Authenticating an unknown device based on relationships with other devices in a group of devices

Patent metadata

Field	Value
Publication number	US-10887306-B2
Application number	US-201715593154-A
Country	US
Kind code	B2
Filing date	May 11, 2017
Priority date	May 11, 2017
Publication date	Jan 5, 2021
Grant date	Jan 5, 2021

Abstract

Provided are techniques for authenticating an unknown device. For a first device in an internet of things network that includes a second device and forms a list of trusted devices, a distance between the first device and the second device is determined. A level of trust for the second device is identified based on the distance, wherein the level of trust specifies a level of data sharing. Reputation ranking is performed for the second device based on the level of trust. The reputation ranking is used to assign a trust score to the second device. Based on determining that the trust score exceeds a trust threshold, access is provided to the second device.

First claim

What is claimed is:

1. A computer-implemented method, comprising operations for:
for a first device in an internet of things network that includes a plurality of other devices, storing a list of trusted devices, a list of untrusted devices, and a watch list;
determining a distance between the first device and each of the plurality of other devices;
identifying a level of trust for each of the plurality of other devices based on the distance, wherein the level of trust specifies a level of data sharing;
ranking each of the plurality of other devices based on the level of trust; and
for a second device of the plurality of other devices,
determining whether the second device is designated as a risky device that is on the watch list and has one or more warnings, wherein each of the one or more warnings indicates a negative score, and wherein each negative score indicates how the second device is perceived by another device of the plurality of other devices;
in response to determining that the second device is designated as the risky device on the watch list,
assigning a trust score to the second device based on the ranking; and
lowering the trust score by each negative score indicated by each of the one or more warnings;

based on determining that the trust score exceeds a trust threshold, providing access to the second device for data of the first device; and
based on determining that the trust score does not exceed the trust threshold, denying the access to the second device for the data of the first device; and

for an unknown device that is not in the plurality of other devices,
receiving a trust score from each of the plurality of other devices in the list of trusted devices;
determining a weighted, average trust score using each trust score received from each device of the plurality of other devices; and
based on determining that the weighted, average trust score exceeds the trust threshold, providing the access to the unknown device for the data of the first device.

2. The computer-implemented method of claim 1 , further comprising operations for:
in response to the unknown device that is not in the list of trusted devices trying to access the first device,
determining that the unknown device is not in the list of untrusted devices; and
interacting, at the first device, with the unknown device based on a minimum level of trust.

3. The computer-implemented method of claim 1 , further comprising operations for:
determining that the level of trust for the second device has dropped;
in response to the determination, identifying the second device as one of threat, foe, enemy, and rogue; and
blocking, at the first device, communication of the second device.

4. The method of claim 1 , further comprising operations for:
in response to the unknown device trying to access the first device,
sending a request to each device of the plurality of other devices for the trust score of the unknown device, wherein each device of the plurality of other devices generates the trust score based on whether the unknown device is on another list of trusted devices for that device.

5. The computer-implemented method of claim 4 , wherein each of the plurality of other devices generates the trust score of the unknown device based on multiple factors.

6. The computer-implemented method of claim 1 , further comprising operations for:
in response to a third device causing malicious activity to the first device, putting the third device on a list of malicious devices, wherein a number of times the third device is added to the list of malicious devices is combined with a weighted factor of a severity of malicious activity to generate a level of trust of the third device.

7. The computer-implemented method of claim 1 , wherein a Software as a Service (SaaS) is configured to perform the operations of the method.

8. A computer program product, the computer program product comprising a computer readable storage medium having program code embodied therewith, the program code executable by at least one processor to perform operations comprising:
for a first device in an internet of things network that includes a plurality of other devices, storing a list of trusted devices, a list of untrusted devices, and a watch list;
determining a distance between the first device and each of the plurality of other devices;
identifying a level of trust for each of the plurality of other devices based on the distance, wherein the level of trust specifies a level of data sharing;
ranking each of the plurality of other devices based on the level of trust; and
for a second device of the plurality of other devices,
determining whether the second device is designated as a risky device that is on the watch list and has one or more warnings, wherein each of the one or more warnings indicates a negative score, and wherein each negative score indicates how the second device is perceived by another device of the plurality of other devices;
in response to determining that the second device is designated as the risky device on the watch list,
assigning a trust score to the second device based on the ranking; and
lowering the trust score by each negative score indicated by each of the one or more warnings;
based on determining that the trust score exceeds a trust threshold, providing access to the second device for data of the first device; and
based on determining that the trust score does not exceed the trust threshold, denying the access to the second device for the data of the first device; and

for an unknown device that is not in the plurality of other devices,
receiving a trust score from each of the plurality of other devices in the list of trusted devices;
determining a weighted, average trust score using each trust score received from each device of the plurality of other devices; and
based on determining that the weighted, average trust score exceeds the trust threshold, providing the access to the unknown device for the data of the first device.

9. The computer program product of claim 8 , wherein the program code is executable by at least one processor to perform further operations comprising:
in response to the unknown device that is not in the list of trusted devices trying to access the first device,
determining that the unknown device is not in the list of untrusted devices; and
interacting, at the first device, with the unknown device based on a minimum level of trust.

10. The computer program product of claim 8 , wherein the program code is executable by at least one processor to perform further operations comprising:
determining that the level of trust for the second device has dropped;
in response to the determination, identifying the second device as one of threat, foe, enemy, and rogue; and
blocking, at the first device, communication of the second device.

11. The computer program product of claim 8 , wherein the program code is executable by at least one processor to perform further operations comprising:
in response to the unknown device trying to access the first device,
sending a request to each device of the plurality of other devices for the trust score of the unknown device, wherein each device of the plurality of other devices generates the trust score based on whether the unknown device is on another list of trusted devices for that device.

12. The computer program product of claim 11 , wherein each of the plurality of other devices generates the trust score of the unknown device based on multiple factors.

13. The computer program product of claim 8 , wherein the program code is executable by at least one proces

Assignees

• IBM

Inventors

• Gupta Rahul
• Kumhyr David B
• Madduri Hari H
• Mukherjee Maharaj

Classifications

• H04L63/101 Primary

  Access control lists [ACL] · CPC title

• H04W12/08

  Access security · CPC title

• H04W4/70

  Services for machine-to-machine communication [M2M] or machine type communication [MTC] · CPC title

• H04W12/66

  Trust-dependent, e.g. using trust scores or trust relationships · CPC title

• H04L63/0853 Primary

  using an additional device, e.g. smartcard, SIM or a different communication terminal (cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234) · CPC title