Location verification for privacy protection

Abstract

Determine the relevance of geographical location without compromising privacy. [Solution] A non-temporary computer-readable medium stores instructions that implement an application programming interface (API). When called by a software entity running on a computing device, the API is configured to receive (304) an indicator indicating a geographic location from the application, obtain (306) an indicator indicating a general geographic area related to the user's home location from the operating system of the computing device, wherein the operating system prevents the software entity from accessing the indicator indicating the general geographic area, and provide (308) an indicator indicating whether the geographic location is within the general geographic area.

Description

Technical Field

[0001] The present disclosure relates to location verification, and more particularly, to an application programming interface for verifying whether a user's home location corresponds to a specific geographic area without revealing the user's home location.

Background Art

[0002] The description of the background art provided herein is for the purpose of presenting a general overview of the background of the present disclosure. The research within the scope described in this background art section by the inventors named as such, and aspects of this description that may not be considered prior art in other forms at the time of filing, are not admitted as prior art to the present disclosure, either explicitly or implicitly.

[0003] Certain services with which a user device can interact apply location-based restrictions and, more generally, modify content or the presentation of content according to the current location of the user device. For example, music streaming and download services often restrict access to a music digital catalog based on the country from which a content request originates. Online video streaming services impose similar restrictions.

[0004] Furthermore, targeted digital advertising (or "ad") providers often tailor content, presentation format, and presentation frequency based on the location of the device on which the content is presented. Advertisers can also use advertising syndications, which allow them to expand their marketing reach by having their text or image ads delivered to further partners, such as third-party online publishers, who place their ads on web pages with relevant content. Advertisers can bid on placements based on how valuable they consider them to be. Bidding can be based on specific aspects of ad impressions, including the ad's click-through rate, and the geographical location where the ad is served.

[0005] In some cases, users set up a virtual private network (VPN) so that their computing device obtains an Internet Protocol (IP) address on a remote network, often in a different country. In this way, a user currently located in country A, but only permitted to access certain content within country B, can make their computing device appear to be operating in country B, and thus gain access to location-restricted content. Today, certain bad actors use VPNs to deceive users from countries where advertisers pay relatively low prices for content presentation into appearing as users from other countries where advertisers pay relatively high prices for content presentation. In some cases, portable devices can directly reveal a user's location to applications or scripts, but doing so significantly reduces the level of privacy the user enjoys. On the other hand, restricting a user's freedom to set up a VPN connection would hinder various legitimate VPN-based services. [Overview of the Initiative] [Means for solving the problem]

[0006] The application programming interface (API) in this disclosure enables an application running on a portable device to determine whether a particular geographical location is associated with the portable device's home location without compromising privacy or interfering with VPN functionality.

[0007] An exemplary embodiment of these techniques is a non-temporary computer-readable medium storing instructions for implementing an application programming interface (API), wherein when the application programming interface (API) is invoked by a software entity running on a computing device, the non-temporary computer-readable medium is configured to receive from the application an indicator indicating a geographic location, and to obtain from the computing device's operating system an indicator indicating a general geographic area related to the user's home location, wherein the operating system obtains the indicator indicating the general geographic area in a way that prevents the software entity from accessing it, and provides the software entity with an indicator indicating whether the geographic location is within the general geographic area.

[0008] Another exemplary embodiment of these techniques is a method implemented in the operating system of a portable device. The method includes identifying a general geographic area associated with the home location of the portable device, storing an indicator representing the general geographic area in a privileged area of ​​the portable device's memory, and restricting access to the indicator. Restriction includes preventing software applications running on the portable device from accessing the indicator and granting access to the indicator to APIs exposed to the software applications that are configured to act on the indicator without revealing the indicator to the software applications.

[0009] A yet another exemplary embodiment of these techniques is a portable device comprising one or more processors and non-temporary computer-readable memory. The memory stores instructions executable on one or more processors for carrying out the methods described above. [Brief explanation of the drawing]

[0010] [Figure 1] This is a block diagram of an exemplary computing environment and a portable device that implements the techniques of this disclosure for providing location proof without compromising user privacy. [Figure 2] This flowchart illustrates an exemplary method that a third-party application can use to determine whether a identified location on a portable device is the portable device's home location, using the Home Location API. [Figure 3] This diagram illustrates a method that can be implemented in the API of this disclosure for determining whether a marked location is the home location of a portable device. [Figure 4] Figure 1 schematically illustrates how the home location estimation module fills the home location information field in the privileged area of ​​memory. [Figure 5] This diagram schematically illustrates how a multimedia application might use the Home Location API of this disclosure to determine whether it should provide location-restricted content through the user interface of a portable device. [Figure 6] This diagram schematically illustrates how an installer script uses the Home Location API of this disclosure to provide an indicator that the user who installed a particular application is currently traveling. [Figure 7] This diagram schematically illustrates how a web browser uses the Home Location API of this disclosure when a portable device communicates with online services using a VPN. [Figure 8] This is a flowchart illustrating exemplary methods that can be implemented in the operating system of a portable device to support location verification while preserving privacy. [Modes for carrying out the invention]

[0011] Generally speaking, the APIs in this disclosure enable applications running on portable devices to determine whether a particular geographic location is related to the portable device's home location. The geographic location provided by the application to the API is an estimate of the portable device's current geographic location. The API compares the provided geographic location to an identifier indicating the home location, stored in a memory area inaccessible to the application. By not revealing the home location to the application, the API enhances user privacy.

[0012] Referring first to Figure 1, these techniques can be implemented in an exemplary portable computing device (or simply “portable device”) 102, such as a smartphone, laptop computer, tablet computer, smartwatch, or any other general-purpose or dedicated computing device. The portable device 102 operates within an environment 100 and can access, for example, location-restricted content 114 from a streaming server 104 and applications 116 from an application server 106 via a wide-area network such as the Internet 110. Furthermore, an advertising (“ad”) server 108 can interact with the portable device 102 and servers 104 and 106 to provide the portable device 102 with advertisements in various formats (such as still images, interactive banners, audio segments, and video segments). The ad server 108 can use a location-based bidding model 118 to determine the minimum bid amount and price adjustments for ads based on geography.

[0013] In some cases, portable devices can operate within a virtual private network (VPN) by tunneling data through a VPN server 120. As will be discussed in more detail with reference to Figure 7, the VPN server 120 can provide IP addresses to servers such as a streaming server 104, an application server 106, and an ad server 108, from which the portable device 102 requests content.

[0014] The hardware 130 of the portable device 102 includes one or more processors 132, non-temporary memory 134 readable by the processors 132, one or more positioning sensors 135, a user interface 136, and a network interface 138. The processors 132 may include one or more central processing units (CPUs), one or more graphics processing units (GPUs), dedicated hardware, etc. The memory 134, which may contain any suitable non-temporary storage device readable by the processors 132, includes a privileged area or privileged region 140 that is accessible to certain software components of the portable device 102 but inaccessible to other software components, such as third-party applications that the user can install on the portable device 102, and various third-party scripts and third-party programs executed by native applications running on the portable device 102. The positioning sensors 135 may include a Global Positioning Service (GPS) module. The OS160 can also locate the portable device 102 or enhance GPS module readings using a wireless local area network (WLAN) interface, a wireless personal area network (WPAN) interface, and other radio components operating as part of the network interface 138. The user interface 136 may include a touchscreen, microphone, speaker, and other suitable input and / or output devices.

[0015] The software 150 of the portable device 102 includes an operating system (OS) 160 and an OS API layer 170. The hardware 130, together with the OS 160 and the OS API layer 170, defines a platform capable of running various native and non-native (e.g., third-party) applications. In addition to standard OS-level functionality, the OS 160 of this disclosure may also include a home location estimation module 162 that, in operation, identifies the home location of the portable device 102 and stores the identified home location information in a field 164 within a privileged area 140. The OS API layer 170 includes a home location API 172 that can access the field 164. Various software applications, programs, and scripts running within other applications (more generally, “software entities”) can call the home location API 172 to check whether a particular location is associated with a home location, but generally cannot access the privileged area 140, specifically the home location information 164.

[0016] In some implementations, the home location estimation module 162 operates, for example, as a background task or daemon, to periodically access the positioning sensor 135 to estimate home location information and / or update the home location information in field 164. Alternatively, the home location estimation module 162 can also operate as a component of the home location API 172, which software entities calling API 172 cannot access directly.

[0017] Continuing to refer to Figure 1, the application layer 180 can include, for example, a multimedia application 182, a social network application 184, and a browser application 186. The application layer 180 can generally contain any number of applications. In this exemplary configuration, the multimedia application 182 and the social network application 184 are non-native third-party applications developed by different third-party developers and adapted for OS 160. The browser application 186 in the example of Figure 1 is a native application developed specifically for OS 160. However, the browser application 186 can execute third-party scripts 190 that may be permitted to access some of the functionality of OS 160 and the OS API layer 170.

[0018] Referring to Figure 2, Method 200 can be implemented in a third-party application such as a multimedia application 182. Method 200 begins in block 202, in which the third-party application identifies the current location of the portable device 102. For this purpose, the application can access the positioning sensors 135 or the current location information stored by the OS 160 when the user of the portable device 102 has given the application permission to access these sensors. Otherwise, in block 202, the application identifies the location of the portable device 102 based on its IP address, user input received directly via a form, referrer information, or another appropriate source of information.

[0019] In block 204, the application calls the home location API 172 to provide an indication of a geographic location that can be the location specified in block 202. For example, the home location API 172 can include a function in the format isHome Location(inputLocation), which returns true if the specified location corresponds to the home location of the portable device 102 and false otherwise. The home location API 172 does not disclose the home location stored in field 164, regardless of the result of the execution of this function. In this way, the home location API 172 protects the user's privacy.

[0020] As will be further discussed below with reference to FIG. 3, the home location API 172 can support any desired level of granularity (or coarseness). Thus, for example, the application can specify the location as a set of GPS coordinates, and the home location API 172 returns true if the GPS coordinates are within the boundaries of the home country of the portable device 102. As another example, the application can identify the IP address of the portable device 102 and specify the town or city in which the Internet service provider (ISP) of that Internet address is registered, and the home location API 172 returns true if that town or city is within the home country of the portable device 102.

[0021] In some implementations of the Home Location API 172, the interface includes a flag indicating granularity, such as isHome Location(inputLocation, granularityLevel), where granularityLevel can be one of a set of predefined values within a predefined set such as {"continent", "country", "state", "city"}. As an alternative, the granularityLevel parameter can also be the magnitude of the desired radius of accuracy, such as "100 miles".

[0022] In block 206, the application adjusts the presentation of the content according to the output of the Home Location API 172 received in block 204. For example, the application can be a subscription-based movie streaming service, and when the Home Location API 172 returns false in block 204, the application disables playback and displays an error message saying "Sorry, you are not within the home location". As another example, the application can provide a tuple (current country, "traveling") or (current country, "home") to the ad server 108, and the ad server 108 can adjust the ad content for display on the portable device 102.

[0023] Figure 3 shows an exemplary method 300 that can be implemented in a suitable API, such as the Home Location API 172. In block 302, the API identifies the home location of the portable device and stores the identified home location in a privileged area 140 of memory 134. In some implementations, a Home Location Estimation Module 162 estimates the home location using multiple readings from the positioning sensor 135. For example, the Home Location Estimation Module 162 can collect N samples over M days and calculate a geographical average. The Home Location Estimation Module 162 can perform collection and estimation periodically, for example, every 12 hours, every 24 hours, or every 72 hours.

[0024] Sensor data could include GPS coordinates, the IP address information of the portable device 102, and the IP address of the WLAN access point (AP) where the portable device 102 operates. As another example, the API could collect nighttime samples because the user is more likely to be at home at that time. Depending on at least some implementations of the API, the user would indicate that the API is permitted to acquire this data by activating certain controls or installing specific software. In yet another implementation, the API would explicitly query the user regarding their home location.

[0025] The API can store home locations as home location information 164 at any desired level of granularity. In various implementations, the API can store home locations at the continent level (e.g., "Asia", "North America"), large geographical regions (e.g., "Eastern Europe", "North Africa"), country level (e.g., "Japan", "France"), state level (e.g., "Bihar", "Alabama"), or city or town level (e.g., "London", "San Francisco"). In other implementations, the API can store home locations as S2 cells or sets of S2 cells, which are projections of the Earth's sphere onto a 2D coordinate system at any appropriate zoom level. Furthermore, in some cases, the API can store home locations as sets of GPS coordinates.

[0026] Next, in block 304, the API receives a query indicating the estimated current location of the portable device 102 and, in some implementations, the desired level of granularity (see the discussion of block 204 above). As discussed above, the API can be exposed to a variety of third-party applications, scripts, or other software entities.

[0027] In block 306, the API compares the location received in block 304 with the home location. For this purpose, the API can obtain a marker indicating the approximate geographic area associated with the home location information 164. For example, the home location information 164 may contain a marker indicating a city, and the application can call the API with the granularity level set to "country". The API can use any appropriate technique, such as converting both locations to S2 cells and traversing the S2 cell tree to determine whether the S2 cell of the identified location is within the S2 cell of the home location. Then, in block 308, the API generates a proof value such as true or false based on the comparison.

[0028] In this exemplary implementation, the API is configured to compare a location specified by a software entity with a home location stored in a privileged area of ​​memory; however, APIs can generally be configured to perform certain appropriate actions on a home location without revealing the home location stored in a privileged area of ​​memory to the entity calling the API.

[0029] In some implementations, the API prevents software entities from frequently calling the API within a given time period by iterating through numerous possibilities to determine their home location. For example, the API may limit the number of times a software entity can call the API per day, or impose a lockout period after returning false. In some implementations, the API returns an error code in response to a determination that a software entity has called the API more than N times (e.g., 3 times, 5 times) within a given time period (e.g., 12 hours, 24 hours).

[0030] To further clarify, we will now discuss some exemplary scenarios in which the application invokes home location 172, with reference to Figures 4-7.

[0031] Referring first to Figure 4, in Scenario 400, the home location estimation module 162 can acquire one or more readings 402 from one or more of the positioning sensor 135, the user interface 136, or the network interface 138. In one such scenario, the home location estimation module 162 acquires multiple GPS readings from the positioning sensor 135 over a specific time period, clusters those readings, and determines the geometric center of the largest cluster. The home location estimation module 162 then identifies S2 cells at a low granularity level (e.g., country) and stores the name of the identified country corresponding to this relatively coarse S2 cell in field 164 404. In another scenario, the location estimation module 162 acquires multiple readings of IP addresses assigned to the network interface 138 over a specific time period and identifies relatively coarse S2 cells as discussed above. In yet another exemplary scenario, the home location estimation module 162 prompts for user input via the user interface 136 and stores the specified country in field 164 404. The home location estimation module 162 can also implement any appropriate combination of these techniques.

[0032] Next, Figure 5 schematically illustrates an exemplary scenario 500 in which the multimedia application 182 uses the Home Location API 172 to determine whether it should enable playback of specific content. In this case, the multimedia application 182 may restrict itself to providing streaming media only if the user is currently in their home country.

[0033] Operation 501 corresponds to the multimedia application 182 determining the current location of the portable device 102 by obtaining readings from the positioning sensor 135, subject to user permission 510. More specifically, before the OS 160 grants the multimedia application 182 access to the positioning sensor 135, it instructs the user to allow the multimedia application 182 to access the current location LOC. current It may be requested to explicitly allow access to it. OS160 may check for permission 510, for example, during the installation or execution of a multimedia application 182.

[0034] Multimedia application 182 is located at the specified location LOC. current 502 provides the Home Location API 172 with the Home Location API 172, which retrieves the Home Location information from field 164. In this exemplary scenario, the multimedia application 182 returns the value "true" to the multimedia application 182 to indicate that the portable device 102 is currently operating within its home location. 503 The multimedia application 182 enables playback accordingly.

[0035] Figure 6 schematically illustrates how the installer script 602 in Scenario 600 uses the Home Location API 172 to provide an indicator showing whether the user installing a particular application 604 is in their home country or is currently traveling. A particular content provider may consider an installation valuable depending on whether the user is a visitor to that country, and the installer script 602 reports to the provider of application 604 or another third party whether the installation took place in the home country of the portable device 102. As a more specific example, the installer script 602 could report to the provider of application 604 a tuple {US, Home} or {US, Traveling}, depending on whether the portable device 102 belongs to a user residing in the US or a user visiting the US.

[0036] Similarly, ad providers may also value impressions (or instances in which ads are displayed via the user interface) differently depending on whether the user operating the portable device 102 in a particular country resides in that country or is visiting that country. A script roughly similar to installer script 602 may report tuples such as {Japan, Traveling} or {India, Home} to the ad server for a particular campaign. The ad server can use this information to run different auctions (e.g., specify different bid amounts) for the {Country, Home} and {Country, Traveling} situations.

[0037] As shown in Figure 6, the installer script 602 is executed within the environment of the browser application 186. More specifically, the installer script 602 may contain instructions written in a scripting language such as Javascript that can be executed by the browser application 186. The installer script provides the browser application 186 with a country code (e.g., "US") 611, and the browser application 186 then calls the Home Location API 172 using the country code 612. In this exemplary scenario, Home Location 172 returns "false", and the browser application reports to the installer script 602 that the user is traveling within the specified country 614.

[0038] Next, Figure 7 schematically illustrates how the browser application 186 can use the Home Location API 172 when accessing location-restricted content 114. In this case, the user has set up a VPN connection with the streaming server 104 via the VPN server 120. Traffic between the portable device 102 and the server 104 proceeds accordingly via the VPN server or VPN host 120. As a result, the browser application 186 and / or software components operating within the environment of the browser application 186 (e.g., hypertext markup language (HTML) instructions, plugins, and scripts, instructions executed on the virtual platform) may have their current location affected by the location of the VPN server 120, which may be operating in a different country or continent than the portable device 102. VPN Server It can be identified that 712 is such. When the streaming server 104 restricts access to content 114 to a specific country, a user may select a VPN server 120 operating in that country and thus obtain access to the restricted content.

[0039] Browser application 186 is LOC VPN Server714 calls the Home Location API 172 using as a parameter. The Home Location API 172 returns "false" in this exemplary scenario 716 because the location stored in field 164 does not correspond to the indicated location. In some scenarios, the streaming server 104 can provide a software component along with location-restricted content 114. After the Home Location API 172 returns "false", this software component can provide an error message such as "This content cannot be played in your region". Alternatively, the browser application 186 can provide the streaming server 104 with the result of calling the Home Location API 172, and the streaming server 104 can provide the error message in the streaming format of the location-restricted content 114.

[0040] Finally, Figure 8 shows an exemplary method 800 that an operating system, such as OS 160, can implement to support location verification functionality. In block 802, the operating system determines the home location of the portable device. As discussed above with reference to block 302 of Figure 3, a component of the OS, such as the home location estimation module 162, can use one or more readings from the positioning sensor 135, the user interface 136, and / or the network interface 138.

[0041] In block 804, the operating system stores an indicator that identifies a specific home location in a privileged area of ​​memory, such as field 164. The operating system can store the indicator at any desired level of coarseness. Next, in blocks 806 and 808, the operating system selectively restricts access to the stored indicator. Specifically, the operating system grants read access to the indicator only to certain software entities (e.g., the home location API 172) (block 806), while preventing other software entities (e.g., multimedia applications 182, social network applications 184, browser applications 186, third-party scripts 190) from accessing the indicator (block 808). In this way, the operating system requires software entities to access the stored home location indicator only indirectly and only through the home location API 172.

[0042] The following additional considerations apply to the discussion above.

[0043] In particular embodiments, the Disclosure describes them as including logic or several components or modules. Modules may be software modules (e.g., code stored on a non-temporary machine-readable medium) or hardware modules. Hardware modules are tangible units capable of performing specific operations and can be configured or arranged in specific ways. Hardware modules may comprise dedicated circuitry or logic that is permanently configured to perform specific operations (e.g., as a dedicated processor such as a field-programmable gate array (FPGA) or application-specific integrated circuit (ASIC)). Hardware modules may also comprise programmable logic or programmable circuitry that is temporarily configured by software to perform specific operations (e.g., contained within a general-purpose processor or other programmable processor). The decision of whether to implement a hardware module as dedicated, permanently configured circuitry or as temporarily configured circuitry (e.g., configured by software) may be determined by cost and time considerations.

[0044] When implemented as software, this technique can be provided as part of an operating system, a library used by multiple applications, or a specific software application. The software can run on one or more general-purpose processors or one or more dedicated processors. [Explanation of Symbols]

[0045] 100 Environment 102 Portable computing devices, portable devices 104 Streaming Servers 106 Application Server 108 Ad servers 110 Internet 114 Location-restricted content 116 Applications 118 Location-Based Bidding Models 120 VPN servers, VPN hosts 130 Hardware 132 processors 134 Non-temporary memory 135 Positioning Sensor 136 User Interface 138 Network Interfaces 140 Privileged area, privileged region 150 Software 160 Operating Systems (OS) 162 Home Location Estimation Module 164 Fields, Home Location Information 170 OS API Layers 172 Home Location API, Home Location 180 Application Layers 182 Multimedia Applications 184 Social Networking Applications 186 Browser applications 190 Third-Party Scripts 200 ways 300 ways 400 Scenarios 402 reading 500 Scenarios 510 User permission 600 Scenarios 602 Installer script 604 Application 800 ways

Claims

1. A non-temporary computer-readable medium storing instructions that implement an Application Programming Interface (API), wherein when the API is invoked by a software entity running on a portable device, The application receives a sign indicating the geographical location, Obtaining from the operating system of the portable device a label indicating an approximate geographic area related to the home location of the portable device, wherein the operating system prevents the software entity from accessing the label indicating the approximate geographic area. The software entity is provided with an indicator showing whether the geographical location is located within the approximate geographical area. A non-temporary computer-readable medium configured to perform the following actions.

2. The non-temporary computer-readable medium according to claim 1, wherein the API is configured to access a privileged area of ​​the memory of the portable device in order to obtain the marker indicating the approximate geographic area, and the privileged area of ​​the memory is inaccessible to the software entity.

3. The non-temporary computer-readable medium according to claim 1 or 2, wherein the approximate geographic area is identified based on periodic readings of one or more sensors of the portable device.

4. The non-temporary computer-readable medium according to claim 1 or 2, wherein the aforementioned approximate geographic area is received from the user via the user interface of the portable device.

5. The aforementioned API, The roughness level is received from the aforementioned application. It is further configured to do the following: The API compares the geographic location to the approximate geographic area according to the roughness level. A non-temporary computer-readable medium according to any one of claims 1 to 4.

6. The non-temporary computer-readable medium according to claim 5, wherein the roughness level corresponds to either a country or a continent.

7. The aforementioned API, Based on the marker indicating the geographical location, the S2 cell is identified, If the identified S2 cell is located within or matches an S2 cell corresponding to the approximate geographic area associated with the user's home location, the marker is provided to indicate that the geographic location is located within the approximate geographic area. A non-temporary computer-readable medium according to any one of claims 1 to 6, further configured to perform the following:

8. The aforementioned API, In response to a determination that the software entity has called the API more than N times within a predetermined time period, the software entity returns an error code. A non-temporary computer-readable medium according to any one of claims 1 to 7, further configured to perform the following:

9. The non-temporary computer-readable medium according to any one of claims 1 to 8, wherein the software entity is a non-native software application configured to run the operating system of the portable device.

10. The non-temporary computer-readable medium according to any one of claims 1 to 9, wherein the software entity is a script configured to run within a native browsing application on the portable device.

11. A method implemented in the operating system of a portable device, The steps include: using one or more processors to identify an approximate geographic area associated with the home location of the portable device; The steps include: storing the indicator representing the approximate geographic area in a privileged area of ​​the portable device's memory using one or more processors; A step of restricting access to the indicator by one or more processors, The steps of preventing software applications running on the portable device from accessing the indicator by one or more processors, and The step of granting access to the sign to an API exposed to the software application by the one or more processors, which is configured to act on the sign without revealing the sign to the software application. Steps and Methods that include...

12. The method according to claim 11, wherein the step of identifying the approximate geographic area includes the step of performing periodic readings of one or more sensors of the portable device.

13. The method according to claim 11, wherein the step of identifying the approximate geographic area includes the step of receiving a sign indicating the approximate geographic area via the user interface of the portable device.

14. One or more processors, A non-temporary computer-readable medium storing instructions, wherein when the instructions are executed by the one or more processors, the portable device is instructed to carry out the method according to any one of claims 11 to 13. A portable device equipped with these features.

Images