Method and system for configurable device fingerprinting
Methods and systems for configurable device fingerprinting and/or achieving communications with enhanced security are disclosed herein. In one example embodiment, a method of configurable device fingerprinting includes storing, at a server, first information regarding one or more selected system attributes, and further includes receiving, at the server, a first signal requesting that a first client device be registered and including system information pertaining to the first client device. Also, the method includes extracting, from the system information, relevant portions of the system information corresponding to the one or more selected system attributes, where the server determines a fingerprint of the first client device based at least in part the relevant portions. Additionally, the method includes generating a first identifier pertaining to the first client device at least indirectly in response to the extracting of the relevant portions, and sending the first identifier for receipt by the first client device.
1. A method of configurable device fingerprinting, the method comprising:
providing, by a server, a user interface comprising a list of selectable system attributes of a first client device that includes:
a basic input/output system universal unique identifier (biosUuid) attribute;
an operating system product identification number (osProductId) attribute;
a system serial number;
a hard disk serial number;
a media access control (MAC) address;
an internet protocol (IP) address; and
a hostname;
rendering the list of selectable system attributes on the user interface;
receiving, from a second device via the user interface, a selection of at least three of the selectable system attributes to generate first information including respective values corresponding to the at least three of the selectable system attributes that correspond to the first client device,
wherein the at least three of the selected system attributes includes:
the biosUuid;
the osProductId; and
at least one of:
the system serial number;
the hard disk serial number;
the MAC address;
the IP address; or
the hostname;
storing, at the server, the first information;
receiving, at the server, a first signal requesting that a first client device be registered, the first signal including system information corresponding to the first client device;
determining a fingerprint of the first client device based on a matching of at least a portion of the system information with the stored first information;
generating a first identifier corresponding to the first client device based at least in part on the portion of the system information that matched the stored first information;
storing, by the server, the fingerprint and corresponding first identifier;
sending, by the server, the first identifier to the first client device;
receiving, by the server, a first token request that includes the first identifier and the system information;
verifying, by the server, the first token request by comparing the received first identifier and the received system information with the stored fingerprint and the stored first identifier; and
in response to the verification:
determining that the first token request was sent by the first client; and
sending a token to the first client,
wherein subsequent communications between the first client and the server are secured using the token.
2. The method of claim 1 , wherein the server is a security agent backend server, wherein the user interface is a security operations center (SOC) user interface, and wherein the first signal is received by the security agent backend server at least indirectly from security agent software operating on the first client device.
3. The method of claim 1 ,
wherein the first information is received from the user interface subsequent to the user interface receiving at least one input from a security operations center (SOC) user specifying the one or more selected system attributes, and
wherein the first identifier is a unique identifier, and wherein the unique identifier pertains to a security agent operating on the first client device.
4. The method of claim 1 , further comprising:
receiving at the server a token renewal request signal after an expiration of a time limit associated with the first token, following the receipt by the first client device of the first token.
5. The method of claim 4 , further comprising: after the token renewal request signal is received,
determining whether a change has occurred with respect to the system information pertaining to the first client device, such that either the matching portion or the fingerprint is no longer consistent with the changed system information.
6. The method of claim 5 , further comprising, when it is determined that the change has occurred such that either the matching portion or the fingerprint is no longer consistent with the changed system information:
generating a second identifier pertaining to the first client device at least indirectly in response to extracting additional portions of the changed system information that match the stored first information;
generating and sending, for receipt by the first client device, a second token, in response to the receiving of a second token request signal, and
linking the second identifier with the first identifier.
7. The method of claim 5 wherein, when it is determined that the change has not occurred, the first token is renewed.
8. The method of claim 1 , further comprising:
receiving, at the server, an additional signal concerning an instruction to replace the one or more selected system attributes with one or more modified selected system attributes;
receiving at the server a token renewal request signal after an expiration of a time limit associated with the first token,
extracting additional portions of the system information, corresponding to the one or more modified selected system attributes;
generating a second identifier pertaining to the first client device at least indirectly based upon the extracted additional portions of the system information; and
linking the second identifier with the first identifier.
9. A system comprising:
one or more processors;
one or more machine-readable, non-transitory storage mediums that include instructions configured to cause the one or more processors to perform operations including:
providing, by a server, a user interface comprising a list of selectable system attributes of a first client device that includes:
a basic input/output system universal unique identifier (biosUuid) attribute;
an operating system product identification number (osProductId) attribute;
a system serial number;
a hard disk serial number;
a media access control (MAC) address;
an internet protocol (IP) address; and
a hostname;
rendering the list of selectable system attributes on the user interface;
receiving, from a second device via the user interface, a selection of at least three of the selectable system attributes to generate first information including respective values corresponding to the at least three of the selectable system attributes that correspond to the first client device,
wherein the at least three of the selected system attributes includes:
the biosUuid;
the osProductId; and
at least one of:
the system serial number;
the hard disk serial number;
the MAC address;
the IP address; or
the hostname;
storing, at the server, the first information;
receiving, at the server, a first signal requesting that a first client device be registered, the first signal including system information corresponding to the first client device;
determining a fingerprint of the first client device based on a matching of at least a portion of the system information with the stored first information;
generating a first identifier corresponding to the first client device based at least in part on the portion of the system information that matched the stored first information;
storing, by the server, the fingerprint and corresponding first identifier;
sending, by the server, the first identifier to the first client device;
receiving, by the server, a first token request that includes the first identifier and the system information;
verifying, by the server, the first token request by comparing the received first identifier and the received system information with the stored fingerprint and the stored first identifier; and
in response to the verification:
determining that the first token request was sent by the first client; and
sending a token to the first client,
wherein subsequent communications between the first client and the server are secured using the token.
10. The system of claim 9 , wherein the server is a security agent backend server, wherein the user interface is a security operations center (SOC) user interface, and wherein the first signal is received by the security agent backend server at least indirectly from security agent software operating on the first client device.
11. The system of claim 9 , wherein the first information is received from the user interface subsequent to the user interface receiving at least one input from a security operations center (SOC) user specifying the one or more selected system attributes, and wherein the first identifier is a unique identifier, and wherein the unique identifier pertains to a security agent operating on the first client device.
12. The system of claim 9 wherein the instructions are further configured to cause the one or more processors to perform operations including:
receiving at the server a token renewal request signal after an expiration of a time limit associated with the first token, following the receipt by the first client device of the first token.
13. The system of claim 12 wherein the instructions are further configured to cause the one or more processors to perform operations including:
after the token renewal request signal is received, determining whether a change has occurred with respect to the system information pertaining to the first client device, such that either the matching portion or the fingerprint is no longer consistent with the changed system information.
14. The system of claim 12 wherein when it is determined that the change has occurred such that either the matching portion or the fingerprint is no longer consistent with the changed system information, the instructions are further configured to cause the one or more processors to perform operations including:
generating a second identifier pertaining to the first client device at least indirectly in response to extracting additional portions of the changed system information that match the stored first information;
generating and sending, for receipt by the first client device, a second token, in response to the receiving of a second token request signal, and
linking the second identifier with the first identifier.
15. A non-transitory computer-program product tangibly embodied in a machine-readable non-transitory storage medium that includes instructions configured to cause one or more processors to perform operations including:
providing, by a server, a user interface comprising a list of selectable system attributes of a first client device that includes:
a basic input/output system universal unique identifier (biosUuid) attribute;
an operating system product identification number (osProductId) attribute;
a system serial number;
a hard disk serial number;
a media access control (MAC) address;
an internet protocol (IP) address; and
a hostname:
rendering the list of selectable system attributes on the user interface;
receiving, from a second device via the user interface, a selection of at least three of the selectable system attributes to generate first information including respective values corresponding to the at least three of the selectable system attributes that correspond to the first client device,
wherein the at least three of the selected system attributes includes:
the biosUuid;
the osProductId; and
at least one of:
the system serial number;
the hard disk serial number;
the MAC address;
the IP address; or
the hostname;
storing, at the server, the first information;
receiving, at the server, a first signal requesting that a first client device be registered, the first signal including system information corresponding to the first client device;
determining a fingerprint of the first client device based on a matching of at least a portion of the system information with the stored first information;
generating a first identifier corresponding to the first client device based at least in part on the portion of the system information that matched the stored first information;
storing, by the server, the fingerprint and corresponding first identifier;
sending, by the server, the first identifier to the first client device;
receiving, by the server, a first token request that includes the first identifier and the system information;
verifying, by the server, the first token request by comparing the received first identifier and the received system information with the stored fingerprint and the stored first identifier; and
in response to the verification:
determining that the first token request was sent by the first client; and
sending a token to the first client,
wherein subsequent communications between the first client and the server are secured using the token.
16. The computer program product of claim 15 , wherein the server is a security agent backend server, wherein the user interface is a security operations center (SOC) user interface, and wherein the first signal is received by the security agent backend server at least indirectly from security agent software operating on the first client device.
17. The computer program product of claim 15 , wherein the first information is received from the user interface subsequent to the user interface receiving at least one input from a security operations center (SOC) user specifying the one or more selected system attributes, and
wherein the first identifier is a unique identifier, and wherein the unique identifier pertains to a security agent operating on the first client device.
18. The computer program product of claim 15 wherein the instructions are further configured to cause the one or more processors to perform operations including:
receiving at the server a token renewal request signal after an expiration of a time limit associated with the first token, following the receipt by the first client device of the first token.
19. The computer program product of claim 15 wherein the instructions are further configured to cause the one or more processors to perform operations including:
after the token renewal request signal is received, determining whether a change has occurred with respect to the system information pertaining to the first client device, such that either the matching portion or the fingerprint is longer consistent with the changed system information.