Methods for generating client-executable actions through TLS parameters and devices thereof
Methods, non-transitory computer readable media, network traffic manager apparatuses, and systems that assist with generating client-executable actions with TLS parameters includes receiving a request from a client for establishing a TLS connection to a server, wherein the request comprises TLS parameters for the TLS connection. An identity of the client is determined based on the TLS parameters in the request unique to the client. A recommended client-executable action is generated based on the TLS parameters. The recommended client-executable action is an adjustment of a characteristic of a system of the client. The recommended client-executable action is transmitted to the client.
1 . A method for generating client-executable actions for an identified client, the method implemented by a network traffic management system comprising one or more network traffic apparatuses, client devices, or server devices, the method comprising:
receiving a request from a client for establishing a TLS connection to a server, wherein the request comprises TLS parameters for the TLS connection;
determining an identity of the client based on the TLS parameters in the request unique to the client by comparing the TLS parameters in the request to a database with known clients mapped to unique combinations of TLS parameters to identify a matching client in the database with a same combination of TLS parameters;
generating a recommended client-executable action based on the TLS parameters, wherein the recommended client-executable action is an adjustment of a characteristic of a system of the client; and
transmitting the recommended client-executable action to the client.
2 . The method as set forth in claim 1 , further comprising:
retrieving historical activity from a database associated with the identified client, wherein the historical activity comprises historical requests or historical transactions of the identified client; and
determining whether the identified client is a suspicious client based on the historical activity associated with the identified client, wherein the recommended client-executable action is a recommended client-executable security action when the identified client is a suspicious client.
3 . The method as set forth in claim 2 , wherein the recommended client-executable security action comprises changing an encryption policy, altering an encryption algorithm, updating a version of TLS handshake messages.
4 . The method as set forth in claim 1 , wherein the recommended client-executable action comprises recommending directing the request or a subsequent request from the identified client through specific hardware or a different service chain.
5 . The method as set forth in claim 1 , wherein the recommended client-executable action comprises recommending a modification of treatment of a plurality of subsequent requests from the identified client based on a predetermined category, wherein the identified client is classified into the predetermined category prior to generating the recommended client-executable action.
6 . A non-transitory computer readable medium having stored thereon instructions for establishing a connection to a server with a certificate comprising executable code which when executed by one or more processors, causes the processors to:
receive a request from a client for establishing a TLS connection to a server, wherein the request comprises TLS parameters for the TLS connection;
determine an identity of the client based on the TLS parameters in the request unique to the client by comparing the TLS parameters in the request to a database with known clients mapped to unique combinations of TLS parameters to identify a matching client in the database with a same combination of TLS parameters;
generate a recommended client-executable action based on the TLS parameters, wherein the recommended client-executable action is an adjustment of a characteristic of a system of the client; and
transmit the recommended client-executable action to the client.
7 . The medium as set forth in claim 6 , wherein the executable code which when executed by the processors, further causes the processors to:
retrieve historical activity from a database associated with the identified client, wherein the historical activity comprises historical requests or historical transactions of the identified client; and
determine whether the identified client is a suspicious client based on the historical activity associated with the identified client, wherein the recommended client-executable action is a recommended client-executable security action when the identified client is a suspicious client.
8 . The medium as set forth in claim 7 , wherein the recommended client-executable security action comprises changing an encryption policy, altering an encryption algorithm, updating a version of TLS handshake messages.
9 . The medium as set forth in claim 6 , wherein the recommended client-executable action comprises recommending directing the request or a subsequent request from the identified client through specific hardware or a different service chain.
10 . The medium as set forth in claim 6 , wherein the recommended client-executable action comprises recommending a modification of treatment of a plurality of subsequent requests from the identified client based on a predetermined category, wherein the identified client is classified into the predetermined category prior to generating the recommended client-executable action.
11 . A network traffic manager apparatus, comprising memory comprising programmed instructions stored in the memory and one or more processors configured to be capable of executing the programmed instructions stored in the memory to:
receive a request from a client for establishing a TLS connection to a server, wherein the request comprises TLS parameters for the TLS connection;
determine an identity of the client based on the TLS parameters in the request unique to the client by comparing the TLS parameters in the request to a database with known clients mapped to unique combinations of TLS parameters to identify a matching client in the database with a same combination of TLS parameters;
generate a recommended client-executable action based on the TLS parameters, wherein the recommended client-executable action is an adjustment of a characteristic of a system of the client; and
transmit the recommended client-executable action to the client.
12 . The device as set forth in claim 11 , wherein the one or more processors are further configured to be capable of executing the programmed instructions stored in the memory to:
retrieve historical activity from a database associated with the identified client, wherein the historical activity comprises historical requests or historical transactions of the identified client; and
determine whether the identified client is a suspicious client based on the historical activity associated with the identified client, wherein the recommended client-executable action is a recommended client-executable security action when the identified client is a suspicious client.
13 . The device as set forth in claim 12 , wherein the recommended client-executable security action comprises changing an encryption policy, altering an encryption algorithm, updating a version of TLS handshake messages.
14 . The device as set forth in claim 11 , wherein the recommended client-executable action comprises recommending directing the request or a subsequent request from the identified client through specific hardware or a different service chain.
15 . The device as set forth in claim 11 , wherein the recommended client-executable action comprises recommending a modification of treatment of a plurality of subsequent requests from the identified client based on a predetermined category, wherein the identified client is classified into the predetermined category prior to generating the recommended client-executable action.
16 . A network traffic management system, comprising one or more traffic management apparatuses, client devices, or server devices, the network traffic management system comprising memory comprising programmed instructions stored thereon and one or more processors configured to be capable of executing the stored programmed instructions to:
receive a request from a client for establishing a TLS connection to a server, wherein the request comprises TLS parameters for the TLS connection;
determine an identity of the client based on the TLS parameters in the request unique to the client by comparing the TLS parameters in the request to a database with known clients mapped to unique combinations of TLS parameters to identify a matching client in the database with a same combination of TLS parameters;
generate a recommended client-executable action based on the TLS parameters, wherein the recommended client-executable action is an adjustment of a characteristic of a system of the client; and
transmit the recommended client-executable action to the client.
17 . The network traffic management system of claim 16 , wherein the one or more processors are further configured to be capable of executing the programmed instructions stored in the memory to:
retrieve historical activity from a database associated with the identified client, wherein the historical activity comprises historical requests or historical transactions of the identified client; and
determine whether the identified client is a suspicious client based on the historical activity associated with the identified client, wherein the recommended client-executable action is a recommended client-executable security action when the identified client is a suspicious client.
18 . The network traffic management system of claim 17 , wherein the recommended client-executable security action comprises changing an encryption policy, altering an encryption algorithm, updating a version of TLS handshake messages.
19 . The network traffic management system of claim 16 , wherein the recommended client-executable action comprises recommending directing the request or a subsequent request from the identified client through specific hardware or a different service chain.
20 . The network traffic management system of claim 16 , wherein the recommended client-executable action comprises recommending a modification of treatment of a plurality of subsequent requests from the identified client based on a predetermined category, wherein the identified client is classified into the predetermined category prior to generating the recommended client-executable action.