an object X in the TIF area 212 , a server As described , a cache cookie may be one or more URLs 

can serve content to the browser that causes the browser to stored in the history cache 204 or one or more TIFs stored 

download object X A server can verify whether the browser in TIF area 212. Thus , the cache cookie can be cleared when 

contains object X in its browser storage area 200 by , for the history cache 204 or the TIF area 212 is cleared . In 

example , redirecting the browser to a URL that contains 5 another embodiment , a cache cookie consists of both TIFs 

object X If TIF X is not present in the browser storage area ( stored in the TIF area 212 ) and URLs ( stored in the history 

200 , then the browser requests object X from the server and cache 204 ) . If a cache cookie consists of both TIFs and 

downloads object X If TIF X is present in the TIF area 212 URLs , the cache cookie can only be erased if both of these 

of the browser storage area 200 , the browser does not storage areas ( e.g. , history cache 204 and TIF area 212 ) are 

10 cleared . request object X from the server but instead retrieves its A cache cookie may also be combined with a traditional local copy . The server can determine whether the browser cookie , for example to provide another layer of identifica requests X or retrieves its local copy of X and can use this tion ( e.g. , authentication ) . The server can identify the client determination to identify the client device ( or user ) . device via the traditional cookie and then authenticate the 

For example , if a browser visits the Web page 15 client device with the cache cookie . To clear the combina 

www.server.com for the first time , the browser downloads tion of a cache cookie with a traditional cookie , a user then 

one or more image files that are displayed as part of the Web has to clear or block cookies during the same interval of time 

page . The browser stores these image files as TIFs in the that the browser storage area 200 is cleared . browser storage area 200. Further , the Web page ( i.e. , the With respect to the second difference between cache 

server providing the Web page ) may redirect ( e.g. , without 20 cookies and traditional cookies , cache cookies may be read 

the user's knowledge ) the browser to other Web pages ( e.g. , and written by an authorized server ( in any domain ) . A 

in the same domain ) and these other Web pages may cause server may be authorized when the server has access to 

the browser to download other image files . As a result , the particular information about the cache cookie ( e.g. , that is 

browser may store a variety of TIFs associated with different difficult for third parties to derive ) . Web pages . When the browser returns to www.server.com at 25 In another embodiment , a server is authorized to read and 

a later time , the server providing the www.server.com page write a cache cookie by having explicit read / write access to 

to the browser can determine what image files the browser the cache cookie . Read / write access is given by knowledge is requesting ( e.g. , from www.server.com ) and what image of the names of the URLs for history based cache cookies . files the browser already has in it's local browser storage Write access of TIF based cache cookies is based on 

area 200 ( i.e. , TIF area 212 ) . The server can use this 30 knowing the names of the TIFs . Read access is associated 

determination ( i.e. , of which specific image files the browser with being the domain associated with the address of the 

retrieves from its local TIF area 212 ) to identify the browser . TIFs . As a result , the TIFs stored in the TIF area 212 of a browser Cache cookies can be generated and deployed in a manner 

are an embodiment of cache cookies . that allows for load balancing between multiple servers . For 

In one embodiment , the server withholds the request for 35 example , each of the multiple servers can read one portion X so that the server does not change the state of the cache of the cache cookie , and the servers are not required to 

cookie whose presence is being tested by the server . In communicate with each other in order for a consistent and 

particular and in one embodiment , if the requests made correct reading of the portion of the cache cookie . As a 

during the “ read ” of data are not responded to by the server result , individual packets corresponding to the cache cookie 

104 ( i.e. , the requested data is not served to the client ) , then 40 can be routed to different servers associated with the same 

the contents of the history cache or the TIF area remain the domain , and there may be no need for coordination between 

same and are not affected by the requests being made . the servers . In one embodiment , the servers do not know of 

Although this may trigger an HTTP “ 401 " error ( i.e. , the each others ' existence . Thus , a newly introduced server only 

response that refuses the client to get the data it requested ) , needs to be known by the servers performing or directing manipulation of the browser storage area 200 can take place 45 routing of Internet traffic in order for them to be able to 

in a hidden window , unperceived by the user ( e.g. , the perform part of the task of reading the cache cookie . Once 

requests are made in a small window , such as a 0 - sized a cache cookie has been read , the identifying information 

iframe ) . can be incorporated in all consecutive communication 

TIF - based cache cookies can enable privacy via access between the user and server during the same session , without 

control restrictions . Browsers often reference TIFs by means 50 any need to read the cache cookie again during the session 

of URLs . When a browser requests a TIF , therefore , the in question . browser refers to the associated domain , not to the server Graph Topology for Cache Cookies 

that is displaying the page containing X ( e.g . , the image ) . In one embodiment , cache cookies are constructed by Thus , in one embodiment , only the Web site in control of the elements associated with a graph structure . Any graph URL corresponding to a TIF can detect the presence of that 55 topology can be associated with a cache cookie . For 

TIF in a browser storage area while another Web site cannot . example , the graph structure can be an n * k matrix of 

Characteristics of Cache Cookies elements or a tree - shaped graph of elements . In one embodi 

Although cache cookies can provide an alternative to ment , the graph structure has the format of n * 2 elements , n 

traditional cookies , several differences exist between the elements and binary trees of height n . two . For one and as described above , cache cookies do not 60 An element of the graph structure associated with a cache 

get cleared when a user clears or blocks traditional cookies . cookie may be “ set ” if the element corresponds to the 

Second , unlike traditional cookies , which can typically only presence of some information . The element may be “ not set " 

be accessed by a server in the specified domain , cache if the element corresponds to the absence of some informa 

cookies stored in the history cache can be accessed by a tion . Depending on the sequence of elements that are “ set ” 

server in any domain . Specifically , the history - based cache 65 or “ not set ” , the server can encode any arbitrary identity or 

cookies can only be read by another server if that server other information string . For a cache cookie corresponding knows the names of the URLs . to n * 2 elements , the graph structure can be considered as 

Case 2:23-cv-00418-JRG-RSP Document 1-1 Filed 09/15/23 Page 11 of 16 PageID #: 70
US 10,594,823 B1 

9 10 

two n - length vectors that are referred to herein as vector browser's history cache 204 , that these requests are made 

number 0 and vector number 1. A set position in the ith from the same IP address if they occur during the same 

position of vector i corresponds to letting the ith position of session . As a result , the server can detect pharming by 

a binary string equal j . For a structure with n elements , determining inconsistencies in IP addresses for related com where n = m log 2m for some value m , the first m positions 5 munication . Specifically , if the DNS tables associated with of the vector can correspond to which binary digits in an a user are incorrect , then the history cache 204 may contain 

m - bit string are set to zero . Similarly , the remaining log m a URL element but not its corresponding IP address element . bits can encode the number of bits that are not set to zero . Additionally , responses to requests can be sent to both types Alternatively , the vector can correspond to the binary digits in an m - bit string that are set to one , and the remaining log 10 in the DNS table . If only the IP address responses are of addresses ( i.e. , the IP address and the domain name ) listed 

m bits can encode the number of bits that are not set to one . received by the server , then the DNS information available As a result , cache cookies can provide error detection . to the client device is likely to be incorrect . In another embodiment , an n * 1 matrix can be used with General Read / Write Structure of Browser Storage Area no error detection . For a cache cookie corresponding to an 

m - height binary tree , the identity or information to be stored 15 The browser storage area 200 can be viewed as a general 

can be encoded by setting all nodes on a given path , and read / write memory structure in the user's browser . A server 

letting the other nodes not be set . In one embodiment , the can test for the presence of any cache cookie in a list of many 

setting of all nodes on a given path is performed at the same cache cookies . In one embodiment , a server can mine cache 

time . Thus , more than one path may be set simultaneously . cookies in an interactive manner ( e.g. , the server can refine This corresponds to storing multiple pieces of information 20 its search as the server searches , using , for example , pre with one browser using one cache cookie . The exact path can liminary information to guide its detection of additional 

encode the information stored , where a left path may cor cache cookies ) . respond to a zero and a right path may correspond to a 1. For As described above , a server can indirectly “ write ” cache 

trees that are k - ary ( each node that is not a leaf has k cookies to the history cache 204 by redirecting a browser to children ) , each node that is not a leaf can correspond to the 25 URLs ( within its domain space or externally ) . For example , storage of a k - ary number , where k = 2 corresponds to the a server operating the domain www.server.com can redirect 

binary case . Similarly , in a matrix of size n * k , n k - ary digits a browser to a URL of the form " www.server.com?Z ” for 

can be stored . In one embodiment , some of the n k - ary digits any desired value of Z , thereby inserting “ www.server 

are used for error - detection purposes . .com ? Z ” into the history cache 204. Thus , a server can create The browser's history cache can correspond to a set of 30 a cache cookie memory structure ( e.g. , within the history elements , where each element is a URL . An element is set cache 204 ) over the space of URLs of the form , e.g. , if the URL is present in the browser's history cache 204 , and “ www.server.com?Z ” , where ZE { 0 , 1 } 1 + 1 . Thus , Z is an 

not set if the URL is present . Further , an element can be index into the cache cookie memory structure . The space can 

set in the TIF area 212 if a particular TIF is present and not be very large ( for example , Microsoft's Internet Explorer 

set if the TIF is not present . 35 can support 2048 - bit URL paths ) . In one embodiment , different parts of a tree - based cache Let the predicate Pi , [ r ] denote whether the URL corre cookie can be read by different servers . Specifically , each sponding to a given index rER is present in the browser 

server may read a part of a cookie by determining whether storage area 200 of user i . If so , P ; [ r ] = 1 ; otherwise P ; [ r ] = 0 . some portion of elements are set or not set . This server may For clarity , time is not included in this notation . further initiate a read of another part of the cache cookie . 40 A server interacting with user i can change any P [ r ] from 

This read of another part of the cache cookie may be O to 1. The server can do this by planting the URL indexed 

performed by a different server . In one embodiment , the by r in the browser storage area 200. To erase cache cookies , server initiates a read of the parts that have not yet been read a server can assign two predicates to a given bit b . The by communicating the parts that have been read to the user's predicates may be viewed as on - off switches . If neither 

browser . The next server can determine the parts that have 45 switch ( predicate ) is on , the bit b has no assigned value . been “ read ” and use this information to determine the parts When the first switch is on and the second switch is off , b = 0 . of the cookie that still need to be " read ” . If the opposite is true , then b = 1 . Finally , if both switches are 

Detection of Pharming Using Cache Cookies on , then b is again unassigned — it has been “ erased ” . In one embodiment , a server can use cache cookies to More formally , let S = { 0,1 } !. A predicate Q [ s ] over Scan 

detect pharming . Pharming typically seeks to obtain per- 50 be defined for any sES . This predicate can assume a bit 

sonal or private ( e.g. , financial ) information through domain value , i.e. , Qi_g [ s ] € { 0,1 } ; otherwise , it is " blank ” and 

spoofing . Pharming “ poisons ” a domain name server . A Q : [ s ] = Q can be written , or it is “ erased ” , and Qi [ s ] = v can be 

domain name server , or DNS server , is a server that trans written . Let || denote string concatenation . Qi can be defined 

lates domain names into IP addresses . The DNS server as follows : Let ro = P [ s || ' 0 ' ) and let r = P [ || * 1 ' ] . If roFr 0 , maintains DNS tables that have IP addresses that correspond 55 then Qi [ s ] = 0 ; if ro = r1 = 1 , then Qi [ s ] = v . Otherwise , Qi [ s ] = b , with domain names . Pharming poisons a DNS server by where r1 = 1 . This definition yields a write - once structure M 

infusing false information into one or more DNS tables , with erasure for cache cookies over the set S. When Qi [ s ] = 0 , resulting in a user's request being redirected to an incorrect a server interacting with user i can write an arbitrary bit 

Web page . The user's browser , however , displays that the value b to Qi [ s ] by setting Pi , [ s || b ] = 1 . The server can erase 

user is at the correct Web page , making pharming dangerous 60 a stored bit bin Q : [ s ] by setting P ; [ s || 1 – b ] = 1 . and often difficult to detect . Within the structure M , an m - bit memory structure M ' can 

A URL can have the format www.server.com/path or be defined . M ' is capable of being written c times . Suppose 192.65.1.12/path ( i.e. , domain name or IP address ) . Some M ' consists of a sequence of n = cm bits in M. Once the first 

URLs can have one format , while others can have another block of m bits in M ' has been written , the server re - writes 

format . If a server receives several requests for URLs , some 65 M ' by erasing this first block and writing to the second block . of which are of one format while others are of the other Thus , the server can write c times to M ' . To read M ' , the 

format , then the server can verify , using cache cookies in the server can perform a binary search , testing the leading bit of 

Case 2:23-cv-00418-JRG-RSP Document 1-1 Filed 09/15/23 Page 12 of 16 PageID #: 71
15 

..bal ) . 

US 10,594,823 B1 

11 12 

the memory blocks in M ' until the server locates the current browser to determine which path the browser storage area write boundary . Thus , a read requires at most ?log c ) queries . contains . Thus , the server performs a depth - first search of 

In one embodiment , the memory structures M and M the identifier tree to identify the user . In one embodiment , permit random access and not search operations . Thus , when the search is feasible only for the original server that 

1 is sufficiently large ( e.g. , when cache cookies are 80 bits 5 generated the identifier tree ( or for a delegate ) , because only long ) the cache cookie memory structure M can be large that server knows the secret cache cookies associated with 

enough to render brute - force search by browser sniffing nodes in the tree . Therefore , privacy for the user identifiers impractical . For example , suppose that a server plants a is maintained . secret , k - bit string x = x0X1 Xz into a random location in For example , consider a binary tree T Let d denote the the history cache 204 of user i . That is , the server selects 10 depth of the tree . For a given node n within the tree , let n || * O ' SE2 ? -k - 1 , and sets Qi [ s + i ] = x ; for 1sisk . It is likely infea denote the left child , and n || ' 1 ' denote the right child . For the sible for a second server interacting with user i to learn root , n is a null string . For every distinct bitstring X — or even to detect its presence . Hidden data of this kind 

can be used to protect the privacy of cache cookies . B = bobi ... b ; of length j , there is a unique corresponding node Variant Memory Structures ?? at depth j . The leaves of T are the set of nodes ng 

In other embodiments , more query - efficient encoding for BE { 0 , 1 } " 

schemes for the cookie cache memory structures M and M ' In one embodiment , two secret values , YB and us , are 

are used . For example , an m - bit block of data in M can be associated with each node ng . The first value , YB , is a k - bit 

defined as follows . Let { P [ s ] , P [ s + 1 ] , P [ s + c ] } represent the secret key . The second value , ub , is a secret ( 1 - bit ) address 

memory block in question . A leading predicate P ; [ s - 1 ] is 20 in the cache cookie memory . To store node ng in the cache 

pre - pended . The value P ; [ s - 1 ] = 0 ' indicates that the block is cookie memory of a particular browser , the server stores the 

active_the block has not yet been erased . To encode the secret key YB in address up . The sets of secret values { ( yB block , a server may change any predicate to a ‘ l ’ . P ; [ s - 1 ] = 1 ' UB ) } B E { 0,13 “ may be selected uniformly at random or gen indicates that the block has been erased . In one embodiment , erated pseudo - randomly from a master secret key . this type of erasure does not truly efface information . The 25 The server that has generated T for its population of users 

information in an “ erased ” block remains readable . Full assigns each user to a unique , random leaf . Suppose that user 

effacement is sometimes desirable , as in the rolling pseud i is associated with leaf ng " ) , where B = b , b2 % ) 

onym scheme described below . In another embodiment , the In one embodiment , when the user visits the server , the 

value associated with a block of stored bits is represented by server determines the leaf — and thus the identity — of the 

the XOR of the bits . Thus , a block can be rewritten m times . 30 user as follows . First , the server queries the user's browser Using Cache Cookies to Identify Users to determine whether the browser ( i.e. , the browser storage 

Tree - Based Scheme area ) contains n , or n ;. In particular , the server queries 

As described above , the server may use cache cookies to address u , of the browser storage area to determine whether 

identify a user . In one embodiment , the server uses a address u . contains secret key yo . The server then queries 

tree - based scheme to structure user identifiers in the cache 35 address u , of the browser storage area to determine whether 

cookie memory structure . address u : contains secret key y1 . The server then recurses . FIG . 3 is an embodiment of a tree structure 300 , referred When the server determines that node ng is present in the 

to herein as an identifier tree 300 , that the server can use to browser storage area , the server next determines whether the 

identify a user . The identifier tree 300 is a tree that has eight children of node ng ( i.e. , ng || -o , or nB || 1 . ) are present . This 

identifiers 302-316 , one for each leaf node . The identifier 40 continues until the server determines the full path of nodes 

tree 300 has a depth d = 3 ( from root node 320 ) . The high ns , 0,0,0 , , 15,20 ble , and thus the leaf lighted path corresponds to identifier ‘ 001 ' 304. To cause corresponding to the identity of user i . this identifier to be stored in a user's browser , a server “ sets ” For example , the server verifies whether a first or second 

the bit value in particular addresses of the cache cookie node is stored . Based on this verification , the server then 

memory to ' 1 ' . When the server later performs a search of 45 checks either whether a third or fourth node is stored ( if the 

the cache cookie memory in the browser storage area , the first node was stored ) or a fifth or sixth node is stored ( if the 

server can determine the bits that have been set along the second node was stored ) . This way , the tree can be traversed . highlighted path , thereby leading the server to the ‘ 001 ' leaf In one embodiment , if the server does not know the 

304 and the user identified by the ‘ 001 ' leaf 304 . addresses ( e.g. , names of TIFs or names of URLs in the 

For example , the server can , during a first session , “ write ” 50 history cache ) , then the server cannot read them . An attacker 

a first URL to node 0 324 , a second URL to node 00 328 , and with a first identifier stored in his browser only knows a part 

a third URL to node 001 304. The combination of the first of all addresses ( e.g. , the names of TIFs or URLs ) and 

URL , second URL , and third URL can identify the user . therefore would not likely be able to read the contents of During a subsequent session between the browser and the another browser . server , the server can “ read ” the browser storage area to 55 Further , the server can deploy identifier trees with any determine whether the first , second , and third URLs are degree . For example , consider an identifier tree with degree 

present . d = 22 , where d is a multiple of z , and the number of leaves 

In another embodiment , the tree - based scheme restricts is L = 2d . The depth of such a tree , and consequently the 

cache cookie access to a site that possesses an underlying number of stored secret cache cookies , is d / z . This correlates 

resource identifier ( e.g. , secret key ) . The identifier tree's 60 to the number of rounds of queries required for a depth - first 

nodes ( e.g. , nodes 324 and 328 ) correspond to secrets in the search , assuming that each communication round contains 

cache cookie memory . These secrets are referred to herein as the 8 concurrent queries associated with the currently secret cache cookies . explored depth . Therefore , higher - degree trees induce lower 

The server can plant in the browser of the user the set of storage requirements and round - complexity . On the other 

secret cache cookies along the path from the root to the 65 hand , higher - degree trees induce larger numbers of queries . distinct leaf that is associated with the user . To identify a Assuming 8 ( concurrent ) queries per level of the tree , the 

user , the server can interactively “ read ” , or query , the user's total number of queries is dd / z = 2 " d / z . 

Case 2:23-cv-00418-JRG-RSP Document 1-1 Filed 09/15/23 Page 13 of 16 PageID #: 72
US 10,594,823 B1 

13 14 

In one embodiment , trees of higher degree can be simu symmetric - key encryption of message m under key x , then 

lated in searching a binary tree . A subtree of depth z of a tree the server may compute , = e [ illi ] . The server can decrypt 

can be compressed anywhere within a binary tree by treating a pseudonym to obtain the user identifier i . In one embodi 

all of its 22 deepest nodes as children of the root node of the ment , the rolling pseudonyms are deployed using cache 

subtree ( effectively disregarding all of its internal nodes ) . 5 cookie memory based on cache cookies that expire ( like 

Depth - first search over this subtree can be replaced by a those for browser histories ) . single round of 22 queries over the deepest child nodes . Using Cache Cookies to Authenticate User 

Likewise , we can compress any set of z consecutive levels As described above , cache cookies can also be used to 

within a binary tree by treating them as a single level of authenticate a user , for example , after a server uses tradi 

degree 22. Such compressed search can achieve lower round- 10 tional cookies to identify a user . Authenticating a user is the 

complexity than a binary depth - first search , at the cost of confirming of the user's identity and occurs after the user has 

more queries . For example , a binary tree of depth d = 12 can been identified . Cache cookies have privacy - enhancing be treated as a tree of degree 8 = 16 and d = 3 . A server can strengths , such as resistance to pharming , which facilitate 

perform a depth - first search with four rounds of communi authentication of a user . cation . In each round , the server queries the sixteen possible 15 Some vendors use traditional cookies as authenticators to 

great - great grandchildren of the current node in the search . supplement user passwords . Because traditional cookies 

Compressed search within a binary tree can be quite flexible . ( and other sharable objects ) are fully accessible by the 

Further , a server can adjust the degree of compression domain that set them , they are typically vulnerable to 

dynamically in accordance with observed network latency pharming . As described above , pharming occurs when a 

( e.g. , high round - trip times favor high compression of tree 20 browser directed to a Web server legitimately associated 

levels , while low round - trip times may favor low compres with a particular domain instead connects to a spoofed site . sion ) . The identifier tree may also be used to identify A pharmer can then access the traditional cookies associated multiple users ( e.g. , of a single browser ) and may help in the with the attacked domain . Thus , pharming can undermine 

management of shared browsers . the use of cookies as supplementary authenticators . In one embodiment , the server includes a cryptographic 25 Secret cache cookies offer resistance to pharming . As 

checksum on each identifier associated with the browser described above in the identifier - tree scheme , a secret cache 

( embedded in a secret , user - specific address in cache cookie cookie is a secret , k - bit key y ; specific to user i that is stored 

memory ) . The checksum may be embedded in a browser in a secret , user - specific address u ; ( in cache cookie 

specific manner . For example , the checksum can be com memory ) . In one embodiment , the server associates a series 

puted over all valid identifiers in the browser . If the server 30 of secret cache cookies to a user . refreshes its identifiers simultaneously , this checksum does To authenticate a user after a user identifies herself ( and , not go stale as a result of a subset of identifiers dropping in one embodiment , after user authenticates herself using from the cache . The checksum can therefore be used other means ) , a server can check for the presence of the 

eliminate spurious identifiers ( e.g. , inserted by a malicious user - specific secret cache cookie y ; ( or cookies ) as an 

server ) . 35 authenticator . Secret cache cookies are resistant to pharming Rolling - Pseudonym Scheme because , in order to access the key Yi , a server has to know 

Another approach to protecting user identifiers is to treat the secret address u , associated with a user . them as pseudonyms and change them ( e.g. , periodically ) . In one embodiment , cache cookies can be rewritten by the 

The server designates a series of k - bit cache cookie memory server if they are erased by the user of the client device . For 

addresses V1 , V2 , ... , where y , is associated with time epoch 40 example , the server may “ write ” a first cache cookie in the j . The server additionally maintains for each user i and each history cache and a second cache cookie that encodes the time epoch j a k - bit pseudonym t ; same or a different value as the first cache cookie in the TIF 

In one embodiment , whenever the server has contact with area . The user may then erase one of the cache cookies . the browser of a given user , the server searches sequentially When the client device revisits the server , the server can 

backward over p positions V ;, V ; -1 , .. Vi - p + 1 until the server 45 determine the user's identity from the cache cookie that was locates a pseudonym It ' ; in position v ; and identifies the user , not erased and can subsequently rewrite the previously 

or determines that no pseudonyms are present within its erased cache cookie again . Further , the server may imple search window . On identifying the user , the server implants ment this technique in addition to using traditional cookies . the current pseudonym t ; ) in address V ;. Thus , if any of the cache cookies or traditional cookies are 

In one embodiment , the server erases the contents of 50 erased , the server can rewrite them when the client revisits 

memory addresses Vji , Vj41 , ... , Vi - 1 . Otherwise , memory the server . addresses associated with epochs in which the user has not Computer Implementation communicated with the server may be blank . These blanks The previous description describes the present invention 

may reveal information to a potential adversary about the in terms of the processing steps required to implement an 

visitation history of the user each blank indicates an epoch 55 embodiment of the invention . These steps may be performed in which the user did not contact the server . by an appropriately programmed server computer , the con 

Additionally , the parameter p may be large enough to figuration of which is well known in the art . An appropriate recognize infrequent users . In one embodiment , a server can server computer may be implemented , for example , using check whether a memory address has been previously well known computer processors , memory units , storage accessed by reading its leading bit . The server can therefore 60 devices , computer software , and other nodes . A high level 

check hundreds of epochs . If an epoch is three days , for block diagram of such a server computer is shown in FIG . example , then a server may be able to scan years worth of 4. Server computer 400 contains a processor 404 which 

memory addresses , and therefore the full lifetime of any controls the overall operation of computer 400 by executing ordinary browser ( and well beyond the lifetime of certain computer program instructions which define such operation . cache - cookies , like those for browser history ) . 65 The computer program instructions may be stored in a 

In one embodiment , the server uses a master key x to storage device 408 ( e.g. , magnetic disk ) and loaded into 

generate pseudonyms as ciphertexts . If ex [ m ] represents a memory 412 when execution of the computer program 

Case 2:23-cv-00418-JRG-RSP Document 1-1 Filed 09/15/23 Page 14 of 16 PageID #: 73
US 10,594,823 B1 

15 16 

instructions is desired . Server computer 400 also includes perform a second identification of at least one of the 

one or more interfaces 416 for communicating with other client device and the user of the client device using devices ( e.g. , locally or via a network ) . Server computer 400 the second cookie of the second type ; and 

also includes input / output 424 which represents devices perform a determination based at least in part on ( 1 ) a 

which allow for user interaction with the computer 400 ( e.g. , 5 presence of a network resource request associated 

display , keyboard , mouse , speakers , buttons , etc. ) . with one of the first cookie and the second cookie , One skilled in the art will recognize that an implementa and ( 2 ) an absence of a network resource request tion of an actual computer will contain other nodes as well , associated with the other of the first cookie and the 

and that FIG . 4 is a high level representation of some of the second cookie ; and 

nodes of such a server computer for illustrative purposes . In 10 a memory coupled to the one or more processors and 

addition , one skilled in the art will recognize that the configured to provide the one or more processors with 

processing steps described herein may also be implemented instructions . using dedicated hardware , the circuitry of which is config 2. The system of claim 1 wherein the client device is 

ured specifically for implementing such processing steps . identified by a server in a domain different from a server that Alternatively , the processing steps may be implemented 15 caused the two different types of cookies to be stored to the using various combinations of hardware and software . Also , client device during the first and second previous network 

the processing steps may take place in a computer or may be sessions . part of a larger machine . 3. The system of claim 1 wherein the client device is 

The foregoing Detailed Description is to be understood as identifiable based at least in part on a presence of either one being in every respect illustrative and exemplary , but not 20 of the first cookie and the second cookie in the respective restrictive , and the scope of the invention disclosed herein is first and second client device browser storage areas . not to be determined from the Detailed Description , but 4. The system of claim 1 wherein the determination rather from the claims as interpreted according to the full comprises detection of pharming . breadth permitted by the patent laws . It is to be understood 5. The system of claim 1 wherein in response to the that the embodiments shown and described herein are only 25 performed determination , the one or more processors are illustrative of the principles of the present invention and that configured to cause a third cookie to be stored at the client 

various modifications may be implemented by those skilled device , wherein the third cookie is one of the first type and 

in the art without departing from the scope and spirit of the the second type . invention . Those skilled in the art could implement various 6. A method , comprising : 

other feature combinations without departing from the scope 30 receiving a network resource request from a client device , and spirit of the invention . wherein the network resource request corresponds to a 

The invention claimed is : first cookie of a first type that was caused to be stored 1. A system , comprising : to the client device during a first previous network 

one or more processors configured to : session , wherein the first cookie of the first type was 

receive a network resource request from a client device , 35 caused to be stored to the client device at least in part wherein the network resource request corresponds to by causing the client device to initiate a set of network 

a first cookie of a first type that was caused to be resource requests determined during the first previous stored to the client device during a first previous network session , wherein the client device initiating the 

network session , wherein the first cookie of the first set of network resource requests caused data represen 

type was caused to be stored to the client device at 40 tative of the set of network resource requests to be 

least in part by causing the client device to initiate a stored at the client device , wherein a second cookie of 

set of network resource requests determined during a second type different from the first type was caused 

the first previous network session , wherein the client to be stored at the client device during a second 

device initiating the set of network resource requests previous network session , and wherein the first cookie 

caused data representative of the set of network 45 of the first type is stored in a first client device browser 

resource requests to be stored at the client device , storage area and the second cookie of the second type wherein a second cookie of a second type different is stored in a second client device browser storage area 

from the first type was caused to be stored at the different from the first client device browser storage client device during a second previous network ses area ; 

sion , and wherein the first cookie of the first type is 50 based at least in part on the network resource request from 

stored in a first client device browser storage area the client device corresponding to the first cookie of the 

and the second cookie of the second type is stored in first type caused to be stored at the client device during 

a second client device browser storage area different the first previous network session , determining infor 

from the first client device browser storage area ; mation that was encoded and stored in the client device ; 

based at least in part on the network resource request 55 and 

from the client device corresponding to the first performing a first identification of at least one of the client 

cookie of the first type caused to be stored at the device and a user of the client device using the first 

client device during the first previous network ses cookie of the first type , wherein the first identification 

sion , determine information that was encoded and is performed using the first cookie of the first type at 

stored in the client device ; least in part by using the determined information that 

perform a first identification of at least one of the client was encoded and stored in the client device ; and 

device and a user of the client device using the first performing a second identification of at least one of the 

cookie of the first type , wherein the first identifica client device and the user of the client device using the 

tion is performed using the first cookie of the first second cookie of the second type ; and 

type at least in part by using the determined infor- 65 performing a determination based at least in part on ( 1 ) a 

mation that was encoded and stored in the client presence of a network resource request associated with 

device ; one of the first cookie and the second cookie , and ( 2 ) 

60 

Case 2:23-cv-00418-JRG-RSP Document 1-1 Filed 09/15/23 Page 15 of 16 PageID #: 74
18 

US 10,594,823 B1 

17 

an absence of a network resource request associated 

with the other of the first cookie and the second cookie . 7. The method of claim 6 wherein the client device is 

identified by a server in a domain different from a server that 

caused the two different types of cookies to be stored to the 5 

client device during the first and second previous network 

sessions . 8. The method of claim 6 wherein the client device is 

identifiable based at least in part on a presence of either one 

of the first cookie and the second cookie in the respective 10 

first and second client device browser storage areas . 9. The method of claim 6 wherein the determination 

comprises detection of pharming . 10. The method of claim 6 wherein in response to the 

performed determination , further comprising causing a third 15 

cookie to be stored at the client device , wherein the third 

cookie is one of the first type and the second type . 

Case 2:23-cv-00418-JRG-RSP Document 1-1 Filed 09/15/23 Page 16 of 16 PageID #: 75