Security Management for Internet-Of-Things Devices

Patent metadata

Field	Value
Publication number	US-2022158974-A1
Application number	US-202017097078-A
Country	US
Kind code	A1
Filing date	Nov 13, 2020
Priority date	Nov 13, 2020
Publication date	May 19, 2022
Grant date	—

Abstract

Security management for Internet-of-things devices can include device-level security, hub-level security, and service-level security. Internet-of-things devices can communicate threats to each other and/or to an Internet-of-things hub on a gateway. The gateway can receive a communication associated with an Internet-of-things device, the communication request including a request for the Internet-of-things device to connect with another device. Based on connection data included in security communications received from the Internet-of-things device, the gateway can determine if the communication associated with the Internet-of-things device should be allowed. If the communication associated with the Internet-of-things device should not be allowed, an action can be taken to limit the communication, If the communication should be allowed, the communication can be allowed.

First claim

1 . A system comprising:
a gateway comprising processor; and a memory that stores computer-executable instructions that, when executed by the processor, cause the processor to perform operations comprising
detecting, at the gateway using an Internet-of-things hub, a communication associated with an Internet-of-things device, wherein the communication comprises an attempt for the Internet-of-things device to communicate with another device,
determining, by the gateway and based on connection data included in security communications received from the Internet-of-things device, if the communication associated with the Internet-of-things device should be allowed,
in response to a determination that the communication associated with the Internet-of-things device should not be allowed, taking, by the gateway, an action to limit the communication, and
in response to a determination that the communication should be allowed, allowing, by the gateway, the communication.

2 . The system of claim 1 , wherein the Internet-of-things device communicates with the gateway via an Internet-of-things network that comprises the Internet-of-things device and the gateway.

3 . The system of claim 2 , the Internet-of-things device is onboarded by the gateway by performing operations comprising:
detecting an onboarding request from the Internet-of-things device; prompting the Internet-of-things device to obtain a hardware verification; and in response to determining that the hardware verification is received, onboarding the Internet-of-things device.

4 . The system of claim 3 , wherein the hardware verification comprises detecting manipulation of a hardware device to generate an input at the Internet-of-things device.

5 . The system of claim 4 , wherein the hardware verification comprises verifying that an output by the hardware device has been detected at the Internet-of-things device.

6 . The system of claim 1 , the computer-executable instructions, when executed by the processor, cause the processor to perform operations further comprising:
generating, at the gateway, display data comprising renderable data for presenting a user interface that depicts the communication; receiving, at the gateway, input comprising selection of a user interface element to modify an aspect of the communication; and triggering, by the gateway, blocking of the communication based on the input.

7 . A method comprising:
detecting, at a gateway comprising a processor that executes an Internet-of-things hub, a communication associated with an Internet-of-things device, wherein the communication comprises an attempt for the Internet-of-things device to communicate with another device; determining, by the processor and based on connection data included in security communications received from the Internet-of-things device, if the communication associated with the Internet-of-things device should be allowed; in response to a determination that the communication associated with the Internet-of-things device should not be allowed, taking, by the processor, an action to limit the communication; and in response to a determination that the communication should be allowed, allowing, by the processor, the communication.

8 . The method of claim 7 , wherein the Internet-of-things device communicates with the gateway via an Internet-of-things network that comprises the Internet-of-things device and the gateway.

9 . The method of claim 8 , the Internet-of-things device is onboarded by the gateway by performing operations comprising:
detecting an onboarding request from the Internet-of-things device; prompting the Internet-of-things device to obtain a hardware verification; and in response to determining that the hardware verification is received, onboarding the Internet-of-things device.

10 . The method of claim 9 , wherein the hardware verification comprises detecting manipulation of a hardware device to generate an input at the Internet-of-things device.

11 . The method of claim 10 , wherein the hardware verification comprises verifying that an output by the hardware device has been detected at the Internet-of-things device.

12 . The method of claim 11 , wherein the hardware device comprises one of a light device or a sound device.

13 . The method of claim 7 , further comprising:
generating, at the gateway, display data comprising renderable data for presenting a user interface that depicts the communication; receiving, at the gateway, input comprising selection of a user interface element to modify an aspect of the communication; and triggering, by the gateway, modification of the communication based on the input.

14 . The method of claim 13 , wherein the modification of the communication comprises blocking the communication.

15 . A computer storage medium having computer-executable instructions stored thereon that, when executed by a processor, cause the processor to perform operations comprising:
detecting, at a gateway that hosts an Internet-of-things hub, a communication associated with an Internet-of-things device, wherein the communication comprises an attempt for the Internet-of-things device to communicate with another device, determining, by the gateway and based on connection data included in security communications received from the Internet-of-things device, if the communication associated with the Internet-of-things device should be allowed, in response to a determination that the communication associated with the Internet-of-things device should not be allowed, taking, by the gateway, an action to limit the communication, and in response to a determination that the communication should be allowed, allowing, by the gateway, the communication.

16 . The computer storage medium of claim 15 , wherein the Internet-of-things device communicates with the gateway via an Internet-of-things network that comprises the Internet-of-things device and the gateway.

17 . The computer storage medium of claim 16 , the Internet-of-things device is onboarded by the gateway by performing operations comprising:
detecting an onboarding request from the Internet-of-things device; prompting the Internet-of-things device to obtain a hardware verification; and in response to determining that the hardware verification is received, onboarding the Internet-of-things device.

18 . The computer storage medium of claim 17 , wherein the hardware verification comprises detecting manipulation of a hardware device to generate an input at the Internet-of-things device.

19 . The computer storage medium of claim 18 , wherein the hardware verification comprises verifying that an output by the hardware device has been detected at the Internet-of-things device.

20 . The computer storage medium of claim 15 , the computer-executable instructions, when executed by the processor, cause the processor to perform operations further comprising:
generating, at the gateway, display data comprising renderable data for presenting a user interface that depicts the communication; receiving, at the gateway, input comprising selection of a user interface element to modify an aspect of the communication; and triggering, by the gateway, blocking of the communication based on the input.

Assignees

• At & T Ip I Lp

Inventors

• Wang Wei
• Serban Cristina

Classifications

• H04L63/0236 Primary

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/104

  Grouping of entities · CPC title

• H04L63/029 Primary

  Firewall traversal, e.g. tunnelling or, creating pinholes · CPC title