# US 2018/0324153 A1 · Client fingerprinting for information system security

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2018/0324153 A1
- Document ID: US20180324153A1
- Status: Published application
- Kind: A1
- Application number: 15/589,220
- Filed: 2017-05-08
- Published: 2018-11-08
- Earliest claimed: 2017-05-08
- Assignees: salesforce.com, inc.
- Applicants: salesforce.com, inc.
- Inventors: John Brooke ALTHOUSE; Jeffrey S. ATKINSON; Joshua ATKINS
- Web page: https://patentgrep.com/patent/US20180324153A1

## CPC

- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 9/0643: {Hash functions, e.g. MD5, SHA, HMAC or f9 MAC}
- H04L 9/3236: {using cryptographic hash functions}
- H04L 43/028: by filtering
- H04L 43/04: Processing captured monitoring data, e.g. for logfile generation
- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- H04L 63/0272: {Virtual private networks}
- H04L 63/101: {Access control lists [ACL]}
- H04L 63/166: {at the transport layer}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Client fingerprints can be used to detect and defend against malware and hacking into information systems more effectively than using IP addresses. A unique client fingerprint can be based on data found in the client's SSL client hello packet. SSL version, cipher suites, and other fields of the packet can be utilized, preferably utilizing individual field values in the order in which they appear in the packet. The ordered values are converted to decimal values, separated by delimiters, and concatenated to form an identifier string. The identifier string may be mapped, preferably by a hash function, to form the client fingerprint. The client fingerprint may be logged, and whitelists and blacklists may be formed using client fingerprints so formed.

## Claims

### Claim 1

A computer-implemented method for a database system, comprising:
monitoring packet data traffic on a network connection to the database system, to detect a Client Hello packet (CHP) received from a client entity over the network;
analyzing the CHP including—
extracting selected data from the CHP;
processing the selected data to form an SSL client identifier string;
applying a selected hash function to the SSL client identifier string to form an SSL client fingerprint; and
logging the SSL client fingerprint in a database.

### Claim 2 (depends on 1)

The method of claim 1 wherein:
the extracted data comprises a series of fields in the CHP, each of the fields containing zero or more hex values; and
processing the selected data includes—
for each of the series of fields, converting each of the hex values into a corresponding decimal value, inserting a value delimiter between the decimal values, and concatenating the decimal values and the value delimiters in an order in which the values appear in the field, to form a field result string; and
concatenating the field result strings to form the SSL client identifier string.

### Claim 3 (depends on 2)

The method of claim 2 wherein concatenating the field result strings includes arranging the field results in a sequence based on an order in which the fields are listed in the CHP, and inserting a predetermined field delimiter after each field result string prior to concatenating the field result strings.

### Claim 4 (depends on 3)

The method of claim 3 wherein the selected data fields comprise:
an SSL Version field, a cipher suite field, and an extension field.

### Claim 5 (depends on 4)

The method of claim 4 wherein the fields further comprise
an elliptic curve field.

### Claim 6 (depends on 2)

The method of claim 2 wherein processing the extracted data further includes inserting a field delimiter after each field in the SSL client identifier string; and concatenating the fields and the field delimiters to form the SSL client identifier string.

### Claim 7 (depends on 6)

The method of claim 6 wherein processing the extracted data further includes inserting a value delimiter after each decimal value within a field of the SSL client identifier string.

### Claim 8 (depends on 2)

The method of claim 2 wherein the selected hash function is an MD5 hash function.

### Claim 9 (depends on 2)

The method of claim 2 wherein processing the extracted data further includes persisting at least one field delimiter in the SSL client identifier string in the absence of data in the CHP for a corresponding field.

### Claim 10 (depends on 1)

The method of claim 1 and further comprising:
receiving a security indication for a specified SSL client fingerprint; and
updating the database based on the security indication.

### Claim 11 (depends on 1)

The method of claim 1 and further comprising:
extracting data from the database to form a log of SSL client fingerprints that identify clients that accessed the database system.

### Claim 12

A non-transitory, computer readable medium storing instructions executable by a processor to cause the processor to realize a client fingerprinting component, including carrying out the steps of:
receiving an indication of a detected Client Hello packet (CHP) on a network wire, and analyzing the CHP including—
extracting selected data from the CHP;
processing the selected data to form an SSL client identifier string;
applying a selected hash function to the SSL client identifier string to form an SSL client fingerprint; and
logging the SSL client fingerprint in a database.

### Claim 13 (depends on 12)

The computer readable medium of claim 12 wherein:
the selected data comprises a series of fields in the CHP, each of the fields containing zero or more values; and
processing the selected data includes—
for each field, converting each of the values into a corresponding decimal value, and concatenating the decimal values in an order in which the values appear in the field, to form a field result; and
concatenating the field results, over all of the fields in the CHP that have at least one value, to form the SSL client identifier string.

### Claim 14 (depends on 13)

The computer readable medium of claim 13 wherein:
concatenating the field results includes arranging the field results in a sequence based on an order in which the fields appear in the CHP, and inserting a field delimiter after each field result prior to concatenating the field results.

### Claim 15 (depends on 13)

The computer readable medium of claim 13 wherein the fields comprise:
an SSL Version field, a cipher suite field, and an extension field.

### Claim 16 (depends on 15)

The computer readable medium of claim 15 wherein the fields further comprise an elliptic curve field.

### Claim 17 (depends on 15)

The computer readable medium of claim 15 wherein the stored instructions further cause the processor to execute the steps of—
receiving a security indication for a specified SSL client fingerprint; and
updating the database based on the security indication.

### Claim 18 (depends on 15)

The computer readable medium of claim 15 wherein the stored instructions further cause the processor to extract data from the database to form a list of SSL client fingerprints that identify clients that accessed the database system.

### Claim 19

A system comprising:
an information system including a network interface for communications over an external network;
a packet analyzer coupled to the network interface to examine packet traffic traveling between the information system and the external network;
an SSL fingerprint component coupled to the network packet analyzer to analyze a Client Hello packet captured by the network packet analyzer;
wherein the fingerprint component is configured to generate an SSL client fingerprint based on the Client Hello packet; and
a datastore coupled to the fingerprint component for storing the SSL client fingerprint.

### Claim 20 (depends on 19)

The system of claim 19 wherein the SSL fingerprint component is arranged to generate a blacklist of clients based on data stored in the datastore; wherein the blacklist identifies each the clients by a corresponding SSL client fingerprint, rather than by an IP address.