Rule-Based Fingerprint Generation for IoT Device Scanning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The rapid growth of Internet of Things (IoT) devices has led to security vulnerabilities, with IoT devices being less secure than typical computers, resulting in incidents like unauthorized access to webcams, highlighting the need for effective detection and prevention of security vulnerabilities in these devices.
Innovation Solution
A rule-based fingerprint generation method and apparatus that involves transmitting packets to randomly generated IP addresses, parsing TCP/IP fields, and comparing them with OS and service fingerprint rules in JSON format to generate OS and service fingerprints, allowing for efficient gathering of device information and vulnerability analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If sequential IP scanning is performed to gather device information, then complete device information can be obtained, but network bottlenecks and blockages occur reducing scanning efficiency
Solution Approach 1:
The patent applies preliminary action by generating random IP addresses before scanning and preparing fingerprint rules in advance. The system generates candidate IP addresses randomly and prepares OS and service fingerprint rules beforehand, so when scanning occurs, the comparison can proceed immediately without bottlenecks. This pre-preparation eliminates the sequential bottleneck while maintaining information gathering effectiveness.
Solution Approach 2:
The patent transitions from sequential linear scanning to parallel random scanning across multiple IP dimensions. Instead of scanning IPs in order (192.168.1.1, 192.168.1.2, ...), the system scans random IPs simultaneously from different address spaces, adding dimensionality to the scanning approach and eliminating sequential bottlenecks.
2Reliability
If comprehensive device scanning is performed to identify all IoT devices, then security vulnerability detection capability is improved, but system complexity and resource consumption increase
Solution Approach 1:
The patent segments the device scanning process into distinct phases: IP generation, packet transmission, response reception, and fingerprint matching. Each phase handles a specific task independently, reducing overall system complexity. The fingerprint database is also segmented into OS fingerprints and service fingerprints, allowing modular processing and analysis.
Solution Approach 2:
The patent introduces fingerprint rules as an intermediary between raw packet data and vulnerability detection. Instead of directly analyzing complex device responses for vulnerabilities, the system compares responses against pre-defined fingerprint rules that encode vulnerability patterns. This intermediary layer simplifies the detection process while maintaining high reliability.
3Productivity
If random IP addresses are generated and scanned in parallel, then scanning speed is improved, but information accuracy may be reduced due to missed devices
Solution Approach 1:
The patent implements feedback by continuously comparing scanned device responses against the fingerprint database and using the results to guide further scanning. The system receives syn-ack packets, extracts TCP/IP fields, compares them with stored fingerprints, and generates OS fingerprints based on matches. This feedback loop ensures accurate device identification while maintaining high scanning speed through parallel random IP generation.
Data Source
AI summary
A device information gathering method is provided. The device information gathering method includes: allowing a device information gathering apparatus to transmit a packet to a randomly generated Internet Protocol (IP) address and to receive a syn-ack packet as a response; allowing the device information gathering apparatus to parse the syn-ack packet and thus to extract Transmission Control Protocol (TCP)/IP fields; and allowing the device information gathering apparatus to compare the TCP/IP fields and an OS fingerprint rule, which is in JavaScript Object Notation (JSON) format, and thus to generate an OS fingerprint of the randomly generated IP address, wherein the OS fingerprint rule stores Operating Systems (OSs) and TCP/IP field values corresponding to versions of the OSs as attribute-value pairs.