IP Library Granted Patent US 11,785,046
Granted Patent B1
US 11,785,046 · App. 16/880,114 · Granted Oct 10, 2023

System and method for maintaining internet anonymity via client fingerprint

Inventor: Shawn Bracken (San Francisco, CA)
Assignee: Plaid Inc.
H04L63/166H04L41/0813H04L63/0428H04L63/10H04L67/01
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 11,785,046
App. No.
16/880,114
Granted
Oct 10, 2023
Kind
B1
Abstract

A system and method for altering client fingerprint that includes editing data components of network communication from a client device to a server, which comprises editing network protocol data from the client during negotiation of a cryptographic protocol; selectively enabling access to library components specified in the edited client network protocol data; and sending a client communication to the server using the edited client network protocol data.

Claims (31)

1. A method comprising:

prior to establishing encrypted communication using a cryptographic protocol between a client and a server:

selecting a targeted device,

editing a set of data components of a client hello message from a client device to the server during negotiation of a cryptographic protocol, wherein the set of data components are edited from a format of the client device to a targeted client configuration of data components of the targeted device, and

selectively enabling access to library components specified in the edited set of data components of the client hello message; and

performing cryptographic protocol negotiation with the server using the edited set of data components of the client hello message, wherein ongoing communication with the server conforms to negotiated cryptographic communication using the library components to facilitate translation from data communications of the client to a format expected at the server, wherein the edited set of data components establishes a client fingerprint for the targeted device.

2. The method of claim 1 , wherein the cryptographic protocol is a transport layer security (TLS) protocol.

3. The method of claim 2 , wherein editing the set of data components of the client hello message from the client device comprises replacing the set of data components of the client hello message.

4. The method of claim 3 , further comprising implementing cryptographic encryption of the data communication of the client according to the set of data components using the library components.

5. The method of claim 3 , wherein replacing the set of data components of the client hello message comprises replacing a cipher suit specified in the client hello message to a second cipher suite of the targeted device.

6. The method of claim 5 , wherein selectively enabling access to library components comprises enabling access to the second cipher suite and when sending the data communications of the client to the server, cryptographically securing client communication using a library of the second cipher suite.

7. The method of claim 3 , wherein replacing the set of data components of the client hello message comprises altering a list of cipher suites, altering a list of compression methods, altering a list of client point formats, altering a list of client supported application protocols, and altering a list of client supported extensions.

8. The method of claim 7 , wherein selectively enabling access to library components comprises enabling access to a library for a cipher suite, enabling access to a library for compression method, enabling access to a library for a client point format, enabling access to a library for a client supported application protocol, and enabling access to a library for a client supported extension.

9. The method of claim 1 , wherein editing the set of data components of the client hello message from the client device is performed through a library accessible on a computing device of the client.

10. The method of claim 1 , further comprising configuring a LD_PRELOAD module for the client; and wherein editing the data components of the client hello message from the client device is performed in response to execution of the LD_PRELOAD module.

11. The method of claim 1 , further comprising receiving the client hello message from the client at a proxy server that is a distinct computing device from the client device.

12. The method of claim 1 , further comprising periodically altering a target client device.

13. The method of claim 1 , wherein editing the set of data components comprises modifying to a synthetic configuration of data components.

14. A method comprising:

receiving client communication from a client device including a client hello message from the client device during handshake negotiation of a cryptographic protocol with a server;

prior to establishing encrypted communication using the cryptographic protocol, modifying a set of data components of the client hello message to a target client configuration of data components thereby generating a modified client hello message wherein the target client configuration of data components modifies a client fingerprint of the client device to a client fingerprint of a targeted device;

finalizing handshake negotiation of the cryptographic protocol with the modified client hello message and establishing cryptographically secured communication with the server;

selectively enabling access to library components specified in the target client configuration of data components; and

sending communication to the server by implementing cryptographic encryption of the client communication using the library components of the target client configuration of data components.

15. The method of claim 14 , wherein the cryptographic protocol is a transport layer security (TLS) protocol.

16. A system comprising:

a non-transitory computer-readable medium storing instructions that, when executed by one or more computer processors, cause the one or more computer processors to:

prior to establishing encrypted communication using a cryptographic protocol between a client and a server: select a targeted device, edit a set of data components of a client hello message from a client device to a server during negotiation of a cryptographic protocol, wherein the set of data components are edited from a format of the client device to a targeted client configuration of data components of the targeted device, and selectively enable access to library components specified in an edited set of data components of a client hello message; and

perform cryptographic protocol negotiation with the server using the edited set of data components of the client hello message, wherein ongoing communication with the server conforms to negotiated cryptographic communication using the library components to facilitate translation from data communications of the client to a format expected at the server, wherein the edited set of data components establishes a client fingerprint for the targeted device.

17. The system of claim 16 , wherein the cryptographic protocol is a transport layer security (TLS) protocol.

18. The system of claim 16 , further comprising implementing cryptographic encryption of the data communications of the client according to the set of packet components using the library components.

Assignments (2)
SECURITY INTEREST Recorded Jul 15, 2020
From: PLAID INC.; QUOVO, INC.; RAMBLER TRELLIS LLC
To: SILICON VALLEY BANK
Reel/Frame 053211/0898 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded May 21, 2020
From: BRACKEN, SHAWN
To: PLAID INC.
Reel/Frame 052724/0190 →
Continuity (1)
Provisional Application 62850890 · May 21, 2019