TLS Handshake Signature Detection for Network Client Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security measures, such as antivirus programs and firewalls, often fail to identify the source of malicious communications in computing networks, leaving networks unprotected and unable to differentiate between first-party and third-party data requests, which can lead to incorrect threat assessments and inadequate security.
Innovation Solution
A system and method that uses Transport Layer Security (TLS) handshake data to filter out known cipher suites and curves, building a data string or hash to uniquely identify network clients or applications, thereby accurately classifying data requests as first or third party, even through proxy or VPN obfuscation, and configuring counter values for domain lists to enhance network security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If TLS handshake data is analyzed to identify network clients, then source identification accuracy is improved, but computational overhead increases
Solution Approach 1:
The patent extracts only the essential identifying features from TLS handshake data - specifically the TLS version and cipher suite combinations - while filtering out unnecessary information. This extraction approach enables accurate client identification without processing the entire handshake data, thereby reducing computational overhead while maintaining identification precision.
Solution Approach 2:
The patent transforms the complex TLS handshake data into simplified parameters by creating a data string based on specific characteristics (TLS version, cipher suites) and generating hash values. This parameter transformation converts detailed cryptographic information into compact identifiers that maintain discrimination capability while significantly reducing the data volume requiring computational processing.
2Measurement precision
If comprehensive TLS handshake analysis is performed, then client identification accuracy is improved, but network latency increases
Solution Approach 1:
The patent performs preliminary analysis of TLS handshake data by pre-defining the specific parameters to extract (TLS version, cipher suite combinations) and preparing the hashing mechanism in advance. This preliminary preparation allows the system to quickly process handshake data without performing comprehensive analysis, thereby reducing latency while maintaining identification accuracy.
Solution Approach 2:
The patent applies partial action by selectively analyzing only certain portions of the TLS handshake data - specifically focusing on TLS version and cipher suite information - rather than performing complete handshake analysis. This partial analysis approach provides sufficient information for accurate client identification while minimizing the time required for processing.
3Reliability
If network monitoring is enhanced to identify all data sources, then security protection is improved, but false threat assessments increase
Solution Approach 1:
The patent segments network traffic into first-party and third-party categories based on domain relationships, and further segments third-party traffic into known-safe and unknown/potential-threat categories. This multi-level segmentation allows the system to apply different security policies to different traffic types, improving overall security protection while reducing false alarms by contextualizing third-party requests rather than treating all such traffic as threats.
Data Source
AI summary
A method for uniquely identifying a network client or application based on a transport layer security (TLS) handshake includes: storing, in a computing device, a list of cipher suites and a list of supported curves; intercepting, by the computing device, a data packet transmitted to as part of the TLS handshake; filtering, by the computing device, cipher suites included in the list of cipher suites from the data packet; filtering, by the computing device, supported curves included in the list of supported curves from the data packet; building, by the computing device, a data string using data in the data packet remaining after filtering; generating, by the computing device, a signature value by hashing the data string; and identifying, by the computing device, a network client or application using the generated signature value.