Client-server response time based computer system geolocation

Patent metadata

Field	Value
Publication number	US-12483425-B2
Application number	US-202318214581-A
Country	US
Kind code	B2
Filing date	Jun 27, 2023
Priority date	Jun 27, 2023
Publication date	Nov 25, 2025
Grant date	Nov 25, 2025

Abstract

An embodiment sends, at a first time, from a boundary server to a client system in response to a challenge request, a challenge specifying a computational problem to be solved by the client system, the boundary server specified in a challenge list sent to the client system. An embodiment receives, at a second time, at the boundary server, a challenge response from the client system, the challenge response comprising a solution to the computational problem. An embodiment generates, at the boundary server, a certificate encoding an elapsed time between the first time and the second time, the certificate usable by the client system to prove a location of the client system. An embodiment sends, from the boundary server to the client system, the certificate.

First claim

What is claimed is:

1 . A computer-implemented method comprising:
sending, at a first time, from a boundary server to a client system, in response to a challenge request, a challenge specifying a computational problem to be solved by the client system, the boundary server specified in a challenge list sent to the client system and selected based on an internet protocol (IP) address of the client system; receiving, at a second time, at the boundary server, a challenge response from the client system, the challenge response comprising a solution to the computational problem; generating, at the boundary server, a certificate encoding an elapsed time between the first time and the second time, the certificate usable by the client system to prove a location of the client system; and sending, from the boundary server to the client system, the certificate.

2 . The computer-implemented method of claim 1 , wherein the challenge list comprises a plurality of boundary servers including the boundary server, each of the plurality of boundary servers having a known physical location.

3 . The computer-implemented method of claim 2 , wherein each of the plurality of boundary servers was selected for inclusion in the challenge list using the known physical location of each of the plurality of boundary servers.

4 . The computer-implemented method of claim 1 , wherein the elapsed time encoded in the certificate, a second elapsed time encoded in a second certificate generated by a second boundary server, and a third elapsed time encoded in a third certificate generated by a third boundary server are usable in performing trilateration of the location of the client system.

5 . The computer-implemented method of claim 1 , further comprising:
cryptographically signing, at the boundary server, prior to the sending, the certificate, the signing performed using a key unknown to the client system.

6 . The computer-implemented method of claim 1 , further comprising:
sending, at a third time, from the boundary server to the client system in response to a second challenge request, a second challenge specifying a string to be echoed by the client system; receiving, at a fourth time, at the boundary server, a second challenge response from the client system, the second challenge response comprising the string; and generating, at the boundary server, a fourth certificate encoding the lesser of the elapsed time and a second elapsed time, the second elapsed time comprising a difference between the fourth time and the third time, the fourth certificate usable by the client system to prove the location of the client system.

7 . A computer program product comprising one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, wherein the stored program instructions are stored in a computer readable storage device in a data processing system, wherein the stored program instructions are transferred over a network from a remote data processing system, and wherein stored program instructions are downloaded in response to a request over the network to the remote data processing system for use in the computer readable storage device associated with the remote data processing system, the stored program instructions executable by a processor to cause the processor to perform operations comprising:
sending, at a first time, from a boundary server to a client system in response to a challenge request, a challenge specifying a computational problem to be solved by the client system, the boundary server specified in a challenge list sent to the client system; receiving, at a second time, at the boundary server, a challenge response from the client system, the challenge response comprising a solution to the computational problem; generating, at the boundary server, a certificate encoding an elapsed time between the first time and the second time, the certificate usable by the client system to prove a location of the client system; and sending, from the boundary server to the client system, the certificate;
wherein the stored program instructions further comprise:
program instructions to meter use of the program instructions associated with the request; and
program instructions to generate an invoice based on the metered use.

8 . The computer program product of claim 7 , wherein the challenge list comprises a plurality of boundary servers including the boundary server, each of the plurality of boundary servers having a known physical location.

9 . The computer program product of claim 8 , wherein each of the plurality of boundary servers was selected for inclusion in the challenge list using the known physical location of each of the plurality of boundary servers.

10 . The computer program product of claim 7 , wherein the elapsed time encoded in the certificate, a second elapsed time encoded in a second certificate generated by a second boundary server, and a third elapsed time encoded in a third certificate generated by a third boundary server are usable in performing trilateration of the location of the client system.

11 . The computer program product of claim 7 , further comprising:
cryptographically signing, at the boundary server, prior to the sending, the certificate, the signing performed using a key unknown to the client system.

12 . The computer program product of claim 7 , further comprising:
sending, at a third time, from the boundary server to the client system in response to a second challenge request, a second challenge specifying a string to be echoed by the client system; receiving, at a fourth time, at the boundary server, a second challenge response from the client system, the second challenge response comprising the string; and generating, at the boundary server, a fourth certificate encoding the lesser of the elapsed time and a second elapsed time, the second elapsed time comprising a difference between the fourth time and the third time, the fourth certificate usable by the client system to prove the location of the client system.

13 . A computer system comprising a processor and one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instructions executable by the processor to cause the processor to perform operations comprising:
sending, at a first time, from a boundary server to a client system in response to a challenge request, a challenge specifying a computational problem to be solved by the client system, the boundary server specified in a challenge list sent to the client system and selected based on an internet protocol (IP) address of the client system; receiving, at a second time, at the boundary server, a challenge response from the client system, the challenge response comprising a solution to the computational problem; generating, at the boundary server, a certificate encoding an elapsed time between the first time and the second time, the certificate usable by the client system to prove a location of the client system; and sending, from the boundary server to the client system, the certificate.

14 . The computer system of claim 13 , wherein the challenge list comprises a plurality of boundary servers including the boundary server, each of the plurality of boundary servers having a known physical location.

15 . The computer system of claim 14 , wherein each of the plurality of boundary servers was selected for inclusion in the challenge list using the known physical location of each of the plurality o

Assignees

• IBM

Inventors

• Vercalli Emanuele
• Accetta Federico
• Caprinali Massimo
• Ragusa Roberto

Classifications

• H04L9/3297

  involving time stamps, e.g. generation of time stamps · CPC title

• H04L9/3271

  using challenge-response · CPC title

• H04L67/52

  specially adapted for the location of the user terminal · CPC title

• H04L9/0872

  using geo-location information, e.g. location data, time, relative position or proximity to other entities · CPC title

• H04L9/3268

  using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL] · CPC title