Network security management based on collection and cataloging of network-accessible device information

Patent metadata

Field	Value
Publication number	US-2020177590-A1
Application number	US-201816207527-A
Country	US
Kind code	A1
Filing date	Dec 3, 2018
Priority date	Dec 3, 2018
Publication date	Jun 4, 2020
Grant date	—

Abstract

Aspects of the subject disclosure may include, for example, monitoring network messages at a network edge of a service provider network, wherein the network edge is coupled via a network edge device to a local area network comprising a plurality of network-addressable (IoT) devices, wherein the network edge device is in communication with a service provider network via a transmission medium in which electromagnetic waves comprising the network messages propagate along the transmission medium without requiring an electrical return path. A network-addressable device of the plurality of network-addressable devices is detected to obtain a detected network-addressable device according to the monitoring of the network messages. Information obtained from the detected network-addressable device is evaluated to obtain an evaluation result and a listing of the plurality of network-addressable devices is updated based on the evaluation results. Other embodiments are disclosed.

First claim

What is claimed is:

1 . A method, comprising:
monitoring, by a processing system including a processor, network traffic at a network edge of a service provider network, wherein the network edge is coupled via a network edge device to a local area network comprising a plurality of network-accessible devices, wherein the network edge device is in communication with the service provider network via a transmission medium in which electromagnetic waves conveying the network traffic propagate along the transmission medium without requiring an electrical return path, and wherein the transmission medium has an external surface; identifying, by the processing system, a network-accessible device of the plurality of network-accessible devices to obtain an identified network-accessible device according to the monitoring of the network traffic; obtaining, by the processing system, information provided by the identified network-accessible device; analyzing, by the processing system, the information provided by the identified network-accessible device to obtain analysis results; and updating, by the processing system, a catalog of the plurality of network-accessible devices based on the analysis results.

2 . The method of claim 1 , further comprising:
determining, by the processing system, a security issue according to the analysis results; and correlating, by the processing system, the security issue with a network-accessible device of the plurality of network-accessible devices to obtain a compromised network-accessible device.

3 . The method of claim 2 , further comprising:
facilitating, by the processing system, blocking network traffic associated with the compromised network-accessible device.

4 . The method of claim 1 , further comprising:
generating, by the processing system, a query message; and submitting, by the processing system, the query message, wherein the network traffic observable at the network edge of the service provider network comprises a response to the query message.

5 . The method of claim 4 , wherein the submitting of the query message further comprises submitting, by the processing system, the query message to a search engine configured to identify devices adapted to engage in machine-to-machine communications.

6 . The method of claim 5 , wherein the search engine configured to identify the devices adapted to engage in machine-to-machine communications comprises a plurality of filters adapted to identify the devices according to the machine-to-machine communications.

7 . The method of claim 1 , further comprising:
obtaining, by the processing system, banner information of another network device of the plurality of network-accessible devices of the local area network, wherein the identifying of the network-accessible device of the plurality of network-accessible devices is further based on the banner information.

8 . A system, comprising:
a processing system including a processor; and a memory that stores executable instructions that, when executed by the processing system, facilitate performance of operations, the operations comprising:
monitoring network messages at a network edge of a service provider network, wherein the network edge is coupled via a network edge device to a local area network comprising a plurality of network-accessible devices, wherein the network edge device is in communication with the service provider network via a transmission medium in which electromagnetic waves conveying the network messages propagate along the transmission medium without requiring an electrical return path, and wherein the transmission medium has an external surface;
detecting a network-accessible device of the plurality of network-accessible devices to obtain a detected network-accessible device according to the monitoring of the network messages;
obtaining information provided by the detected network-accessible device;
analyzing the information provided by the detected network-accessible device to obtain analysis results; and
updating a listing of the plurality of network-accessible devices based on the analysis results.

9 . The system of claim 8 , wherein the operations further comprise:
determining a security issue according to the analysis results; and correlating the security issue with a network-accessible device of the plurality of network-accessible devices to obtain a compromised network-accessible device.

10 . The system of claim 9 , wherein the operations further comprise:
facilitating blocking network messages associated with the compromised network-accessible device.

11 . The system of claim 8 , wherein the operations further comprise:
generating a query message; and submitting the query message, wherein the network messages observable at the network edge of the service provider network comprises a response to the query message.

12 . The system of claim 11 , wherein the submitting of the query message further comprises submitting the query message to a search engine configured to identify network-addressable devices adapted to engage in machine-type communications.

13 . The system of claim 12 , wherein the search engine configured to identify the network-addressable devices adapted to engage in machine-type communications comprises a plurality of filters adapted to identify the network-addressable devices according to the machine-type communications.

14 . The system of claim 8 , wherein the operations further comprise:
obtaining banner information of another network device of the plurality of network-accessible devices of the local area network, wherein the detecting of the network-accessible device of the plurality of network-accessible devices is further based on the banner information.

15 . A non-transitory, machine-readable storage medium, comprising executable instructions that, when executed by a processing system including a processor, facilitate performance of operations, the operations comprising:
monitoring network messages at a network edge of a service provider network, wherein the network edge is coupled via a network edge device to a local area network comprising a plurality of network-addressable devices, wherein the network edge device is in communication with the service provider network via a transmission medium in which electromagnetic waves conveying the network messages propagate along the transmission medium without requiring an electrical return path, and wherein the transmission medium has an external surface; detecting a network-addressable device of the plurality of network-addressable devices to obtain a detected network-addressable device according to the monitoring of the network messages; evaluating information obtained from the detected network-addressable device to obtain an evaluation result; and updating a listing of the plurality of network-addressable devices based on the evaluation result.

16 . The non-transitory, machine-readable storage medium of claim 15 , wherein the operations further comprise:
determining a security issue according to the evaluation result; and correlating the security issue with a network-addressable device of the plurality of network-addressable devices to obtain a compromised network-addressable device.

17 . The non-transitory, machine-readable storage medium of claim 16 , wherein the operations further comprise:
facilitating blocking network messages associated with the compromised network-addressable device.

18 . The non-transitory, machine-readable storage medium of claim 15 , wherein the o

Assignees

• At & T Ip I Lp

Inventors

• Levy Donald
• Gross David
• Serban Cristina
• Ramachandran Jayaraman

Classifications

• H04B3/52

  Systems for transmission between fixed stations via waveguides · CPC title

• H04L67/12

  specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks · CPC title

• H04L63/10 Primary

  for controlling access to devices or network resources · CPC title

• H04W12/60

  Context-dependent security · CPC title

• H04W12/10

  Integrity · CPC title