Auditable metering with lightweight security

Article type: Research Article

Authors: Franklin, Matthew K.^a | Malkhi, Dahlia^{b; *}

Affiliations: [a] Xerox PARC, 3333 Coyote Hill Road, Palo Alto, CA 94304, USA. E-mail: franklin@parc.xerox.com | [b] AT&T Labs – Research, 180 Park Avenue, Florham Park, NJ 07932-0971, USA. E-mail: dalia@research.att.com

Correspondence: [*] Corresponding author.

Abstract: In this work we suggest a new mechanism for metering the popularity of Web sites: the compact metering scheme. Our approach does not rely on client authentication or on a third party. Instead, we suggest the notion of a timing function, a computation that can be performed incrementally, whose output is compact, and whose result can be used to efficiently verify the effort spent with high degree of confidence. We use the difficulty of computing a timing function to leverage the security of a metering method by involving each client in computing the timing function (for some given input) upon visiting a Web site, and recording the result of the computation along with the record of the visit. Thus, to forge client visits requires a known investment of computational resources, which grows proportionally to the amount of fraud, and is infeasible for visit counts commonly found in the World Wide Web (WWW). The incremental nature of the timing function is used to create a new measure of client accesses, namely their duration. This paper describes the foundations of the timing scheme and its deployment in the WWW.

DOI: 10.3233/JCS-1998-6402

Journal: Journal of Computer Security, vol. 6, no. 4, pp. 237-255, 1998