# US 11,310,053 B2 · System and method of filtering internet traffic via a client fingerprint > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,310,053 B2 - Document ID: US11310053B2 - Status: Granted - Kind: B2 - Application number: 16/730,037 - Filed: 2019-12-30 - Published: 2020-07-02 - Granted: 2022-04-19 - Earliest claimed: 2018-12-28 - Assignees: Plaid Inc. - Applicants: Plaid Inc. - Inventors: Shawn Bracken - Web page: https://patentgrep.com/patent/US11310053B2 ## CPC - H04L 9/3236: {using cryptographic hash functions} - H04L 63/166: {at the transport layer} - H04L 43/026: using flow identification - H04L 43/028: by filtering - H04L 63/0281: {Proxies} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 67/303: Terminal profiles - H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC} - H04L 43/04: Processing captured monitoring data, e.g. for logfile generation - H04L 67/02: based on web technology, e.g. hypertext transfer protocol [HTTP] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system and method that includes receiving a client data packet from network traffic with a client device; extracting a set of packet components from the client data packet; generating a client fingerprint from the set of packet components; assigning a client type to the network traffic using the client fingerprint; and optionally filtering the network traffic of the client device based at least in part on the client type. ## Claims ### Claim 1 A method comprising: receiving a client data packet from network traffic with a client device; extracting a set of packet components from the client data packet; individually applying a hash operation to each of the set of packet components to generate a set of hashed packet components; applying a hash operation to the set of hashed packet components to generate a hash of the set of hashed packet components; generating a multiple tiered client fingerprint with an overall client fingerprint from the hash of the set of hashed packet components and a set of sub-fingerprints from the set of hashed packet components; and assigning a client type to the network traffic using the multiple tiered client fingerprint. ### Claim 2 (depends on 1) The method of claim 1, wherein the client data packet is a client hello message received during negotiation during a cryptographic protocol. ### Claim 3 (depends on 2) The method of claim 2, wherein the cryptographic protocol is a transport layer security (TLS) protocol. ### Claim 4 (depends on 2) The method of claim 2, further comprising filtering the network traffic of the client device based at least in part on the client type. ### Claim 5 (depends on 4) The method of claim 4, wherein assigning the client type to the network traffic using the multiple tiered client fingerprint comprises of selecting the client type from a database mapping multiple tiered client fingerprints to a classification of client type. ### Claim 6 (depends on 4) The method of claim 4, wherein extracting the set of packet components comprises extracting identifying data from a client cipher suite list and a list of compression methods from the client hello message; and wherein generating the multiple tiered client fingerprint comprises encoding the set of packet components into the multiple tiered client fingerprint as a character representation, wherein individually applying the hash operation to each of the set of packet components to generate the set of hashed packet components comprises hashing the client cipher suite list and hashing the list of compression methods. ### Claim 7 (depends on 4) The method of claim 4, wherein filtering the network traffic further comprises limiting network traffic from a client because of the client type. ### Claim 8 (depends on 2) The method of claim 2, wherein generating the multiple tiered client fingerprint further comprises encoding the set of packet components into the multiple tiered client fingerprint as a character representation. ### Claim 9 (depends on 8) The method of claim 8, wherein encoding the set of packet components into the multiple tiered client fingerprint as a character representation of the hash of the set of hashed packet components and the set of sub-fingerprints from the set of hashed packet components. ### Claim 10 (depends on 8) The method of claim 8, wherein extracting the set of packet components further comprises extracting identifying data from a client cipher suite list from the client hello message; and wherein individually applying the hash operation to each of the set of packet components to generate the set of hashed packet components comprises hashing the client cipher suite list. ### Claim 11 (depends on 8) The method of claim 8, wherein extracting the set of packet components further comprises extracting identifying data from a list of compression methods from the client hello message; and wherein individually applying the hash operation to each of the set of packet components to generate the set of hashed packet components comprises hashing the list of compression methods. ### Claim 12 (depends on 8) The method of claim 8, wherein extracting the set of packet components further comprises extracting identifying data from a client point formats from the client hello message; and wherein individually applying the hash operation to each of the set of packet components to generate the set of hashed packet components comprises hashing the client point formats. ### Claim 13 (depends on 8) The method of claim 8, wherein extracting the set of packet components further comprises extracting identifying data from a list of supported application protocols from the client hello message; and wherein individually applying the hash operation to each of the set of packet components to generate the set of hashed packet components comprises hashing the list of supported application protocols. ### Claim 14 (depends on 8) The method of claim 8, wherein extracting the set of packet components further comprises extracting identifying data from a list of client-supported extensions from the client hello message; and wherein individually applying the hash operation to each of the set of packet components to generate the set of hashed packet components comprises hashing a formation of the list of client-supported extensions. ### Claim 15 A non-transitory computer-readable medium storing instructions that, when executed by one or more computer processors of a communication platform, cause the communication platform to perform operations comprising: receiving a client data packet from network traffic with a client device; extracting a set of packet components from the client data packet; individually applying a hash operation to each of the set of packet components to generate a set of hashed packet components; applying a hash operation to the set of hashed packet components to generate a hash of the set of hashed packet components; generating a multiple tiered client fingerprint with an overall client fingerprint from the hash of the set of hashed packet components and a set of sub-fingerprints from the set of hashed packet components; and assigning a client type to the network traffic using the multiple tiered client fingerprint. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the client data packet is a client hello message received during negotiation during a transport layer security (TLS) protocol. ### Claim 17 (depends on 16) The non-transitory computer-readable medium of claim 16, wherein extracting the set of packet components comprises extracting identifying data from a client cipher suite list and a list of compression methods from the client hello message; wherein generating the multiple tiered client fingerprint comprises encoding the set of packet components into the multiple tiered client fingerprint as a character representation; wherein individually applying the hash operation to each of the set of packet components to generate the set of hashed packet components comprises hashing the client cipher suite list and hashing the list of compression methods; and wherein assigning the client type to the network traffic using the multiple tiered client fingerprint comprises selecting the client type from a database mapping multiple tiered client fingerprints to a classification of client type; and further comprising filtering the network traffic of the client device based at least in part on the client type. ### Claim 18 (depends on 17) The non-transitory computer-readable medium of claim 17, wherein extracting the set of packet components comprises extracting identifying data from the client point formats, the list of supported application protocols, and the list of client-supported extensions from the client hello message; wherein individually applying the hash operation to each of the set of packet components to generate the set of hashed packet components comprises hashing the client point formats, hashing the list of supported application protocols, and hashing the list of client-supported extensions. ### Claim 19 (depends on 18) The system of claim 18, wherein the client data packet is a client hello message received during negotiation during a transport layer security (TLS) protocol. ### Claim 20 (depends on 19) The system of claim 19, wherein instructions to extract the set of packet components comprises instructions to extract identifying data from the client point formats, the list of supported application protocols, and the list of client-supported extensions from the client hello message; wherein instructions to individually applying the hash operation to each of the set of packet components to generate the set of hashed packet components comprises instructions to hash the client point formats, hash the list of supported application protocols, and hash the list of client-supported extensions. ### Claim 21 A system comprising of: a network traffic data interface with access to client data packet from network traffic with a client device; and a data packet analyzer that receives the client data packet from the network traffic data interface and comprises one or more computer-readable mediums storing instructions that, when executed by the one or more computer processors, cause a computing platform to: extract a set of packet components from the client data packet, individually apply a hash operation to each of the set of packet components to generate a set of hashed packet components, apply a hash operation to the set of hashed packet components to generate a hash of the set of hashed packet components, generate a multiple tiered client fingerprint with an overall client fingerprint from the hash of the set of hashed packet components and a set of sub-fingerprints from the set of hashed packet components, and assign a client type to the network traffic using the multiple tiered client fingerprint. ### Claim 22 (depends on 21) The system of claim 21, wherein instructions to extract the set of packet components comprises instructions to extract identifying data from a client cipher suite list and a list of compression methods from the client hello message; wherein instructions to generate the multiple tiered client fingerprint comprises instructions to encode the set of packet components into the multiple tiered client fingerprint as a character representation, wherein instructions to individually apply the hash operation to each of the set of packet components to generate the set of hashed packet components comprises instructions to hash the client cipher suite list and hash the list of compression methods; and wherein instructions to assign the client type to the network traffic using the multiple tiered client fingerprint comprises instructions to select the client type from a database mapping multiple tiered client fingerprints to a classification of client type; and further comprising instructions to filter the network traffic of the client device based at least in part on the client type.