In the network access authentication system, accurate identification of the identity and type of access terminal is the basis for fine-tuning access control. Traditional end recognition relies mainly on MAC addresses and IP addresses, but MAC addresses can be forged, IP addresses can change dynamically, and terminals cannot be accurately identified by using only these two types of information. The device fingerprinting technology allows the unique identifier of the equipment to be more accurate and reliable.
Why do you need device fingerprinting?
Traditional end-identification methods have clear limitations: one is that the MAC address can be forged and the attackers can use the MAC address as an authorized terminal access network; the other is that the IP address can change dynamically, with the terminal ' s IP address in the DHCP environment may change frequently and not be used as a stable end sign; the third is that there is no distinction between the end type and whether it is PC, mobile phone, printer or camera that cannot be known by MAC and IP alone to allow for different access strategies according to the end type; and the fourth is that there is no detection of terminal changes, where the end card has been replaced, system re-installed and user replaced, traditional means are undetectable, which could lead to ineffective access strategies. The device fingerprinting technology can address the limitations of traditional identification by collecting multiple feature information about the end (hardware features, software features, network features, behavioural characteristics, etc.) and building the only marking of the equipment: first, it is difficult to forge the device fingerprints and their combination makes them extremely expensive; second, the equipment fingerprint is stable and reliable, and the device fingerprint can still identify the same terminal even if IP or MAC changes; third, it can distinguish between end types, which are determined according to the profile of the device, and different access strategies; fourth, it can detect a change in the end, and when key end characteristics change, the system can sense and reassess access strategies. For enterprises, the equipment fingerprinting technology is a basis for fine-tuning and intelligent network access, especially in the context of high access to PACT and increasing complexity of end types.
Elements of a device fingerprint
The device fingerprint is composed of multiple feature combinations of end-of-pipe features, usually consisting of the following categories: first, hardware characteristics, including CPU type and serial numbers, main plate serial number, hard disk serial number, memory size, Internet card MAC address, BIOS information, video type, external information (USB equipment, printer, camera etc.), hardware features are relatively stable, difficult to forge, and are a core element of the device ' s fingerprints; The second is the features of the software, including types and versions of operating systems, time for installation of operating systems, hostnames, user names, installed lists of software, running process lists, service configurations, browser types and versions, browser plugins, system language and time zones, etc., which reflect end-use status and security; the third is the characteristics of the network, including IP addresses, MAC addresses, gateways, DNS servers, open ports, network protocol stack features (TTL values, TCP window size, MSCs, etc.), network behavioural features (communication frequency, traffic mode, common target address, etc.) that reflect terminal location and communication behaviour; The fourth is behavioural features, including terminal access times, usage habits, common applications, input habits (typographic speed, mouse-mobile patterns, etc.), which reflect end user and use patterns for unusual behavior detection."Multi-specific weighted integration") The system can produce a unique device fingerprint ID for each endpoint through multi-characterizations, and the system can still identify the same endpoint by other features (e.g. IP change). It is important to note that the signature collection of the device's fingerprints needs to be carried out in accordance with legal compliance, that users should be informed of the scope and use of information collected and that user privacy should be protected.
Terminal type identification and classification
The types of terminals that are common include PCs and notebooks, including desktop terminals for Windows, Marcos, Linux, which are normally functionally complete, support the installation of proxy software, enable comprehensive compliance checks, and mobile devices, including smart phones (Android, iOS), flatboard computers, etc., which are portable, have a diverse viewing and have greater security control difficulties; Third are the network terminals, including printers, cameras, IP phones, smart televisions, typographical devices, industrial sensors, which are usually single functions, operating systems are old, no proxy software can be installed and security capabilities are weak; fourthly, network equipment, including switches, routers, wireless APs, firewalls, etc., which are network infrastructure requiring special access strategies; and fifthly virtual terminals, including virtual machines, cloud desktops, containers, etc., which have characteristics different from physical terminals and require special identification and control methods. The method of identifying the end type usually includes: first, matching the characteristics of the terminal with the known end type ' s identity library based on signature matches; second, mechanical learning based on automatic classification of the end characteristics through trained classification models; and third, protocol-based analysis to determine the end type by analysing the network communication protocols and flow features of the terminal (e.g. printers typically use SNMPs and printing protocols, cameras often use RTSP and ONVIF protocols). Terminal type identification is the basis for fine-tuning access control: different types of terminals use different modes of access (PC 802.1X+ proxy, PNT + no agent), different compliance inspection strategies (PC check patches and poisons, PIF check solid version and open port), different network access rights (PC access to office networks, PIN equipment limited to dedicated VLAN). Accurate end type identification allows more precision and effectiveness of access strategies.
The way the device's fingerprints are collected
The device fingerprints are collected in two main ways: proxy and non-agent. Proxy is the installation of agent software (Agent) at terminals, which collects information on terminal features such as hardware, software, networks, behaviour etc. and sends it to network access systems. Proxy has the advantage of being comprehensive and accurate in gathering information that can capture detailed information within operating systems (e.g. process lists, software lists, registry forms, etc.), with high accuracy of fingerprinting; the disadvantage is that software needs to be installed at the end, deployment and maintenance costs are higher, and no use is possible for terminals that cannot install agents (e.g., physical networking equipment, printers, cameras). No proxy means to collect terminal feature information without the installation of proxy software, including through network scanning, traffic analysis, protocol query. Specific non-agent methods include: one active scanning, system sending detection messages to terminals (e.g. ICMP, TCP SYN, SNMM, WMI, SSH etc.) and obtaining signature information based on end response; two passive listening, system accessing terminal network traffic via port mirrors or network partitioners (TAP), and tracking end message by analysing the Protocol characteristics of flow, communication modes, data package features, etc. Third, protocols are solved and systems are dissecting the network protocols of terminals (such as DHCP, ARP, LLDP, CDP, mDNS, etc.) to extract feature information from the protocol messages. The advantage of non-agent means is that they deploy simple, do not require installation of software at the end, all types of terminals; the disadvantage is that information collection is relatively limited, detailed information within the operating system cannot be obtained, and the accuracy of the device's fingerprints is lower than proxy."Proxy + No Proxy", for terminals that support the installation of agents such as PC and notebooks, full-scale device fingerprints are collected by proxy; for devices connected to the network and those which cannot be installed by proxy, base equipment fingerprints are collected by non-agent means. The combination allows for a balance between precision and coverage, which is the dominant way in which business network access deployment is currently being conducted.
A device fingerprinting application
(a) The device fingerprint technology has multiple applications in network access: first, end identification, based on the equipment fingerprint identification terminal identity, only known and authorized terminals can access the network to prevent unauthorized terminal access; second, end compliance checks, based on software features and configuration information for the device fingerprints, checking that the end is in line with a safety baseline (whether patches are filled, poisons are loaded, non-compliance software is available, etc.), and non-compliant terminals are isolated or denied access; Third, an abnormal terminal test, whereby when the end-of-pipe device fingerprint changes (e.g. sudden change of address for MAC, non-reform of hardware features and registration, emergence of unknown new terminals) the system automatically alerts and isolates the endpoint, possibly tampered or falsified; fourth, a final behavioural analysis, which analyses end usage habits and communications behaviour based on the equipment fingerprint behaviour characteristics, and identifies unusual behaviour (e.g. a terminal suddenly transmits data in large quantities during irregular periods, a terminal tries to access unauthorized resources); Fifthly, asset inventory and management, which automatically identifies and recognizes all terminals in the network based on fingerprinting of equipment, generates a complete list of assets including end types, manufacturers, models, operating systems, access locations, users, etc., to resolve enterprises"I don't know what the terminal is on the network."Issue VI: Control of the PIN terminal, white list management and microsegregation of the PIN terminals based on type and state of the PID Cable, preventing PNT from being invaded and becoming a springboard for attacking the inner grid; VII is supported by zero trust structures, and device fingerprints are in zero confidence structures"Equipment trust assessment"The device's fingerprinting technology is used to allow access to the network."Account-based authentication"Upgrade To"Ongoing assessment based on end-identity and state"It is an important basis for achieving a zero-confidence security architecture.
Challenges and trends in fingerprinting of equipment
While there are many advantages to the device fingerprinting technology, there are challenges: first, privacy protection, equipment fingerprints collect a large amount of end-specific information that involves user privacy and needs to be conducted in a context of legal compliance, the range and use of information collected by users should be informed, and measures such as data encryption and access control should be taken to protect user privacy; second, characteristics change, end-characterizations may vary over time (e.g. hardware replacement, reassembly systems, software updating), and equipment fingerprints need to be able to adapt to these changes, avoiding miscalculation of endpoints as unknown terminals because of their changing features; Third, the counterfeiting of confrontations, with the spread of fingerprinting techniques and the fact that the attackers are also studying the methods of forgery of fingerprints in equipment, requires continuous upgrading of the detection and counter-opposition capabilities of the device; fourth, the performance costs, the need to collect and match the device's fingerprints, which require certain computing and network resources, and the need to ensure system performance and scalability in large-scale end-use environments; fifth, standardization, with current equipment fingerprint profiling and collection methods lacking uniform standards, and different manufacturers' lack of interoperable fingerprinting and need to promote industry standardization. Trends in equipment fingerprinting technology include: first, the application of artificial intelligence and machine learning to enhance the accuracy of device fingerprints and their detection by mechanical learning algorithms, automatically detecting unknown terminals and anomalies; second, the increase in passive non-agentized collection, with increasing demand for non-agentized methods as the number of object network terminals increases and the capacity for passive flow analysis and protocol resolution will grow; third, the depth of zero trust structures, with device fingerprints being used as core technology for equipment confidence assessment in zero trust structures, which will be integrated into the depth of zero trust components such as identification authentication, application authorization, data protection; The fourth is the development of a fingerprinting bank for cloud-end equipment, which will enhance the ability to identify unknown and malicious terminals through the use of equipment fingerprint databases and threat intelligence shared on cloud ends; the fifth is the application of privacy protection techniques that enable the collection and analysis of fingerprints from equipment to protect users’ privacy, including through federal learning and differential privacy. The device fingerprint technology is constantly developing and improving, and will play an increasingly important role in business network security and zero trust structures.
The device fingerprint and terminal identification technology is one of the core technologies of the network access authentication system, which addresses the limitations of traditional end-identification by collecting multiple features of the terminal, such as hardware, software, networks, behaviour, etc. Based on the equipment fingerprint, the network access system can achieve a variety of applications such as end-identifying, compliance check, unusual detection, behavioural analysis, asset inventory, and material networking control, which are fundamental to precision, intelligent network access and an important support for zero trust security structures. While equipment fingerprinting is challenged by privacy protection, identity changes, and counterfeit confrontations, with the development of technologies such as artificial intelligence, passive capture, zero trust integration, the device fingerprinting technology will continue to improve and play an increasingly important role in enterprise network security. For businesses, choosing a network access certification system that has powerful equipment fingerprint capabilities is an important step in improving inner-network security control and responding to increasingly complex end-of-life environments.