System and method for providing secure and redundant communications and processing for a collection of internet of things (IOT) devices

Patent metadata

Field	Value
Publication number	US-10855655-B2
Application number	US-201715695359-A
Country	US
Kind code	B2
Filing date	Sep 5, 2017
Priority date	Sep 5, 2017
Publication date	Dec 1, 2020
Grant date	Dec 1, 2020

Abstract

A system for providing a system for providing network communications organized using communities of interests defined by a common encryption key. IoT devices are located at the edge of a network while providing secure and isolated communications for its applications and data through a common network infrastructure. The system's functionality provides the IoT network with secure communications to obtain data from devices by host applications over public networks. The data may be organized and segmented in a manner that isolates and protects the data with only authorized applications gaining access the data to see its existence and read its contents.

First claim

What is claimed is:

1. A distributed processing system for collecting and analyzing edge device data over a secure communications network, the distributed processing system comprising:
one or more host computers connected to the secure communications network, the host computers having one or more device data processing applications for receiving and analyzing device data, each of the device data processing applications being associated with one or more of a plurality of communities of interest implemented within the secure communications network;
a plurality of edge devices including one or more sensor devices communicating with one or more of the device data processing applications, each of the plurality of edge devices belonging to one or more of the plurality of communities of interest;
wherein each one of the one or more communities of interest isolates its data using a separate encryption key, and
each of the plurality of edge devices and host computers hosting device data processing applications within a particular community of interest of the plurality of communities of interest is configured to:
respond to one or more received communications packets when the data included in the one or more received communications packets received at the device is part of the particular community of interest, and
decline to respond to communication packets from entities outside the particular community of interest.

2. The distributed processing system according to claim 1 , wherein the plurality of edge devices comprise:
a first sensor device having its own secure communications endpoint.

3. The distributed processing system according to claim 1 , wherein the plurality of edge devices comprise:
a second sensor coupled to a gateway providing a microbridge secure communications endpoint for communicating over the secure communications network within its respective community of interest; and
the gateway having one or more application agents running to communicate with its corresponding more device data processing applications.

4. The distributed processing system according to claim 1 , wherein the plurality of edge devices comprise:
a third sensor coupled to a communications gateway providing a shared secure communications endpoint for communicating over the secure communications network within its respective community of interest; and
the gateway having one or more application agents running to communicate with its corresponding more device data processing applications.

5. The distributed processing system according to claim 4 , wherein the gateway provides a shared secure communications endpoint with micro-segmentation of edge devices and application agents into separate communities of interest for communicating over the secure communications network.

6. The distributed processing system according to claim 1 , wherein edge devices comprise a data generating sensor.

7. The distributed processing system according to claim 6 , wherein edge devices further comprise a programmable control device.

8. The distributed processing system according to claim 1 , wherein plurality of edge devices further comprises a fog computing module supporting one or more application agents running to process the device data from edge devices into a reduced set of data before transmitting the reduced set of data with the one or more device data processing applications.

9. A computer implemented method for collecting and analyzing edge device data over a secure communications network, the method comprising:
configuring an edge device gateway to communicate with a server implementing an device data processing application over a secure communications network, the secure communications network including a plurality of communities of interest implemented using an encryption key associated with each of the respective plurality of communities of interest, the edge device gateway and the server hosting the device data processing application being within a common community of interest;
initiating collection of edge device data within one or more edge devices coupled to the edge device gateway, the one or more edge devices including a data generating sensor, each of the one or more edge devices having a secure connection to the edge device gateway; and
receiving the edge device data at the server from the edge device gateway over a secure communications network, the edge device data being secured using the encryption key associated with the common community of interest;
wherein each of the devices within the secure communications network, including the edge device gateway and the server hosting the device data processing application, is configured to:
respond to one or more received communications packets only when the data included in the one or more received communications packets received at the device is part of the particular community of interest, and
decline to respond to communication packets from entities outside the particular community of interest.

10. The computer implemented method according to claim 9 , wherein the plurality of edge devices comprise:
a first sensor device having its own secure communications endpoint.

11. The computer implemented method according to claim 9 , wherein the plurality of edge devices comprise:
a second sensor coupled to a gateway providing a microbridge secure communications endpoint for communicating over the secure communications network within its respective community of interest; and
the gateway having one or more application agents running to communicate with its corresponding more device data processing applications.

12. The computer implemented method according to claim 9 , wherein the plurality of edge devices comprise:
a third sensor coupled to a communications gateway providing a shared secure communications endpoint for communicating over the secure communications network within its respective community of interest; and
the gateway having one or more application agents running to communicate with its corresponding more device data processing applications.

13. The computer implemented method according to claim 12 , wherein the gateway provides a shared secure communications endpoint with micro-segmentation of edge devices and application agents into separate communities of interest for communicating over the secure communications network.

14. The computer implemented method according to claim 9 , wherein plurality of edge devices further comprises a fog computing module supporting one or more application agents running to process the device data from edge devices into a reduced set of data before transmitting the reduced set of data with the one or more device data processing applications.

15. A computer data product containing a non-transitory computer readable storage medium comprising a set of instructions, which when executed by a computing device, cause the computing device to implement a method for collecting and analyzing edge device data over a secure communications network, the method comprising:
configuring an edge device gateway to communicate with a server implementing an device data processing application over a secure communications network, the secure communications network including a plurality of communities of interest implemented using an encryption key associated with each of the respective plurality of communities of interest, the edge device gateway and the server hosting the device data processing application being within a common community of interest;
initiating collection of edge device data within one or more edge devices coupled to the edge device gateway, t

Assignees

• Entezari Mehdi
• Dremann Zachary
• Landis John A
• Unisys Corp

Inventors

• Entezari Mehdi
• Dremann Zachary
• Landis John A

Classifications

• H04L67/12

  specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks · CPC title

• H04L63/0236 Primary

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title

• H04L63/061

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• H04L63/0281

  Proxies · CPC title