Patent ID: 8261324

Claim:
A method for identifying an unapproved client device seeking access to a secured network, said method comprising: in one or more devices connected directly or indirectly to the secured network, measuring and storing in a database, timing characteristics of an approved client device relative to the secured network, said measuring and storing including computing and storing a clock skew of the approved client device, based on one of multiple TCP timestamps, a rate of Initial Sequence Numbers (ISN), and packet interarrival times; measuring timing characteristics of the unapproved client device, after the unapproved client device has requested access to the network, the timing characteristics include multiple TCP timestamps, ISN buckets, and packet interarrival times; determining a hardware fingerprint of the unapproved device based on the timing characteristic, said determining based on linear regression of the multiple TCP timestamps, linear regression of the ISN bucket, discrete Fourier Transforms of the packet interarrival times, and standard deviation of packet interarrival times; determining a clock skew of the unapproved device by measuring a rate of change of the ISN, and the rate of change of the packet interarrival times; comparing the measured clock skew and the measured hardware fingerprint of the unapproved client device to the timing characteristics, including the clock skew, of the approved client device in order to match the unapproved client device to an approved client device; and granting access to the secured network, if the measured clock skew and the measured hardware fingerprint of the unapproved client device matches the timing characteristics, including the clock skew, of the approved client device.