Method and system for first party and third party detection and for the occlusion of network device TLS signatures

摘要

A method for uniquely identifying a network client or application based on a transport layer security (TLS) handshake includes: storing, in a computing device, a list of cipher suites and a list of supported curves; intercepting, by the computing device, a data packet transmitted to as part of the TLS handshake; filtering, by the computing device, cipher suites included in the list of cipher suites from the data packet; filtering, by the computing device, supported curves included in the list of supported curves from the data packet; building, by the computing device, a data string using data in the data packet remaining after filtering; generating, by the computing device, a signature value by hashing the data string; and identifying, by the computing device, a network client or application using the generated signature value.