# US 12,217,196 B2 · Facilitating device fingerprinting through assignment of fuzzy device identifiers

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,217,196 B2
- Document ID: US12217196B2
- Status: Granted
- Kind: B2
- Application number: 18/097,083
- Filed: 2023-01-13
- Published: 2023-07-13
- Granted: 2025-02-04
- Earliest claimed: 2018-12-17
- Assignees: Microsoft Technology Licensing, LLC
- Applicants: Microsoft Technology Licensing, LLC
- Inventors: Ram Prasad Sunkara; Shoou-Jiun Wang; Jayaram NM Nanduri
- Web page: https://patentgrep.com/patent/US12217196B2

## CPC

- G06N 5/048: Fuzzy inferencing
- H04L 63/102: {Entity profiles}
- G06F 16/2365: {Ensuring data consistency and integrity}
- G06F 21/44: Program or device authentication
- G06N 20/00: Machine learning
- G06Q 20/409: {Device specific authentication in transaction processing}
- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- H04W 12/75: Temporary identity
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06Q: INFORMATION AND COMMUNICATION TECHNOLOGY [ICT] SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES; SYSTEMS OR METHODS SPECIALLY ADAPTED FOR ADMINISTRATIVE, COMMERCIAL, FINANCIAL, MANAGERIAL OR SUPERVISORY PURPOSES, NOT OTHERWISE PROVIDED FOR
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Various device attributes associated with a current event may be obtained. Similarity metrics may be determined that indicate a degree of similarity between the device attributes that are associated with the current event and stored device attributes that are associated with previous events and previously created fuzzy device identifiers. A fuzzy device identifier may be assigned to the current event based at least in part on a comparison of the similarity metrics with a threshold. If none of the similarity metrics compare favorably with the threshold, then a new fuzzy device identifier may be created for the current event. However, if at least one of the similarity metrics compares favorably with the threshold, then the previously created fuzzy device identifier whose stored device attributes are most similar to the device attributes that are associated with the current event may be assigned to the current event.

## Claims

### Claim 1

A computer-implemented method for facilitating device fingerprinting, the method comprising:
obtaining device attributes that are associated with a current event;
determining similarity metrics that indicate a similarity correspondence between the device attributes associated with the current event and stored device attributes that are associated with previous events and previously created fuzzy device identifiers,
determining whether a similarity metric of the similarity metrics satisfies an attribute similarity threshold;
based on the similarity metric not satisfying the attribute similarity threshold, assigning a fuzzy device identifier for the current event by creating anew fuzzy device identifier for the current event;
based on the similarity metric satisfying the attribute similarity threshold with stored device attributes of a previously created fuzzy device identifier, assigning the previously created fuzzy device identifier as the fuzzy device identifier for the current event;
receiving a request decision from a risk server, the risk server having authorized the current event using the fuzzy device identifier; and
in response to receiving the request decision from the risk server, providing the assigned fuzzy device identifier to a requesting device for facilitating the device fingerprinting.

### Claim 2 (depends on 1)

The computer-implemented method of claim 1, wherein determining that the stored device attributes of the previously created fuzzy device identifier satisfies the attribute similarity threshold comprises determining that the stored device attributes of the previously created fuzzy device identifier indicates a higher degree of similarity to the device attributes that are associated with the current event than other similarity metrics.

### Claim 3 (depends on 1)

The computer-implemented method of claim 1, wherein:
the device attributes that are associated with the current event are represented as character strings;
the similarity metrics are distances; and
determining the similarity metrics comprises transforming the character strings to numeric values using attribute encoding matrices.

### Claim 4 (depends on 3)

The computer-implemented method of claim 3, further comprising generating the attribute encoding matrices by:
creating a training dataset that comprises a plurality of triplets, each triplet comprising an anchor event, a positive event, and a negative event;
encoding the plurality of triplets in the training dataset using the attribute encoding matrices to generate encoded triplets;
providing the encoded triplets as inputs to a cost-based loss model; and
adjusting the attribute encoding matrices based on outputs of the cost-based loss model.

### Claim 5 (depends on 3)

The computer-implemented method of claim 3, wherein determining the similarity metrics further comprises comparing distances between a vector that comprises the numeric values and a plurality of other vectors representing the stored device attributes associated with the previous events and the previously created fuzzy device identifiers.

### Claim 6 (depends on 1)

The computer-implemented method of claim 1, wherein determining the similarity metrics comprises:
transforming character strings representing the device attributes that are associated with the current event to numeric values using attribute encoding matrices; and
determining distances between a vector that comprises the numeric values and a plurality of other vectors representing the stored device attributes that are associated with the previous events and the previously created fuzzy device identifiers.

### Claim 7 (depends on 1)

The computer-implemented method of claim 1, wherein determining the similarity metrics comprises:
calculating partition similarity metrics that indicate a degree of similarity between the device attributes that are associated with the current event and stored device attributes that are associated with a plurality of partitions, wherein each partition of the plurality of partitions includes a set of previously created fuzzy device identifiers and stored device attributes;
utilizing the partition similarity metrics to select a particular partition from the plurality of partitions; and
determining the similarity metrics that indicate the degree of similarity between the device attributes that are associated with the current event and the stored device attributes that are associated with the previous events and the previously created fuzzy device identifiers stored in the particular partition.

### Claim 8 (depends on 1)

The computer-implemented method of claim 1, further comprising:
assigning a plurality of fuzzy device identifiers to a plurality of events for which global device identifiers are known; and
determining an accuracy metric that indicates accuracy of the assignment of the plurality of fuzzy device identifiers.

### Claim 9 (depends on 8)

The computer-implemented method of claim 8, wherein determining the accuracy metric comprises assigning a status label to each of the plurality of fuzzy device identifiers based on defined rules, and wherein the defined rules specify that:
a true positive status label is assigned when a first-time fuzzy device identifier is assigned to a first-time global device identifier;
a false negative status label is assigned when an already assigned global device identifier is assigned to an unassigned fuzzy device identifier; and
a false positive status label is assigned when an already assigned fuzzy device identifier is assigned to an unassigned global device identifier.

### Claim 10

A computer-implemented method for facilitating device fingerprinting, comprising:
obtaining device attributes that are associated with a current event that requires authorization from a risk server;
determining similarity metrics that indicate a similarity correspondence between the device attributes associated with the current event and stored device attributes that are associated with previous events and previously created fuzzy device identifiers,
determining whether a similarity metric of the similarity metrics satisfies an attribute similarity threshold;
based on the similarity metric not satisfying the attribute similarity threshold, assigning a fuzzy device identifier for the current event by creating a new fuzzy device identifier for the current event;
based on the similarity metric satisfying the attribute similarity threshold with stored device attributes of a previously created fuzzy device identifier, assigning the previously created fuzzy device identifier as the fuzzy device identifier for the current event;
providing the assigned fuzzy device identifier to the risk server that cause the risk server to use the fuzzy device identifier to determine whether to authorize the current event;
receiving a request decision from the risk server indicating authorization of the current event; and
in response to receiving the request decision from the risk server, providing the assigned fuzzy device identifier to a requesting device.

### Claim 11 (depends on 10)

The computer-implemented method of claim 10, wherein determining that the stored device attributes of the previously created fuzzy device identifier satisfies the attribute similarity threshold comprises determining that the stored device attributes of the previously created fuzzy device identifier indicates a higher degree of similarity to the device attributes that are associated with the current event than other similarity metrics.

### Claim 12 (depends on 10)

The computer-implemented method of claim 10, wherein determining the similarity metrics comprises:
transforming character strings representing the device attributes that are associated with the current event to numeric values using attribute encoding matrices; and
comparing distances between a vector that comprises the numeric values and a plurality of other vectors representing the stored device attributes associated with the previous events and the previously created fuzzy device identifiers.

### Claim 13 (depends on 10)

The computer-implemented method of claim 10, wherein determining the similarity metrics comprises:
creating a dataset that comprises results of comparing the device attributes that are associated with the current event and the stored device attributes that are associated with the previous events and the previously created fuzzy device identifiers;
providing the dataset as input to a logistic regression model that outputs numerical values for each set of device attributes input into the logistic regression model; and
comparing a first set of numerical values from the device attributes that are associated with the current event with sets of numerical values from the stored device attributes that are associated with the previous events to determine the similarity metrics.

### Claim 14 (depends on 13)

The computer-implemented method of claim 13, wherein:
the results in the dataset comprise a plurality of sets of values;
each set of values of the results corresponds to a comparison of the device attributes that are associated with the current event and a set of stored device attributes that are associated with a previous event and the previously created fuzzy device identifiers; and
each value within a particular set of values of the results is generated by comparing a device attribute associated with the current event and a corresponding device attribute in a set of stored device attributes.

### Claim 15 (depends on 13)

The computer-implemented method of claim 13, wherein determining the similarity metrics comprises creating the dataset that includes weighted values based on comparing the device attributes associated with the current event with the stored device attributes associated with the previous events.

### Claim 16 (depends on 15)

The computer-implemented method of claim 15, wherein:
the weighted values comprise inverse frequency smoothing values;
the inverse frequency smoothing values having a first polarity correspond to matching attributes; and
the inverse frequency smoothing values having a second polarity opposite the first polarity correspond to non-missing pairs of attributes that do not match.

### Claim 17

A system for facilitating device fingerprinting, comprising:
a processor; and
memory comprising instructions that are executable by the processor to perform operations comprising:
obtaining device attributes that are associated with a current event;
determining similarity metrics that indicate a similarity correspondence between the device attributes associated with the current event and stored device attributes that are associated with previous events and previously created fuzzy device identifiers,
determining whether a similarity metric of the similarity metrics satisfies an attribute similarity threshold;
based on the similarity metric not satisfying the attribute similarity threshold, assigning a fuzzy device identifier for the current event by creating a new fuzzy device identifier for the current event;
based on the similarity metric satisfying the attribute similarity threshold with stored device attributes of a previously created fuzzy device identifier, assigning the previously created fuzzy device identifier as the fuzzy device identifier for the current event;
receiving a request decision from a risk server, the risk server having authorized the current event using the fuzzy device identifier; and
in response to receiving the request decision from the risk server, providing the assigned fuzzy device identifier to a requesting device for facilitating the device fingerprinting.

### Claim 18 (depends on 17)

The system of claim 17, wherein determining that the stored device attributes of the previously created fuzzy device identifier satisfies the attribute similarity threshold comprises determining that the stored device attributes of the previously created fuzzy device identifier indicates a higher degree of similarity to the device attributes that are associated with the current event than other similarity metrics.