Invisible DOM Element CSS Fingerprinting for Spoofing Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing browser fingerprinting solutions are ineffective against determined attackers due to their ease of spoofing, as they rely on manipulable device fingerprints and lack a general anti-spoofing defense.
Innovation Solution
A device fingerprinting method based on Cascading Style Sheet (CSS) properties of Document Object Model (DOM) elements is implemented, where an intermediary injects an invisible DOM element with random style properties, tracking styles to identify clients and detect spoofing attacks, leveraging the unique rendering of browsers in different environments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional browser fingerprinting is used to identify clients, then device identification can be achieved, but the identification is easily spoofed by attackers manipulating device fingerprints
Solution Approach 1:
The patent introduces an intermediary invisible DOM element between the browser and the web page. This intermediary element acts as a mediator that captures the browser's true rendering behavior through CSS property tracking, preventing direct manipulation of fingerprint data while maintaining identification accuracy
Solution Approach 2:
The patent changes the fingerprinting approach from using direct device attributes (user agent, screen resolution) to using CSS rendering parameters (margins, padding, font sizes) of an intermediary element. This parameter transformation makes fingerprinting resistant to spoofing while preserving identification capability
2Adaptability or versatility
If browser extensions are analyzed through injected styles for fingerprinting, then extension identification is possible, but the approach does not provide general anti-spoofing defense
Solution Approach 1:
The patent creates a universal fingerprinting mechanism that works across all browsers and devices by using standard CSS rendering behavior. The intermediary DOM element approach is browser-agnostic and can identify both legitimate devices and detect spoofing attempts, providing general-purpose anti-spoofing protection
3Reliability
If device fingerprints are made more complex to resist spoofing, then anti-spoofing protection improves, but the fingerprinting system becomes more vulnerable to manipulation
Solution Approach 1:
The patent employs a self-service approach where the browser's own CSS rendering engine generates the fingerprint data through the intermediary element. The system leverages the browser's inherent behavior rather than adding complex external verification layers, achieving robust anti-spoofing protection without excessive system complexity
Data Source
AI summary
A method of detecting deceptive web activity is implemented in an intermediary located between a requesting client device, and a server that hosts a web application. Following a bootstrap phase used to generate a database of information identifying characteristics of clients, the method begins by receiving a page directed to the client from the server. The server injects an invisible DOM element having a set of style properties associated therewith, with one of the set of style properties assigned a random value, to generate a modified page, which is returned to the client. As the client interacts with the modified page, the intermediary tracks the device's styles and uses them to identify the client from information in the database. Once the device is identified, the intermediary then detects whether a spoofing attack has occurred. By leveraging the tracked styles, a spoofing attack on the DOM element's styles may also be detected.