Monitoring secured network using network tap devices

Patent metadata

Field	Value
Publication number	US-11516687-B2
Application number	US-202117154327-A
Country	US
Kind code	B2
Filing date	Jan 21, 2021
Priority date	Jan 21, 2021
Publication date	Nov 29, 2022
Grant date	Nov 29, 2022

Abstract

A network tap device is configured to join a secured network to be monitored through a joining process. The joining process includes communicating with the access point to obtain security keys of the monitored network and communicating with the access point to obtain a network address for the network tap device. After joining the secured network, the network tap device collects the network data on the secured network. Collecting the network data includes detecting network traffic on the monitored network, the network traffic containing encrypted data and unencrypted data, decrypting the encrypted data in the network traffic using the security keys to generate decrypted data, and adding the decrypted data and unencrypted data to the network data. The network tap device further transmits the collected network data to a monitoring workstation via a data transmission network.

First claim

The invention claimed is:

1. A system comprising:
a headend system configured for managing network devices in a monitored network;
an access point configured for managing communications between a subset of the network devices in the monitored network, the subset of the network devices comprising network nodes and a network tap device unknown to other network devices in the subset of the network devices except for a parent network device of the network tap device; and
the network tap device in connection with the access point through the monitored network and managed by the access point and the headend system, the network tap device configured for:
joining the monitored network as a network device of the monitored network, joining the monitored network comprising:
communicating with the access point to obtain security keys of the monitored network, and
communicating with the access point to obtain a network address for the network tap device;

collecting network data for the monitored network, comprising:
detecting network traffic on the monitored network, the network traffic comprising encrypted data and unencrypted data,
decrypting the encrypted data in the network traffic using the security keys to generate decrypted data, and
adding the decrypted data and unencrypted data to the network data;

connecting to a monitoring workstation via a data transmission network different from the monitored network; and
transmitting the collected network data to the monitoring workstation via the data transmission network.

2. The system of claim 1 , wherein the network tap device is further configured for:
prior to obtaining the security keys for the monitored network, communicating with the headend system to authenticate the network tap device via the monitored network; and
the headend system is further configured for:
authenticating the network tap device based on one or more of an identifier of the network tap device, a name of the network tap device, or a certificate of the network tap device.

3. The system of claim 1 , wherein the headend system is configured to manage the network tap device by one or more of:
sending commands to the network tap device via the monitored network using the network address of the network tap device;
receiving responses from the network tap device via the monitored network; and
removing the network tap device from the monitored network.

4. The system of claim 1 , wherein the network tap device is further configured for:
obtaining a channel hopping sequence of the monitored network; and
switching to different channels at different times according to the channel hopping sequence to detect the network traffic on the monitored network.

5. The system of claim 1 , wherein collecting the network data for the monitored network further comprises one or more of:
identifying a decryption error when decrypting the encrypted data using the security keys and adding an indication of the decryption error in the collected network data;
detecting signal strength of a message in the network traffic and adding the signal strength of the message to the collected network data; or
determining a symbol rate of the network traffic and adding the symbol rate to the collected network data.

6. The system of claim 1 , wherein the network tap device transmits the collected network data to the monitoring workstation by streaming the collected network data via the data transmission network.

7. The system of claim 1 , wherein the monitored network is one of a mesh network associated with a resource distribution network, a wireless network, or a cellular network, and the data transmission network is one or more of an Ethernet, a cellular network, or a power line carrier.

8. The system of claim 1 , wherein the network tap device comprises a radio of a plurality of radios of a multi-radio gateway device in the monitored network, the radio being dedicated to the network tap device.

9. The system of claim 1 , wherein the network tap device is configured to collect network data for a first region of the monitored network, the system further comprising at least an additional network tap device configured to collect additional network data for at least another region of the monitored network and to transmit the additional network data to the monitoring workstation via the data transmission network.

10. The system of claim 9 , further comprising the monitoring workstation configured for:
receiving the collected network data and the additional network data;
analyzing the collected network data and the additional network data to generate analysis results; and
causing one or more network devices in the monitored network to be reconfigured based on the analysis results.

11. A network tap device, comprising:
a transceiver configured to communicate both in a monitored network and in a data transmission network different from the monitored network,
the network tap device being configured for:
joining the monitored network as a leaf node of the monitored network unknown to a plurality of network devices of the monitored network except for a parent network device of the network tap device, joining the monitored network comprising:
communicating with a network manager to obtain security keys of the monitored network, and
communicating with the network manager to obtain a network address for the network tap device;

collecting network data for the monitored network, comprising:
detecting network traffic on the monitored network, the network traffic comprising encrypted data and unencrypted data,
decrypting the encrypted data in the network traffic using the security keys to generate decrypted data, and
adding the decrypted data and unencrypted data to the network data; and

transmitting the collected network data to a monitoring workstation via the data transmission network.

12. The network tap device of claim 11 , wherein collecting the network data for the monitored network further comprises one or more of:
identifying a decryption error when decrypting the encrypted data using the security keys and adding an indication of the decryption error in the collected network data;
detecting signal strength of a message in the network traffic and adding the signal strength of the message to the collected network data; or determining a symbol rate of the network traffic and adding the symbol rate to the collected network data.

13. The network tap device of claim 11 , wherein joining the monitored network comprising:
communicating with a headend system of the monitored network to authenticate the network tap device, wherein the headend system is configured to authenticate the network tap device based on one or more of an identifier of the network tap device, a name of the network tap device, or a certificate of the network tap device.

14. The network tap device of claim 11 , wherein transmitting the collected network data to the monitoring workstation comprises streaming the collected network data via the data transmission network.

15. The network tap device of claim 11 , wherein the transceiver comprises a radio of a plurality of radios of a multi-radio gateway device in the monitored network, the radio being dedicated to the network tap device.

16. A method performed by a network tap device, comprising:
joining a monitored network as a leaf node of the monitored network unknown to a plurality of network devices of the monitored network except for a parent network device of the network tap device, joining the monitored network comprising:
communicating with a network manager

Assignees

• Landis & Gyr Innovations Inc

Inventors

• Chasko Stephen
• Hartman James P
• Hugoo Damien

Classifications

• H04L63/1425 Primary

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title

• H04W88/08

  Access point devices · CPC title

• H04W84/18

  Self-organising networks, e.g. ad-hoc networks or sensor networks · CPC title

• H04W12/04

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title