Security for devices connected to a network

Patent metadata

Field	Value
Publication number	US-10460103-B2
Application number	US-201615270344-A
Country	US
Kind code	B2
Filing date	Sep 20, 2016
Priority date	Sep 20, 2016
Publication date	Oct 29, 2019
Grant date	Oct 29, 2019

Abstract

According to one embodiment of the present invention, a system provides security for a device and includes at least one processor. The system monitors a plurality of networked devices for a security risk. Each networked device is associated with a corresponding security risk tolerance. In response to a monitored security risk for one or more of the plurality of networked devices exceeding the corresponding risk tolerance, a network service is initiated to perform one or more actions on each of the one or more networked devices to alleviate the associated security risk. Embodiments of the present invention further include a method and computer program product for providing security to a device in substantially the same manner described above.

First claim

What is claimed is:

1. A system of providing security for a device comprising:
at least one hardware processor configured to:
monitor a plurality of networked devices for a security risk, wherein each networked device is associated with a corresponding security risk tolerance for initiating actions to alleviate the security risk and a corresponding remediation risk tolerance indicating a risk level associated with performance of the actions to alleviate the security risk on that networked device;
determine the risk level associated with performing the actions on the plurality of networked devices based on outcomes of prior performance of the actions to alleviate security risks, wherein the risk level associated with performing the actions on the plurality of networked devices is further based on a trust level of a source providing the actions, and wherein a greater trust level of the source produces a lower risk level relative to the risk level produced from a lower trust level of the source; and
in response to a monitored security risk for one or more of the plurality of networked devices exceeding the corresponding security risk tolerance:
determine one or more actions with a risk level from performance satisfying the corresponding remediation risk tolerance for each of the one or more networked devices; and
initiate at the system a network service provided to the one or more networked devices to perform the determined one or more actions on each of the one or more networked devices to alleviate the monitored security risk.

2. The system of claim 1 , wherein the determined one or more actions include one or more from a group of remediating the monitored security risk, and quarantining the one or more networked devices with the monitored security risk exceeding the corresponding security risk tolerance.

3. The system of claim 1 , wherein the security risk is based on one or more from a group of:
readings for a networked device outside of a defined number of standard deviations;
readings for a networked device outside of an operating range for that networked device; and
an external condition outside of a reference range.

4. The system of claim 1 , wherein the at least one hardware processor is further configured to:
consolidate data from the plurality of networked devices, and use the consolidated data to identify the networked devices with a security risk exceeding the corresponding security risk tolerance.

5. A computer program product for providing security for a device from a security system, the computer program product comprising a computer readable storage medium having computer readable program code embodied therewith, the computer readable program code executable by at least one processor of the security system to cause the at least one processor to:
monitor a plurality of networked devices for a security risk, wherein each networked device is associated with a corresponding security risk tolerance for initiating actions to alleviate the security risk and a corresponding remediation risk tolerance indicating a risk level associated with performance of the actions to alleviate the security risk on that networked device;
determine the risk level associated with performing the actions on the plurality of networked devices based on outcomes of prior performance of the actions to alleviate security risks, wherein the risk level associated with performing the actions on the plurality of networked devices is further based on a trust level of a source providing the actions, and wherein a greater trust level of the source produces a lower risk level relative to the risk level produced from a lower trust level of the source; and
in response to a monitored security risk for one or more of the plurality of networked devices exceeding the corresponding security risk tolerance:
determine one or more actions with a risk level from performance satisfying the corresponding remediation risk tolerance for each of the one or more networked devices; and
initiate at the security system a network service provided to the one or more networked devices to perform the determined one or more actions on each of the one or more networked devices to alleviate the monitored security risk.

6. The computer program product of claim 5 , wherein the security risk includes one or more from a group of:
a probability of an incident based on analysis of other similar devices; and
a cost of utilizing compromised data.

7. The computer program product of claim 5 , wherein at least one of the plurality of networked devices includes an additional hardware module to monitor for the security risk.

8. The computer program product of claim 5 , wherein the determined one or more actions include one or more from a group of remediating the monitored security risk, and quarantining the one or more networked devices with the monitored security risk exceeding the corresponding security risk tolerance.

9. The computer program product of claim 8 , wherein the computer readable program code is further configured to cause the at least one processor to:
evaluate and change each quarantined device to alleviate the monitored security risk; and
return each changed quarantined device to the network to resume operation.

10. The computer program product of claim 5 , wherein the security risk is based on one or more from a group of:
readings for a networked device outside of a defined number of standard deviations;
readings for a networked device outside of an operating range for that networked device; and
an external condition outside of a reference range.

11. The computer program product of claim 5 , wherein the computer readable program code is further configured to cause the at least one processor to:
consolidate data from other networked devices similar to a networked device of a user, and use the consolidated data to identify the networked devices with a security risk exceeding the corresponding security risk tolerance within a domain of the user.

12. The computer program product of claim 5 , wherein the computer readable program code is further configured to cause the at least one processor to:
consolidate data from each of the plurality of networked devices, and use the consolidated data to identify the networked devices with a security risk exceeding the corresponding security risk tolerance.

13. The system of claim 1 , wherein the security risk includes one or more from a group of:
a probability of an incident based on analysis of other similar devices; and
a cost of utilizing compromised data.

14. The system of claim 1 , wherein at least one of the plurality of networked devices includes an additional hardware module to monitor for the security risk.

15. The system of claim 2 , wherein the at least one hardware processor is further configured to:
evaluate and change each quarantined device to alleviate the monitored security risk; and
return each changed quarantined device to the network to resume operation.

16. The system of claim 1 , wherein the at least one hardware processor is further configured to:
consolidate data from other networked devices similar to a networked device of a user, and use the consolidated data to identify the networked devices with a security risk exceeding the corresponding security risk tolerance within a domain of the user.

Assignees

• IBM

Inventors

• Bender Michael
• Childress Rhonda L
• Dickenson Marc A
• Fleischman Thomas J
• Hahn Timothy J

Classifications

• H04W4/70

  Services for machine-to-machine communication [M2M] or machine type communication [MTC] · CPC title

• H04L63/1433

  Vulnerability analysis · CPC title

• G06F2221/031

  Protect user input by software means · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• G06F21/554 Primary

  involving event detection and direct action · CPC title