Web Browser Fingerprinting for Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for identifying and controlling access to web-accessible software applications are inadequate, as they rely on version strings that can be obscured or modified, leading to vulnerabilities in computer and network security.
Innovation Solution
A system and method that uses executable code or algorithms to inspect the runtime environment of software applications, analyze HTTP headers, and combine these with user-agent string analysis to accurately identify and verify the type and version of web browsers and other software applications, ensuring up-to-date status and mitigating security risks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If version strings are used to identify software applications, then access control is simplified, but security is compromised due to malleability and emulation capabilities
Solution Approach 1:
The patent introduces an intermediary inspection mechanism that acts as a mediator between the software application and the access control system. This intermediary inspects the runtime environment and generates a fingerprint that serves as a reliable identifier, decoupling the access control function from the malleable version string while maintaining security through environment-based verification
Solution Approach 2:
The patent replaces the mechanical/string-based version identification system with a runtime environment inspection system. Instead of relying on textual version strings that can be manipulated, the system inspects the actual execution environment's characteristics to generate fingerprints, substituting the identification mechanism to eliminate malleability issues
2Reliability
If version numbers are made public for identification, then security policy enforcement is improved, but user privacy is compromised due to tracking and exploitation risks
Solution Approach 1:
The patent changes the identification parameter from explicit version numbers to runtime environment fingerprints. The fingerprint is derived from inspecting the execution environment's characteristics, transforming the identification approach to maintain security policy enforcement while avoiding the privacy risks associated with publishing and tracking version numbers
Solution Approach 2:
The patent extracts the identification function from the version string and relocates it to the runtime environment inspection process. By taking out the version number as the identification mechanism and replacing it with environment-based fingerprinting, the system maintains security enforcement capability while eliminating the privacy vulnerabilities inherent in public version number tracking
Data Source
AI summary
A method and system includes: receiving an access request for a protected web application server by the requesting browser application; returning a web page embedded with code that initiates a browser testing session between the requesting web browser and a remote access control server; generating a browser identity inspector based on a selection of two or more predetermined browser identity tests; executing the browser identity inspector to collect runtime environment data of the requesting web browser based on an execution of the selected two or more predetermined browser identity tests at the requesting web browser; compiling the collected runtime environment data into a browser digital fingerprint of the requesting web browser; using the browser digital fingerprint to: identify a browser version and type of the requesting web browser; calculating a browser identity confidence score that indicates a likelihood or a probability that the identified browser version and type is accurate.