# US 11,030,293 B2 · Method and system for configurable device fingerprinting > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,030,293 B2 - Document ID: US11030293B2 - Status: Granted - Kind: B2 - Application number: 16/236,820 - Filed: 2018-12-31 - Published: 2020-07-02 - Granted: 2021-06-08 - Earliest claimed: 2018-12-31 - Assignees: Beijing Didi Infinity Technology and Development Co., Ltd. - Applicants: Beijing Didi Infinity Technology And Development Co., Ltd. - Inventors: Chandrasekhar Rentachintala; Shengyong Deng; Qingdi Liu - Web page: https://patentgrep.com/patent/US11030293B2 ## CPC - G06F 21/44: Program or device authentication - G06F 21/32: using biometric data, e.g. fingerprints, iris scans or voiceprints - G06F 21/43: wireless channels - H04L 63/062: {for key distribution, e.g. centrally by trusted party (cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819)} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/0861: {using biometrical features, e.g. fingerprint, retina-scan (cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231)} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04W 12/06: Authentication - H04W 12/30: Security of mobile devices; Security of mobile applications - G06F 2221/2117: User registration - H04L 63/068: {using time-dependent keys, e.g. periodically changing keys (cryptographic mechanisms or cryptographic arrangements for controlling usage of secret information H04L9/088)} - H04L 63/0846: {using time-dependent-passwords, e.g. periodically changing passwords} - H04L 63/108: {when the policy decisions are valid for a limited amount of time} - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Methods and systems for configurable device fingerprinting and/or achieving communications with enhanced security are disclosed herein. In one example embodiment, a method of configurable device fingerprinting includes storing, at a server, first information regarding one or more selected system attributes, and further includes receiving, at the server, a first signal requesting that a first client device be registered and including system information pertaining to the first client device. Also, the method includes extracting, from the system information, relevant portions of the system information corresponding to the one or more selected system attributes, where the server determines a fingerprint of the first client device based at least in part the relevant portions. Additionally, the method includes generating a first identifier pertaining to the first client device at least indirectly in response to the extracting of the relevant portions, and sending the first identifier for receipt by the first client device. ## Claims ### Claim 1 A method of configurable device fingerprinting, the method comprising: providing, by a server, a user interface comprising a list of selectable system attributes of a first client device that includes: a basic input/output system universal unique identifier (biosUuid) attribute; an operating system product identification number (osProductId) attribute; a system serial number; a hard disk serial number; a media access control (MAC) address; an internet protocol (IP) address; and a hostname; rendering the list of selectable system attributes on the user interface; receiving, from a second device via the user interface, a selection of at least three of the selectable system attributes to generate first information including respective values corresponding to the at least three of the selectable system attributes that correspond to the first client device, wherein the at least three of the selected system attributes includes: the biosUuid; the osProductId; and at least one of: the system serial number; the hard disk serial number; the MAC address; the IP address; or the hostname; storing, at the server, the first information; receiving, at the server, a first signal requesting that a first client device be registered, the first signal including system information corresponding to the first client device; determining a fingerprint of the first client device based on a matching of at least a portion of the system information with the stored first information; generating a first identifier corresponding to the first client device based at least in part on the portion of the system information that matched the stored first information; storing, by the server, the fingerprint and corresponding first identifier; sending, by the server, the first identifier to the first client device; receiving, by the server, a first token request that includes the first identifier and the system information; verifying, by the server, the first token request by comparing the received first identifier and the received system information with the stored fingerprint and the stored first identifier; and in response to the verification: determining that the first token request was sent by the first client; and sending a token to the first client, wherein subsequent communications between the first client and the server are secured using the token. ### Claim 2 (depends on 1) The method of claim 1, wherein the server is a security agent backend server, wherein the user interface is a security operations center (SOC) user interface, and wherein the first signal is received by the security agent backend server at least indirectly from security agent software operating on the first client device. ### Claim 3 (depends on 1) The method of claim 1, wherein the first information is received from the user interface subsequent to the user interface receiving at least one input from a security operations center (SOC) user specifying the one or more selected system attributes, and wherein the first identifier is a unique identifier, and wherein the unique identifier pertains to a security agent operating on the first client device. ### Claim 4 (depends on 1) The method of claim 1, further comprising: receiving at the server a token renewal request signal after an expiration of a time limit associated with the first token, following the receipt by the first client device of the first token. ### Claim 5 (depends on 4) The method of claim 4, further comprising: after the token renewal request signal is received, determining whether a change has occurred with respect to the system information pertaining to the first client device, such that either the matching portion or the fingerprint is no longer consistent with the changed system information. ### Claim 6 (depends on 5) The method of claim 5, further comprising, when it is determined that the change has occurred such that either the matching portion or the fingerprint is no longer consistent with the changed system information: generating a second identifier pertaining to the first client device at least indirectly in response to extracting additional portions of the changed system information that match the stored first information; generating and sending, for receipt by the first client device, a second token, in response to the receiving of a second token request signal, and linking the second identifier with the first identifier. ### Claim 7 (depends on 5) The method of claim 5 wherein, when it is determined that the change has not occurred, the first token is renewed. ### Claim 8 (depends on 1) The method of claim 1, further comprising: receiving, at the server, an additional signal concerning an instruction to replace the one or more selected system attributes with one or more modified selected system attributes; receiving at the server a token renewal request signal after an expiration of a time limit associated with the first token, extracting additional portions of the system information, corresponding to the one or more modified selected system attributes; generating a second identifier pertaining to the first client device at least indirectly based upon the extracted additional portions of the system information; and linking the second identifier with the first identifier. ### Claim 9 A system comprising: one or more processors; one or more machine-readable, non-transitory storage mediums that include instructions configured to cause the one or more processors to perform operations including: providing, by a server, a user interface comprising a list of selectable system attributes of a first client device that includes: a basic input/output system universal unique identifier (biosUuid) attribute; an operating system product identification number (osProductId) attribute; a system serial number; a hard disk serial number; a media access control (MAC) address; an internet protocol (IP) address; and a hostname; rendering the list of selectable system attributes on the user interface; receiving, from a second device via the user interface, a selection of at least three of the selectable system attributes to generate first information including respective values corresponding to the at least three of the selectable system attributes that correspond to the first client device, wherein the at least three of the selected system attributes includes: the biosUuid; the osProductId; and at least one of: the system serial number; the hard disk serial number; the MAC address; the IP address; or the hostname; storing, at the server, the first information; receiving, at the server, a first signal requesting that a first client device be registered, the first signal including system information corresponding to the first client device; determining a fingerprint of the first client device based on a matching of at least a portion of the system information with the stored first information; generating a first identifier corresponding to the first client device based at least in part on the portion of the system information that matched the stored first information; storing, by the server, the fingerprint and corresponding first identifier; sending, by the server, the first identifier to the first client device; receiving, by the server, a first token request that includes the first identifier and the system information; verifying, by the server, the first token request by comparing the received first identifier and the received system information with the stored fingerprint and the stored first identifier; and in response to the verification: determining that the first token request was sent by the first client; and sending a token to the first client, wherein subsequent communications between the first client and the server are secured using the token. ### Claim 10 (depends on 9) The system of claim 9, wherein the server is a security agent backend server, wherein the user interface is a security operations center (SOC) user interface, and wherein the first signal is received by the security agent backend server at least indirectly from security agent software operating on the first client device. ### Claim 11 (depends on 9) The system of claim 9, wherein the first information is received from the user interface subsequent to the user interface receiving at least one input from a security operations center (SOC) user specifying the one or more selected system attributes, and wherein the first identifier is a unique identifier, and wherein the unique identifier pertains to a security agent operating on the first client device. ### Claim 12 (depends on 9) The system of claim 9 wherein the instructions are further configured to cause the one or more processors to perform operations including: receiving at the server a token renewal request signal after an expiration of a time limit associated with the first token, following the receipt by the first client device of the first token. ### Claim 13 (depends on 12) The system of claim 12 wherein the instructions are further configured to cause the one or more processors to perform operations including: after the token renewal request signal is received, determining whether a change has occurred with respect to the system information pertaining to the first client device, such that either the matching portion or the fingerprint is no longer consistent with the changed system information. ### Claim 14 (depends on 12) The system of claim 12 wherein when it is determined that the change has occurred such that either the matching portion or the fingerprint is no longer consistent with the changed system information, the instructions are further configured to cause the one or more processors to perform operations including: generating a second identifier pertaining to the first client device at least indirectly in response to extracting additional portions of the changed system information that match the stored first information; generating and sending, for receipt by the first client device, a second token, in response to the receiving of a second token request signal, and linking the second identifier with the first identifier. ### Claim 15 A non-transitory computer-program product tangibly embodied in a machine-readable non-transitory storage medium that includes instructions configured to cause one or more processors to perform operations including: providing, by a server, a user interface comprising a list of selectable system attributes of a first client device that includes: a basic input/output system universal unique identifier (biosUuid) attribute; an operating system product identification number (osProductId) attribute; a system serial number; a hard disk serial number; a media access control (MAC) address; an internet protocol (IP) address; and a hostname: rendering the list of selectable system attributes on the user interface; receiving, from a second device via the user interface, a selection of at least three of the selectable system attributes to generate first information including respective values corresponding to the at least three of the selectable system attributes that correspond to the first client device, wherein the at least three of the selected system attributes includes: the biosUuid; the osProductId; and at least one of: the system serial number; the hard disk serial number; the MAC address; the IP address; or the hostname; storing, at the server, the first information; receiving, at the server, a first signal requesting that a first client device be registered, the first signal including system information corresponding to the first client device; determining a fingerprint of the first client device based on a matching of at least a portion of the system information with the stored first information; generating a first identifier corresponding to the first client device based at least in part on the portion of the system information that matched the stored first information; storing, by the server, the fingerprint and corresponding first identifier; sending, by the server, the first identifier to the first client device; receiving, by the server, a first token request that includes the first identifier and the system information; verifying, by the server, the first token request by comparing the received first identifier and the received system information with the stored fingerprint and the stored first identifier; and in response to the verification: determining that the first token request was sent by the first client; and sending a token to the first client, wherein subsequent communications between the first client and the server are secured using the token. ### Claim 16 (depends on 15) The computer program product of claim 15, wherein the server is a security agent backend server, wherein the user interface is a security operations center (SOC) user interface, and wherein the first signal is received by the security agent backend server at least indirectly from security agent software operating on the first client device. ### Claim 17 (depends on 15) The computer program product of claim 15, wherein the first information is received from the user interface subsequent to the user interface receiving at least one input from a security operations center (SOC) user specifying the one or more selected system attributes, and wherein the first identifier is a unique identifier, and wherein the unique identifier pertains to a security agent operating on the first client device. ### Claim 18 (depends on 15) The computer program product of claim 15 wherein the instructions are further configured to cause the one or more processors to perform operations including: receiving at the server a token renewal request signal after an expiration of a time limit associated with the first token, following the receipt by the first client device of the first token. ### Claim 19 (depends on 15) The computer program product of claim 15 wherein the instructions are further configured to cause the one or more processors to perform operations including: after the token renewal request signal is received, determining whether a change has occurred with respect to the system information pertaining to the first client device, such that either the matching portion or the fingerprint is longer consistent with the changed system information.