User authentication on a web resource using a browser fingerprint-based identifier

Abstract

The invention relates to methods for authenticating users by generating web browser identifiers. The present method includes the steps of receiving, on a server, data about a user connection to a web resource; collecting¸ from the client device, parameters of the user's web browser, including a web browser performance parameter, audio processing interface parameters and 2D and 3D graphic rendering parameters; determining parameters of the web browser connection to the server, including the HTTP headers received in the browser request, and the IP address of the client device; generating SSL and TCP fingerprints on the server on the basis of the obtained client device web browser parameters; generating an identifier of the web browser fingerprint by vectorizing the collected web browser parameters; using the obtained identifier to train a machine learning model; using the machine learning model for the subsequent authorization of users on the web resource. The technical result is an increase in the reliability of user authentication.

Description

AUTHENTICATION OF USERS ON A WEB RESOURCE USING A WEB BROWSER FINGERPRINT-BASED IDENTIFIER AREA OF TECHNOLOGY

[0001] This technical solution relates to the field of information technology, namely to methods of user authentication using the formation of web browser identifiers (ID). LEVEL OF TECHNOLOGY

[0002] A method for forming a fingerprint of a user's web browser is known (application US 20150067472 A1, 05.03.2015), which is used as an identifier of the user's device type for subsequent modification of the interface for displaying content in the required format depending on the type of device and the user's web browser.

[0003] A method is known for generating an identifier of information provided to the user via a web browser (application US 20190124168 A1, 04 / 25 / 2019), based on the use of hashing of relevant information according to a set of parameters.

[0004] The prior art also includes approaches to user authentication based on the history of page transitions in a web browser (patent US 9712520 B1, 18.07.2017), which allow the formation of an identifier based on related transitions between pages, taking into account previous user authentications.

[0005] Thus, at the present time, it is not proposed to generate a stable identifier of a web browser based on the set of data of the device on which the web browser is running, for subsequent training of machine learning models that subsequently allow authenticating users. ESSENCE OF THE INVENTION

[0006] The present invention allows solving the technical problem of creating a stable user identifier based on digital fingerprints of a web browser.

[0007] The technical result is to ensure efficient generation of an identifier based on a digital fingerprint of a website for user authentication.

[0008] Another technical result is to increase the reliability of user authentication by generating a web browser fingerprint.

[0009] The claimed solution in a preferred embodiment is a method for authenticating users on a web resource using an identifier based on a web browser fingerprint, comprising the steps of: a) receiving user connection data on the web resource from the server; b) collecting user web browser parameters from the client device, which include at least: a web browser performance parameter, audio processing interface parameters, 2D and 3D graphics rendering parameters; c) determining web browser connection parameters on the server, which include: HTTP headers received in the browser request and the IP address of the client device; d) generating SSL and TCP fingerprints on the server based on the received client device web browser parameters; e) generating a web browser fingerprint identifier using vectorization of the collected web browser parameters in steps b) - d);f) use the identifier obtained in step e) to train at least one machine learning model; g) apply the machine learning model trained in step f) for subsequent authorization of users on the web resource.

[0010] In one particular implementation example, data in step b) is collected using a script executed on the client device.

[0011] In another particular example of implementation, at step b) at least one parameter is additionally collected, selected from the group: an identifier stored in cookies; characteristics of the browser and user device, characteristics available through CSS media queries; a user agent string; availability of notifications; execution of JavaScript operations; a list of installed fonts; a list of names of installed voices for speech synthesis.

[0012] In another particular example of implementation, the vectorization of parameters for the formation of the identifier is carried out using several machine learning models, each of which processes the corresponding part of the set of collected parameters.

[0013] In another preferred embodiment, a system for authenticating users on a web resource using an identifier based on a web browser fingerprint comprising at least one process and at least one memory storing machine-readable instructions that, when executed by at least one processor, implement the above method. BRIEF DESCRIPTION OF DRAWINGS

[0014] Fig. 1 illustrates the general scheme of operation of the claimed solution.

[0015] Fig. 2 illustrates a block diagram of the implementation of the claimed method.

[0016] Fig. 3 illustrates an example of a computing device. IMPLEMENTATION OF THE INVENTION

[0017] Fig. 1 shows a general diagram (100) of the claimed solution. When connecting a client device (110) to a web resource using a web browser (112) installed on the device (BD), data is exchanged with the server (120) for subsequent collection of device parameters (110). When connecting a device (110), for example a computer or laptop, to the server (120) by means of a request for access to the web resource, a parameter collection module (111) is activated on it, which can be a software script or an application that ensures data collection, testing and their transmission to the server (120) for the formation of a fingerprint (121).

[0018] The server (120), based on the data collected by the module (111), transmits them to the database (130), after which it forms a fingerprint (121) of the web browser. The server (120), in one of the implementation examples, contains the Nginx web server, an SSL fingerprint formation module (JA3) for the Nginx web server, and a TCP fingerprint formation module (pOf).

[0019] In the database (130), for each created fingerprint, a data block is stored in the form of a hierarchical structure consisting of the following fields: - unique identifier of the record in the database, - date and time (UTC) of the creation of the record in the database by the server, - client version of the fingerprint (deprecated; for backward compatibility), - a set of fingerprint components.

[0020] Example of a generated web browser fingerprint "_id": { "$oid": "650abfd3clccd97eal7afdal" }, "datetime": { "$date": "2023-09-20T09:48:03.978Z" "fingerprint": "702ee8808d3d03646a37cf3a41c7a459", "components": { / / set of fingerprint components } Key Purpose id Unique identifier of the record in the database datetime Date and time (UTC) when the record in the database was created by the server fingerprint Client version of the fingerprint (deprecated; for backward compatibility) components Data block in which the set of fingerprint components is stored.

[0021] Structure of the fingerprint component data block Each fingerprint component contains the following data: - the value or values ​​(in the form of a JSON object) obtained during the test of this component; - time spent to obtain the value of the component; - hashes of the component value generated by several hashing algorithms. Let's consider the structure of the fingerprint component using the autold component as an example. "_autold": { "value": { "id": "За810d58-2d99-4127-af8c-cadl 8de2286e", "status": "new" "duration": 1, "sha256": "12e68edb5357fb99114fddcd7519a084a048c8bl0367cfdbe720aa0746c449bl", "murmurhash2": 766997022, "murmurhash3": 3855976235, "murmurhash3.x86.hash32": 3855976235, "murmurhash3 ,x86.hashl 28 " : " 1 a0ce831 deea2aa7e 1 fda7259612b69e", "murmurhash3.x64.hashl28": "e0cd3e75dbb430b00el220fff48504d3", "ssdeep" : "3 : YM5yQdqBtsUCu7EBoAXXmHJWR4bs:YMcQdA7E+AXXwJWcs"} .

[0022] Fig. 2 shows a block diagram of the method (200) for forming a digital fingerprint of the web browser of the user device (110). At the first stage (201), the server (120) receives the user's connection data on the web resource. Then, the server (120) activates the data collection module (111), which collects the parameters of the user's web browser (112) from the client device (110), which include the following minimum set: data on the minimum time interval for loading the web page, audio processing interface parameters, 2D and 3D graphics rendering parameters in the browser.

[0023] The above parameters are collected by performing a series of tests carried out on the user's device (110) in the web browser (112), while their execution is invisible to the user and does not affect the display of information on the display of the device (110).

[0024] Web browser performance data (112) is collected by the module (111) during a web page opening speed test. The Performance.now method (https: / / developer.mozilla.org / en-US / docs / Web / APl / Performance / now) can be used as such a test. The availability of the browser's Performance API is preliminarily checked, and 'null' is returned if it is unavailable. At each iteration of the execution loop of this method, the values ​​of the smallest and second smallest difference are updated during testing, which represent the difference between the current value returned by the 'performance.now' method and its previous value. As a result, the function returns an array of two values: the smallest and second smallest difference.

[0025] The browser fingerprint component is generated using the implementation features of the built-in browser Performance API. The Performance API is a group of standards that describe browser APIs used to measure web application performance with higher accuracy than the built-in Date class. The performance.now() method returns the current time value with a step of up to 1 microsecond. However, the actual accuracy of this method is lower and may differ across browsers; this feature is used to generate this browser fingerprint component.

[0026] Determination of the accuracy of the method, that is, the minimum interval actually available for measurement, is implemented by means of multiple calls to the method performance.now() in a loop without delays at maximum frequency and storing the smallest of the time difference values ​​returned by this method. The time difference can be compared based on the current RTC value of the device (110).

[0027] The number of loop iterations sufficient to determine the minimum value is determined by the processor performance and is limited from below by the need to capture a sufficient number of changes to the value returned by the performance.now() method, and from above by the need to limit the processor load and the total duration of collecting the browser fingerprint components. The base value for the number of loop iterations does not change and is set to 5000. This value may be changed in other versions.

[0028] While the current iteration number does not exceed the maximum number of loop iterations, the following algorithm is executed: • The availability of the browser's Performance API is checked, and if it is not available, null is returned; • Before the loop starts, the current value returned by the performance.now() method is saved and the variable is initialized; • At each iteration of the loop, the performance.now() method is called and the result it returns is compared with the value obtained previously; • If the new value is greater than the previous one, the difference is compared with the stored lowest values. As a result, the function returns an array of the two smallest difference values: the minimum and the next value (to reduce the influence of random outliers). The similar component of the performance fingerprint returns only one value: the smallest difference.

[0029] An example implementation of this function in TypeScript: export default async function performance2(): Promise<[number, number] | null> { const perf = window.performance if (perf === undefined) return null const now = perf.now if (typeof now !== 'function') return null const COUNT = 5000 let minDiff = 1 let otherMinDiff = 1 let oldNow = nowQ let newNow = oldNow for (let i = 0; i < COUNT; i++) { oldNow = newNow newNow = now() / / Check if the new value is greater than the previous one if (oldNow < newNow) { const diff = newNow - oldNow / / If the new difference value is greater than the saved minimum value if (diff > minDiff) { / / The current minimum value does not need to be changed / / Check that the value of the second minimum exceeds the current value and adjust it if necessary if (diff < otherMinDiff) { / / Correct the second minimum otherMinDiff = diff } else if (diff < minDiff) { / / Adjust the minimum value to the new difference value and the second minimum to the previous minimum value . otherMinDiff = minDiff minDiff = diff / / Return the minimum and second minimum values ​​return [minDiff, otherMinDiff]

[0030] The parameters of the audio processing interface are also defined using the WebAudio API method of the web browser. This method synthesizes triangular oscillations to which the dynamic compression effect is applied, limiting the maximum signal level. The resulting audio oscillations are then converted to digital form to calculate a hash function based on them. The WebAudio API of the browser creates an 'AudioContext' object, to which an 'OscillatorNode' is added, generating periodic oscillations with the specified parameters and a 'DynamicsCompressorNode', limiting the signal level. 'AudioContext' then generates an output array of audio data obtained using 'getChannelData'. The hash function of the digitized fragment of this array is used as the result. Example value: 124.08075643483608.

[0031] The module (111) also collects 2D and 3D graphics rendering data in the web browser (112), which is done by rendering an array of points in two-dimensional and three-dimensional space, which allows determining the performance of the user's device's graphics processor (110). One example of this kind of algorithm is using the Threejs and DrawnApart methods for 3D graphics and Canvas2 for 2D graphics.

[0032] Threejs and Canvas2 methods return a hash of the binary representation of the bitmap generated during their execution as a result. The time required to draw each array of points can also be used as collected parameters for subsequent hashing. In a particular implementation example, the time required to display the graphical user interface in a web browser can also be measured (112).

[0033] An example of the canvas algorithm in action!

[0034] A fingerprint generated using 2D graphics. It is generated by drawing geometric shapes based on an array of dots with a gradient fill and fixed text. The value is randomized by a number of plugins and the Brave browser. "geometry": { "hash": "fa6c6560f0ba9blaf60ba4e5fb28bl3c", "winding": true "text": { "hash" : "ff96235dcc81 c9fec 187d7d0ae571 f97", winding": true }, "combined": { "hash": "3682505187bff83e94969df5838d8cff', "winding": true }

[0035] An example of the Drawn Apart algorithm in action "offscreen": { "measurements": [ 90, 5.5, 3.2, 3.2, 3.1, 3.7, 3.4, 3.2, 3.2, 3, 3.2, 3.1, 3.4, 3.2, 3.5, 3, 3, 4.7, 8.4, 4.8, 4.8, 13.7, 34.1, 5.6, 6.2, 6.4, 5.5, 5.5, 5.2, 5.2, 5.2, 4.8, 2.9, 4.7, 5.4, 5.2, 5.6, 4.7, 5.4, 5.1, 4.7, 4.7, 5.1, 4.7, 5.3, 5.1, 5, 5.6, 3.4, 7.6, 5.1, 4.8, 5, 5.3, 5.6, 6.6, 5.6, 5.6, 4.9, 5.7, 5.2, 5.1, 5.3, 5.7, 3, 5, 5.1, 5, 4.9, 5, 4.8, 4.7, 5.3, 5.3, 5.5, 5.2, 5.1, 5.1, 5.4, 5.7, 3.3, 4.9, 5.4, 5.4, ​​5.3, 5.1, 5, 5.1, 5.1, 5.4, 4.9, 5.8, 6.6, 5.7, 5.6, 5.8, 3.4, 4.8, 5, 6.4, 5.1, 5.1, 5.4, 5.2, 5.2, 5.2, 5.2, 5.5, 5.4, 5.2, 5, 5.2, 4.8, 5.9, 5.2, 5.8, 6.1, 5.8, 5.4, 5.1, 5.4, 5.3, 5.3, 5.5, 5.7, 6.4, 5.3, 5.7 ], "total": 771.6 "onscreen": { "measurements": [2.2, 22.7, 124.6, 36.4, 33.9, 22.7, 34.2], "total": 277.6

[0036] Additionally, the module (111) may additionally collect one or more of the following parameters: an identifier stored in cookies; browser and user device characteristics, characteristics available through CSS media queries; user agent string; notification availability; Executing JavaScript operations; List of installed fonts; List of names of installed voices for speech synthesis.

[0037] At stage (202), data is collected on the server (120), during which the web browser connection parameters (112) are determined. Such parameters may be HTTP headers received in the browser request and the IP address of the client device (110). The IP address of the device and the host name from the Nginx variables are saved in the HTTP headers.

[0038] Next, at stage (203), SSL and TCP fingerprints are formed on the server (120) based on the parameters obtained at stage (202). To form additional fingerprint components on the server side, the Nginx web server with an additional module is used - for the SSL fingerprint and the pOf utility - for the TCP fingerprint.

[0039] Getting SSL fingerprint The SSL fingerprint is generated using the JA3 algorithm (see https: / / github.com / phuslu / nginx-ssl-ringerprint), implemented as an Nginx module. The fingerprint obtained from the module variables is saved in HTTP headers when proxying a request to a server application: proxy set header HTTP-SSL-GREASED $http_ssl_greased; proxy set header HTTP-SSL- JA3 $http_sslja3; proxy_set_header HTTP-SSL-JA3-HASH $http_sslja3_hash.

[0040] To be able to form an SSL fingerprint, the SSL connection must be terminated directly on the Nginx where this module is installed. If SSL termination is performed earlier, all fingerprint information will be lost. Similarly, if termination is performed after passing Nginx with this module, receiving data from the encrypted stream is also impossible.

[0041] Getting TCP fingerprint The pOf algorithm (and utility) is used to form a TCP fingerprint. The classic implementation of this algorithm is the pOf utility (see https: / / github.com / pOt7pOf.git). A modified version can also be used, in which the MTU parameter value is also added to the available data. To operate, this utility is launched as a background process, intercepts and analyzes packets in sniffer mode, using the libpeap library. The analysis results are cached in memory and are available to third-party processes via a Unix socket using a simple protocol.

[0042] The server (120), having received an HTTP request, extracts the IP address from it and requests information on this IP from the pOf process. Since the TCP connection has already been established at this point, pOf returns the generated fingerprint to the server (120). It supplements the HTTP headers, which are then saved in the database (130). The pOf process is launched in a separate container, which, on the one hand, has access to the same network card as Nginx to intercept incoming packets, and on the other hand, to a dedicated disk directory (read + write) for the Unix socket to interact with the server application. To be able to generate a TCP fingerprint, the TCP connection must be opened between the client device (110) and the server network card directly (120). Otherwise (using NAT, proxy, "opaque" firewall, etc. on the server side) will lead to a complete loss of fingerprint information.

[0043] Based on the parameters of the user data of the web browser (112) obtained at stages (201 - 203), at stage (204) a fingerprint of the web browser is formed, which characterizes itself, which is then used at stage (205) to train the machine learning model, which will subsequently be used to identify the user (110). The entire array of received data is combined (concatenated) and encrypted using the ssdeep method.

[0044] As part of the task of finding effective methods for authenticating an individual user based on their session characteristics, a deep analysis of a number of existing identifiers was carried out in order to assess their effectiveness within the authorized zone. Based on the totality of the data examined, it was established that, on average, the quality and accuracy of the specified identifiers fluctuates within 75-85%, and the number of their collisions is minimal.

[0045] To improve the accuracy of user identification in the authorized zone, as well as the potential expansion of the application to the unauthorized zone, a series of experimental studies were conducted. The purpose of these studies was to identify the most relevant, stable and robust session parameters that are registered independently of the current identifiers, as well as to exclude those parameters that may distort or have no effect on the final result.

[0046] As part of the continuation of the task of searching for effective methods of identifying an individual user based on his session characteristics, alternative identification options using structural neural network solutions were considered. After a series of experiments and assessments, a solution based on the formation of individual embeds for each user session based on its data, and assessing their similarity with other available records for their identification and possible clustering.

[0047] The mentioned machine learning model, in particular the neural network model, was trained on an array of network session data and the corresponding characteristics of user devices on which the web browser was opened. The total volume of unloaded data was about 137,809 records. The proposed embedding is formed on the basis of 170 original numerical, text and hashed characteristics of the user session. Based on these characteristics, the ensemble of transformations and neural networks calculates a vector of about 3,500 numerical values ​​- the session embedding when the web browser is running in terms of user access to the required resources and his authentication.

[0048] The number of parameters involved in the formation and the final vector dimension may be subject to minor changes. This depends on the integration of new parameters or the exclusion / regrouping of existing ones, the impact of which on the final quality of the embedding is currently difficult to determine. With further development of the topic, these parameters may be revised.

[0049] In general, an embedding is a composition of four discrete vectors. Each of these vectors is normalized by its average length to unity and scaled using certain pre-calculated coefficients:

[0050] Vector #1 is formed on the basis of 58 parameters (Boolean, integer, categorical), processed and fed into a pre-trained neural network classification model. The values ​​of the neurons of the model on the penultimate layer, which has a dimension of 512, act as components of this vector, which is then normalized.

[0051] Vector #2 is formed based on 21 text parameters each passed to the Universal Sentence Encoder (Google / Tensorflow). The resulting vectors are summed and averaged into a single vector of dimension 512, after which it is normalized.

[0052] Vector #3 is formed from 9 parameters that are some combinations of letters and numbers, but are not classified as pure text or hash values. Universal Sentence Encoder (Google / Tensorflow) is applied to each parameter. The resulting vectors are summed and averaged into a single vector of dimension 512, after which it is normalized.

[0053] Vector #4 is formed based on 95 text parameters in hex format. Each parameter is bucketed (distributed) into 20 baskets according to its value, after which the one-hot-encoding method is applied and all data is concatenated. The resulting final vector of -1995 dimension is normalized.

[0054] Vectors are combined (concatenated) into an embedding with pre-multiplication by pre-determined coefficients designed to correct the influence of different data blocks on the final results.

[0055] The identification of the user (110) at stage (206) using the embedding formed on the basis of the digital fingerprint of his web browser (112) can be performed, depending on the logic of business tasks, in various ways, which are based on the calculation of the Euclidean distance between different embeddings or their assessment using the Bray-Curtis measure. During the analysis, a search for the nearest “neighbors” of the embeddings of records is used, as well as a search for the entire group of records of one user using the threshold values ​​of the Bray-Curtis measure, which demonstrated greater accuracy in comparison with the Euclidean distance. The preliminary threshold of the Bray-Curtis measure was chosen to be 0.15, which made it possible to obtain results close to absolutely accurate on the data of the authorized zone.

[0056] The created machine learning model for user authentication was validated on 100 thousand records, for which embeddings were formed and a search for the closest “neighbor” from this sample was conducted for each. Among the specified records, there are about 1700 in the authorized zone, for which their user and at least two of their records in this sample are reliably known. The closest embeddings according to the Bray-Curtis measure were correctly determined for about 1677 records.

[0057] Let's look at a few examples in which some of the records are selected that can reliably track the same user in an unauthorized zone based on the total uniqueness of the parameters:

[0058] Example 1. Record #43680 and the closest Bray-Curtis embedding - #50534: all identifiers (toplOO id, adtech uid, top lOOCounter. value. fp, autold, mid, stat_publd) are different for the pair, but both records have a rare (about 0.01%) x-real-ip (Sydney Australia), speechSynthesis.value, canvas2. value, touchSupport, which together with a very high probability indicates that this is one and the same user, which showed the embedding values, but did not show all available identifiers.

[0059] Example 2. Record #48203 and the closest Bray-Curtis embedding - #73561: all identifiers (toplOO_id, adtech uid, toplOOCounter.value.fp, autold, ruid, stat_publd) are different for the pair, but both records have rare (about 0.01%) canvas2.value, webglProgram. value and quite rare (from 0.01% to 1%) screenResolution.value, headers.value.user-agent, audio, which together with a very high probability indicate that this is the same user, as shown by the embedding values, but not all available identifiers.

[0060] Example 3. Record #52770 and the closest Bray-Curtis embedding - #78028: all identifiers (toplOO id, adtech uid, toplOOCounter.value.fp, autold, ruid, stat_publd) are different for the pair, but both records have rare (about 0.01%) x-real-ip (Calgary Canada), speechSynthesis.value , canvas2. value, threejs. value. gpu hash, timezone. value and fairly rare (from 0.01% to 1%) fonts. value, headers.value.user-agent, webglProgram.value, videoCard.value.renderer , which together with a very high probability indicates that this is the same user, as shown by the embedding values, but not all available identifiers.

[0061] Example 4. Record #4756 and the closest Bray-Curtis embedding #82732: all identifiers (toplOO id, adtech uid, toplOOCounter.value.fp, autold, ruid, stat_publd) are different for the pair, but both records have rare (about 0.01%) canvas2. value, ids.value.lastgeoip, fonts.value and fairly rare (from 0.01% to 1%) browserObjects. value, headers.value.user-agent, videoCard.value.renderer and others, which together indicate with a very high probability that this is the same user, as shown by the embedding values, but not all available identifiers.

[0062] Example 5. Record #1352 and the closest Bray-Curtis embedding #1360: all identifiers (toplOO id, adtech_uid, toplOOCounter.value.fp, autold, ruid, stat_publd) are different for the pair, but both records have rare (about 0.01%) canvas2.value, fonts.value, webglProgram.value and quite rare other parameters, which together with a very high probability indicates that this is the same user, as shown by the embedding values, but not all available identifiers.

[0063] A visual preliminary assessment shows that the Bray-Curtis threshold of 0.08 is a reliable indicator of a single user group in an unauthorized zone.

[0064] At stage (206), the trained neural network model analyzes the digital fingerprint (121) of the user's web browser, saved in the database (130), and the fingerprint formed during an active web browser session (112), for example, when accessing a site that requires user authentication, and based on the results of their comparison, makes a decision on its authentication, or rejection and a request for a third-party confirmation factor, which allows for the implementation of an additional security measure in terms of protecting user data.

[0065] Additionally, this solution can also be used to implement automatic user authentication mechanisms on web resources or in applications, eliminating the need to enter authentication data, based on a comparison of the received fingerprint and the one stored for the given user.

[0066] Fig. 3 shows a general view of a computing system implemented on the basis of a computing device (300). In the general case, the computing device (300) contains one or more processors (301) united by a common information exchange bus, memory means such as RAM (302) and ROM (303), input / output interfaces (304), input / output devices (305), and a device for network interaction (306).

[0067] The processor (301) (or several processors, multi-core processor) can be selected from a range of devices that are widely used at present, for example, from Intel™, AMD™, Apple™, Samsung Exynos™, MediaTEK™, Qualcomm Snapdragon™, etc. The processor must also include a graphic processor, for example, NVIDIA or ATI GPU, which is also suitable for the full or partial implementation of the method (200). In this case, the available memory capacity of the graphic card or graphic processor can act as a memory means.

[0068] RAM (302) is a random access memory and is intended for storing machine-readable instructions executed by the processor (301) to perform the necessary operations for logical data processing. RAM (302), as a rule, contains executable instructions of the operating system and the corresponding software components (applications, software modules, etc.).

[0069] ROM (303) represents one or more permanent storage devices, such as a hard disk drive (HDD), a solid-state drive (SSD), flash memory (EEPROM, NAND, etc.), optical storage media (CD-R / RW, DVD-R / RW, BlueRay Disc, MD), etc.

[0070] To organize the operation of the device components (300) and to organize the operation of external connected devices, various types of I / O interfaces (304) are used. The choice of the corresponding interfaces depends on the specific design of the computing device, which may include, but are not limited to: PCI, AGP, PS / 2, IrDa, FireWire, LPT, COM, SATA, IDE, Lightning, USB (2.0, 3.0, 3.1, micro, mini, type C), TRS / Audio jack (2.5, 3.5, 6.35), HDMI, DVI, VGA, Display Port, RJ45, RS232, etc.

[0071] To ensure interaction between the user and the computing device (300), various means (305) of I / O information are used, for example, a keyboard, a display (monitor), a touch display, a touchpad, a joystick, a mouse, a light pen, a stylus, a touch panel, a trackball, speakers, a microphone, augmented reality means, optical sensors, a tablet, light indicators, a projector, a camera, biometric identification means (a retina scanner, a fingerprint scanner, a voice recognition module), etc.

[0072] The network interaction means (306) ensures data transmission by the device (300) via an internal or external computer network, for example, Intranet, Internet, LAN, etc. One or more means (306) may be, but are not limited to: an Ethernet card, GSM modem, GPRS modem, LTE modem, 5G modem, satellite communication module, NFC module, Bluetooth and / or BLE module, Wi-Fi module, etc.

[0073] Additionally, satellite navigation tools included in the device (300) can also be used, for example, GPS, GLONASS, BeiDou, Galileo.

[0074] The submitted application materials disclose preferred examples of the implementation of the technical solution and should not be interpreted as limiting other, particular examples of its implementation that do not go beyond the scope of the requested legal protection, which are obvious to specialists in the relevant field of technology.

Claims

FORMULA 1. A method for authenticating users on a web resource using an identifier based on a web browser fingerprint, comprising the steps of: a) receiving user connection data on the web resource from the server; b) collecting user web browser parameters from a client device, which include at least: a web browser performance parameter, audio processing interface parameters, 2D and 3D graphics rendering parameters; c) determining web browser connection parameters on the server, which include: HTTP headers received in the browser request and the IP address of the client device; d) generating SSL and TCP fingerprints on the server based on the received client device web browser parameters; e) generating a web browser fingerprint identifier by vectorizing the collected web browser parameters in steps b) - d); f) using the identifier obtained in step e) to train at least one machine learning model.g) apply the machine learning model trained in stage I) for subsequent authorization of users on the web resource.

2. The method according to paragraph 1, in which the data in step b) is collected using a script executed on the client device.

3. The method according to claim 1, wherein at step b) at least one parameter is additionally collected, selected from the group: an identifier stored in cookies; characteristics of the browser and user device, characteristics available through CSS media queries; a user agent string; availability of notifications; execution of JavaScript operations; a list of installed fonts; a list of names of installed voices for speech synthesis.

4. The method according to claim 1, in which the vectorization of parameters for generating the identifier is carried out using several machine learning models, each of which processes the corresponding part of the set of collected parameters.

5. A system for authenticating users on a web resource using an identifier based on a web browser fingerprint, comprising at least one process and at least one memory in which machine-readable data is stored instructions that, when executed by at least one processor, implement the method according to any one of paragraphs 1-4.

Images