Profiling of devices powered through power over ethernet for device security

Patent metadata

Field	Value
Publication number	US-2025039005-A1
Application number	US-202318361251-A
Country	US
Kind code	A1
Filing date	Jul 28, 2023
Priority date	Jul 28, 2023
Publication date	Jan 30, 2025
Grant date	—

Abstract

Profiles of powered devices (PDs) are created based on monitoring device attributes and power consumption trends for connected PDs. An agent executing on power sourcing equipment (PSE) determines device attributes of connected PDs per port based on data received on each port of the PSE on which a PD is connected. The agent communicates device attributes determined for each port to a service that builds and maintains profiles for connected PDs. As the agent periodically reports monitored power consumption of connected PDs, the service tracks power consumption trends for each PD in association with the PD's profile. If the service detects deviations from the profile of a PD based on additional data received on the corresponding port that are reported by the agent, including substantial deviations from the power consumption trends and/or deviations from device attributes, the service generates alerts for the PD and port combination.

First claim

1 . A method comprising:
creating a profile of a powered device (PD) connected to power sourcing equipment (PSE) based on first data received on a port of the PSE to which the PD is connected, wherein the profile of the PD comprises a first plurality of device attributes and a plurality of power consumption measurements identified based on the first data; evaluating second data received on the port based on the profile of the PD to determine if the second data deviate from the profile of the PD, wherein the second data comprise one or more power consumption measurements, and wherein evaluating the second data against the profile of the PD comprises evaluating the one or more power consumption measurements based on the plurality of power consumption measurements; and based on determining that the second data received on the port deviate from the profile of the PD, indicating a deviation for the PD.

2 . The method of claim 1 , wherein evaluating the one or more power consumption measurements based on the plurality of power consumption measurements comprises,
comparing the one or more power consumption measurements to a subset of the plurality of power consumption measurements; and determining if the one or more power consumption measurements substantially deviate from the subset of power consumption measurements, wherein determining that the second data deviate from the profile of the PD comprises determining that the one or more power consumption measurements substantially deviate from the subset of power consumption measurements.

3 . The method of claim 2 , wherein determining if the one or more power consumption measurements substantially deviate from the plurality of power consumption measurements comprises determining if a difference between an average of the one or more power consumption measurements and an average of the subset of power consumption measurements exceeds a threshold.

4 . The method of claim 2 , wherein the one or more power consumption measurements correspond to a first time window and the subset of power consumption measurements correspond to a second time window.

5 . The method of claim 4 , wherein the second time window is proximate to the first time window.

6 . The method of claim 4 , wherein the first time window and the second time window correspond to a same length of time.

7 . The method of claim 1 , wherein the first data received on the port of the PSE comprise at least one of Ethernet frames, data exchanged during a handshake between the PD and the PSE, and Link Layer Discovery Protocol (LLDP) protocol data units (PDUs), and wherein creating the profile of the PD comprises identifying the first plurality of device attributes based on the at least one of the Ethernet frames, the data exchanged during the handshake, and the LLDP PDUs and creating the profile with the first plurality of device attributes.

8 . The method of claim 1 , wherein the second data comprise a second plurality of device attributes, wherein determining if the second data received on the port deviate from the profile of the PD further comprises determining if the second plurality of device attributes match the first plurality of device attributes.

9 . The method of claim 1 , wherein indicating the deviation comprises indicating that the PD has potentially been compromised.

10 . One or more non-transitory machine-readable media having program code stored thereon, the program code comprising instructions to:
determine a Power over Ethernet (POE) fingerprint for a powered device (PD) connected to a port of power sourcing equipment (PSE) to which the PD is connected via Ethernet cabling and monitor PoE data corresponding to the PD for mismatches from the PoE fingerprint; wherein the instructions to monitor the PoE data comprise instructions to evaluate subsequent sets of PoE data corresponding to the PD to determine whether at least one of a device attribute has changed from what is indicated in the fingerprint and one or more power consumption measurements have substantially changed from that indicated in the fingerprint; and based on a determination that at least one of a device attribute has changed and one or more power consumption measurements has changed substantially, indicate a fingerprint mismatch for the port of the PSE.

11 . The non-transitory machine-readable media of claim 10 , wherein the instructions to determine whether the one or more power consumption measurements have substantially changed from that indicated in the fingerprint comprise instructions to,
compare the one or more power consumption measurements and a first power consumption measurement identified from the fingerprint, wherein the first power consumption measurement is an average power consumption; and determine whether a difference between the one or more power consumption measurements and the first power consumption measurement exceeds a threshold, wherein the instructions to determine that the one or more power consumption measurements have substantially changed comprise instructions to determine that the difference exceeds the threshold.

12 . The non-transitory machine-readable media of claim 10 , wherein the instructions to determine the PoE fingerprint comprise instructions to determine the PoE fingerprint based on first data received on the port of the PSE, wherein the first data received on the port of the PSE comprise at least one of Ethernet frames, data transmitted via the Ethernet cabling during a handshake between the PD and the PSE, and Link Layer Discovery Protocol (LLDP) protocol data units (PDUs).

13 . The non-transitory machine-readable media of claim 12 , wherein the instructions to determine the PoE fingerprint further comprise instructions to determine a set of device attributes and a set of power consumption measurements based on the at least one of the Ethernet frames, the data transmitted during the handshake, and the LLDP PDUs, wherein the PoE fingerprint comprises the set of device attributes and the set of power consumption measurements.

14 . An apparatus comprising:
a processor; and a machine-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to,
create a profile of a powered device (PD) connected to a port of power sourcing equipment (PSE) via Ethernet cabling based on first data received on the port, wherein the profile of the PD comprises a first plurality of device attributes and first power consumption data collected for the PD;
evaluate second data received on the port based on the profile of the PD to determine if the second data substantially differ from the profile of the PD, wherein the second data comprise second power consumption data, and wherein the instructions to evaluate the second data against the profile of the PD comprise instructions to evaluate the second power consumption data based on the first power consumption data; and
based on a determination that the second data received on the port substantially differ from the profile of the PD, generate an alert for the PD.

15 . The apparatus of claim 14 , wherein the instructions executable by the processor to cause the apparatus to evaluate the second power consumption data based on the first power consumption data comprise instructions executable by the processor to cause the apparatus to,
compare the second power consumption data to the first power consumption data; and determine if the second power consumption data substantially differ from the first power consumption data.

16 . The apparatus of claim 15 , wherein the first power consum

Assignees

• Palo Alto Networks Inc

Inventors

• Puthenparambil Jeslin Antony
• Sankaranarayanan Ramakrishnan
• - Suryakant Devangan
• Borikar Ashwini Ulhas
• Chandrasekaran Arun Athrey

Classifications

• H04L12/10 Primary

  Current supply arrangements · CPC title

• G06F1/266 Primary

  Arrangements to supply power to external peripherals either directly from the computer or under computer control, e.g. supply of power through the communication port, computer controlled power-strips · CPC title

• Y02D30/00

  Reducing energy consumption in communication networks · CPC title