Client fingerprinting for information system security
Client fingerprints can be used to detect and defend against malware and hacking into information systems more effectively than using IP addresses. A unique client fingerprint can be based on data found in the client's SSL client hello packet. SSL version, cipher suites, and other fields of the packet can be utilized, preferably utilizing individual field values in the order in which they appear in the packet. The ordered values are converted to decimal values, separated by delimiters, and concatenated to form an identifier string. The identifier string may be mapped, preferably by a hash function, to form the client fingerprint. The client fingerprint may be logged, and whitelists and blacklists may be formed using client fingerprints so formed.
1. A computer-implemented method for a database system, comprising:
monitoring packet data traffic on a network connection to the database system, to detect a Client Hello packet (CHP);
processing selected data from the CHP to form an SSL client identifier string, wherein processing the selected data includes:
for each set of fields of the CHP, converting hex values into a corresponding decimal value, selectively inserting a value delimiter between the decimal values, and concatenating the decimal values and the value delimiters in an order in which the values appear in the field, to form a field result string; and
applying a selected hash function to the SSL client identifier string to form an SSL client fingerprint that is based on an order of data in the set of fields.
2. The method of claim 1 , wherein the SSL client identifier string includes field results that are arranged in a sequence based on an order in which the fields are listed in the CHP, and a predetermined field delimiter after each field result string.
3. The method of claim 2 , wherein the selected data fields comprise: an SSL Version field, a cipher suite field, and an extension field.
4. The method of claim 3 , wherein the fields further comprise an elliptic curve field.
5. The method of claim 1 , wherein processing the data further includes inserting a field delimiter after each field in the SSL client identifier string; and concatenating the fields and the field delimiters to form the SSL client identifier string.
6. The method of claim 5 , wherein processing the data further includes inserting a value delimiter after each decimal value within a field of the SSL client identifier string.
7. The method of claim 1 , wherein the selected hash function is an MD5 hash function.
8. The method of claim 1 , wherein processing the extracted data further includes persisting at least one field delimiter in the SSL client identifier string in the absence of data in the CHP for a corresponding field.
9. The method of claim 1 , and further comprising:
receiving a security indication for a specified SSL client fingerprint; and updating the database based on the security indication.
10. The method of claim 1 , and further comprising:
extracting data from the database to form a log of SSL client fingerprints that identify clients that accessed the database system.
11. A non-transitory, computer readable medium storing instructions executable by a processor to cause the processor to realize a client fingerprinting component, including carrying out the operations of:
monitoring packet data traffic on a network connection to the database system, to detect a Client Hello packet (CHP);
processing selected data from the CHP to form an SSL client identifier string, wherein processing the selected data includes:
for each set of fields of the CHP, converting hex values into a corresponding decimal value, selectively inserting a value delimiter between the decimal values, and concatenating the decimal values and the value delimiters in an order in which the values appear in the field, to form a field result string; and
applying a selected hash function to the SSL client identifier string to form an SSL client fingerprint that is based on an order of data in the set of fields.
12. The computer readable medium of claim 11 , wherein the SSL client identifier string includes field results that are arranged in a sequence based on an order in which the fields are listed in the CHP, and a predetermined field delimiter after each field result string.
13. The computer readable medium of claim 12 , wherein selected data fields comprise: an SSL Version field, a cipher suite field, and an extension field.
14. The computer readable medium of claim 13 , wherein the fields further comprise an elliptic curve field.
15. The computer readable medium of claim 11 , wherein processing the extracted data further includes inserting a field delimiter after each field in the SSL client identifier string; and concatenating the fields and the field delimiters to form the SSL client identifier string.
16. A system comprising:
one or more processors;
one or more memory devices communicatively coupled with the one or more processors, at least one of the one or more memory devices comprising instructions that when executed cause at least one processor of the one or more processors to:
monitor packet data traffic sent over a network connection for a Client Hello packet (CHP);
for each set of fields of the CHP,
convert hex values in the CHP into corresponding decimal values,
selectively insert a value delimiter between the decimal values, and
concatenate the decimal values and the value delimiters in an order in which the decimal values and the value delimiters appear in the field, to form an SSL client identifier string; and
apply a selected hash function to the SSL client identifier string to form an SSL client fingerprint that is based on an order of data in the set of fields.
17. The system of claim 16 , wherein the SSL client identifier string includes field results that are arranged in a sequence based on an order in which the fields are listed in the CHP, and a predetermined field delimiter after each field result string.
18. The system of claim 17 , wherein the set of fields comprise: an SSL Version field, a cipher suite field, and an extension field.
19. The system of claim 18 , wherein the set of fields further comprise an elliptic curve field.