System, apparatus and method for security interoperability path analysis in an internet of things (iot) network

Patent metadata

Field	Value
Publication number	US-2016366181-A1
Application number	US-201615045676-A
Country	US
Kind code	A1
Filing date	Feb 17, 2016
Priority date	Jun 9, 2015
Publication date	Dec 15, 2016
Grant date	—

Abstract

In one embodiment, an apparatus comprises a first logic to receive security attribute information from a plurality of devices, generate a connectivity graph of the plurality of devices based at least in part on the security attribute information and identify an interoperability issue between a first device and a second device based on the connectivity graph. The apparatus may further include a second logic to generate a recommendation to resolve the interoperability issue and a third logic to provide provisioning information to at least one of the first device and the second device based on the recommendation. Other embodiments are described and claimed.

First claim

What is claimed is:

1 . An apparatus comprising:
a first logic to receive device attribute information from a plurality of devices of a network, the first logic to analyze security attribute information of the device attribute information and generate a connectivity graph of the plurality of devices based at least in part on the security attribute information and identify an interoperability issue between a first device and a second device based on the connectivity graph; a second logic to generate a recommendation to resolve the interoperability issue; and a third logic to provide provisioning information to at least one of the first device and the second device based on the recommendation.

2 . The apparatus of claim 1 , wherein the recommendation comprises at least one of a communication channel and a transport protocol to enable the first device and the second device to establish a secure communication path.

3 . The apparatus of claim 1 , wherein the apparatus comprises a security resource introspection manager (SRIM), the SRIM to execute in a distributed manner across at least some of the plurality of devices.

4 . The apparatus of claim 3 , wherein the apparatus comprises a security abstraction layer having the SRIM.

5 . The apparatus of claim 1 , wherein the apparatus comprises a central controller of the network to execute on one or more computing platforms.

6 . The apparatus of claim 5 , wherein the one or more computing platforms comprises a trusted execution environment (TEE) to execute in an isolated environment, the second logic to execute at least in part in the TEE.

7 . The apparatus of claim 1 , wherein the second logic is to identify whether a third device to be incorporated into the network would realize a path to a sub-graph of the connectivity graph, the sub-graph to be isolated from other devices.

8 . The apparatus of claim 1 , wherein the second logic is to enable the first device to form a secure communication path to the second device via a first common communication channel and a first common transport protocol, the first common communication channel and the first common transport protocol having a greater security capability than a second common communication channel and a second common transport protocol.

9 . The apparatus of claim 1 , wherein the second logic is to receive a trusted boot measurement from the first device and compare information of the trusted boot measurement with the device attribute information.

10 . The apparatus of claim 1 , wherein the second logic is to identify a third device to be isolated from at least a fourth device, based on the connectivity graph and the security attribute information.

11 . The apparatus of claim 1 , wherein the second logic is to group a first portion of the plurality of devices into a first group based on the security attribute information and to group a second portion of the plurality of devices into a second group based on the security attribute information, wherein at least one device is to be grouped in the first group and the second group.

12 . At least one computer readable storage medium comprising instructions that when executed enable a system to:
analyze, in a security engine of a network, security attribute information of a plurality of devices of the network; identify, in the security engine, at least one interoperability issue between a first device and a second device of the network; and provide, from the security engine, a recommendation to at least one of the first device and the second device for a configuration update to enable the first and second devices to be interoperable at a first security level.

13 . The at least one computer readable storage medium of claim 12 , further comprising instructions that when executed enable the security engine to receive the security attribute information in device attribute information of the plurality of devices.

14 . The at least one computer readable storage medium of claim 12 , further comprising instructions that when executed enable the security engine to generate a connectivity graph of the network based at least in part on the security attribute information.

15 . The at least one computer readable storage medium of claim 14 , further comprising instructions that when executed enable the security engine to identify the at least one interoperability issue based at least in part on the connectivity graph.

16 . The at least one computer readable storage medium of claim 14 , further comprising instructions that when executed enable the security engine to isolate a third device from a fourth device of the network based at least in part on the connectivity graph.

17 . The at least one computer readable storage medium of claim 12 , wherein the recommendation comprises at least one of an updated channel and an updated transport protocol, where at least one of the updated channel and the updated transport protocol is not native to at least one of the first device and the second device.

18 . The at least one computer readable storage medium of claim 17 , further comprising instructions that when executed enable the security engine to cause the at least one of the first device and the second device to be provisioned for the at least one of the updated channel and the updated transport protocol.

19 . A system comprising:
a plurality of devices, each of the plurality of devices including at least one channel and at least one transport protocol; and a controller coupled to the plurality of devices, the controller including a security logic to receive security attribute information of the plurality of devices, analyze the security attribute information, identify an interoperability issue between a first device and a second device based at least in part on the analyzed security attribute information, generate a recommendation to resolve the interoperability issue, and provide provisioning information to at least one of the first device and the second device based on the recommendation.

20 . The system of claim 19 , wherein the security logic is to communicate an isolation of a third device from a fourth device to a network authoring tool, the network authoring tool to generate an access control policy to prevent interaction between the third device and the fourth device.

21 . The system of claim 19 , wherein the recommendation comprises at least one of an updated channel and an updated transport protocol, where at least one of the updated channel and the updated transport protocol is not native to at least one of the first device and the second device.

22 . The system of claim 19 , wherein the first device comprises a security abstraction layer to provide the security attribute information to the controller, the security attribute information including channel and transport protocol information.

Assignees

• Intel Corp

Inventors

• Smith Ned M
• Poornachandran Rajesh
• Heldt-Sheller Nathan

Classifications

• G06F21/57

  Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities · CPC title

• H04L63/102

  Entity profiles · CPC title

• G06F21/6236

  between heterogeneous systems · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/20 Primary

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title