# US 11,122,411 B2 · Distributed, crowdsourced internet of things (IoT) discovery and identification using block chain > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,122,411 B2 - Document ID: US11122411B2 - Status: Granted - Kind: B2 - Application number: 16/570,949 - Filed: 2019-09-13 - Published: 2020-03-19 - Granted: 2021-09-14 - Earliest claimed: 2018-09-14 - Assignees: RaGaPa Inc. - Applicants: RaGaPa Inc. - Inventors: Gagandeep B. Singh; Ravinder S. Virk; Parvinder S. Bhasin - Web page: https://patentgrep.com/patent/US11122411B2 ## CPC - G06F 21/64: Protecting data integrity, e.g. using checksums, certificates or signatures - H04W 8/005: {Discovery of network devices, e.g. terminals} - G06F 16/1824: {implemented using Network-attached Storage [NAS] architecture (distributed or networked storage systems G06F3/067; protocols for distributed storage of data in a network H04L67/1097)} - G06F 16/1834: {implemented based on peer-to-peer networks, e.g. gnutella (p2p communication protocols H04L67/104)} - H04L 9/3239: {involving non-keyed hash functions, e.g. modification detection codes [MDCs], MD5, SHA or RIPEMD} - H04L 9/3247: {involving digital signatures} - H04L 9/50: {using hash chains, e.g. blockchains or hash trees} - H04L 63/12: {Applying verification of the received information (cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32)} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04W 4/70: Services for machine-to-machine communication [M2M] or machine type communication [MTC] - G16Y 20/20: relating to the thing itself - G16Y 30/10: Security thereof - G16Y 40/50: Safety; Security of things, users, data or systems - H04L 2209/805: Lightweight hardware, e.g. radio-frequency identification [RFID] or sensor - H04W 4/02: Services making use of location information - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G16Y: INFORMATION AND COMMUNICATION TECHNOLOGY SPECIALLY ADAPTED FOR THE INTERNET OF THINGS [IoT] ## Abstract Disclosed embodiments relate to distributed, crowd-sourced Internet of Things (IoT) discovery using Block Chain. In one example, a method includes scanning a network and generating a signature based on IoT device traits discovered, determining whether the signature is already in a verified or an unverified Block Chain, when the signature exists in the verified Block Chain, providing a verified entry including at least the IoT device type, otherwise, when the signature exists in the unverified Block Chain, providing an unverified entry including at least the IoT device type, incrementing a count, and promoting the unverified entry to the verified Block Chain when the count reaches a threshold, and otherwise, when the signature is in neither Block Chain, using the traits to guess the IoT device type, generating a new entry including the IoT device type, a location, and a timestamp, and storing the new entry in the unverified Block Chain. ## Claims ### Claim 1 A method of discovering an Internet of Things (IoT) device type, the method comprising: scanning a network and generating a signature based on IoT device traits discovered during the scan; determining whether the signature is already in a verified or an unverified Block Chain; in response to determining that the signature exists in the verified Block Chain, providing a verified entry comprising at least the IoT device type; in response to determining that the signature exists in the unverified Block Chain, providing an unverified entry comprising at least the IoT device type, incrementing a verification count associated with the unverified entry, and promoting the unverified entry to the verified Block Chain when the verification count reaches a verification threshold; and in response to determining that the IoT device signature is not already in the verified or unverified Block Chains, using the traits to guess and attempt to confirm the IoT device type, generating a new entry comprising the signature of the IoT device type, the IoT device type, a device counter, a location of the IoT device, and a timestamp, and storing the new entry in the unverified Block Chain. ### Claim 2 (depends on 1) The method of claim 1, wherein discovering the traits and generating the signature comprises analyzing network traffic, including raw packet data received from the IoT device, and gathering characteristics regarding the IoT device, the characteristics comprising a MAC (Media Access Control) address, an IP (Internet Protocol) address, ports open, a protocol, and source and destination URLs (Uniform Resource Locators). ### Claim 3 (depends on 2) The method of claim 2, wherein discovering the traits and generating the signature further comprises attempting to identify an operating system (OS), an OS version, and a manufacturer of the IoT device. ### Claim 4 (depends on 3) The method of claim 3, wherein discovering the traits and generating the signature further comprises receiving and analyzing logs from one or more DHCP (Dynamic Host Configuration Protocol) and DNS (Domain Name System) servers, one or more firewalls, and one or more routers. ### Claim 5 (depends on 4) The method of claim 4, wherein guessing the device type comprises using the signature to identify the IoT device type in one or both of the verified and the unverified Block Chains, the signature having been generated based on analysis of traits comprising a location, a MAC address, an IP address, a manufacturer, an OS (operating system), an OS version, ports that are open, a network protocol, and source and destination URLs (Uniform Resource Locators). ### Claim 6 (depends on 1) The method of claim 1, wherein the verified Block Chain is immutable, requiring administrative privileges in order be modified, and wherein dynamically changing fields of the verified entry, including the location, are not included in the providing. ### Claim 7 (depends on 1) The method of claim 1, further comprising synchronizing the verified and unverified Block Chains with a plurality of additional, geographically-dispersed instances of each. ### Claim 8 (depends on 7) The method of claim 7, further comprising using a democratic process to confirm accuracy and detect an attempt to maliciously update the verified Block Chain, wherein the democratic process comprises comparing the verified Block Chain with each of the plurality of additional instances of the verified Block Chain. ### Claim 9 A computing device to discover an Internet of Things (IoT) device type comprising: a processor; and memory coupled to the processor, the memory including instructions which when executed by the processor are to cause: scanning a network and generating a signature based on IoT device traits discovered during the scan; determining whether the signature is already in a verified or an unverified Block Chain; in response to determining that the signature exists in the verified Block Chain, providing a verified entry comprising at least the IoT device type; in response to determining that the signature exists in the unverified Block Chain, providing an unverified entry comprising at least the IoT device type, incrementing a verification count associated with the unverified entry, and promoting the unverified entry to the verified Block Chain when the verification count reaches a verification threshold; and in response to determining that the signature is not already in the verified or unverified Block Chains, using the traits to guess and attempt to confirm the IoT device type, generating a new entry comprising the signature of the IoT device type, the IoT device type, a device counter, a location of the IoT device, and a timestamp, and storing the new entry in the unverified Block Chain. ### Claim 10 (depends on 9) The computing device of claim 9, wherein discovering the traits and generating the signature comprises analyzing network traffic, including raw packet data received from the IoT device, and gathering characteristics regarding the IoT device, the characteristics comprising a MAC (Media Access Control) address, an IP (Internet Protocol) address, ports open, a protocol, and source and destination URLs (Uniform Resource Locators). ### Claim 11 (depends on 10) The computing device of claim 10, wherein discovering the traits and generating the signature further comprises attempting to identify an operating system (OS), an OS version, and a manufacturer of the IoT device. ### Claim 12 (depends on 11) The computing device of claim 11, wherein discovering the traits and generating the signature further comprises receiving and analyzing logs from one or more DHCP (Dynamic Host Configuration Protocol) and DNS (Domain Name System) servers, one or more firewalls, and one or more routers. ### Claim 13 (depends on 12) The computing device of claim 12, wherein guessing the device type comprises using the signature to identify the IoT device type in one or both of the verified and the unverified Block Chains, the signature having been generated based on analysis of traits comprising a location, a MAC address, an IP address, a manufacturer, an OS (operating system), an OS version, ports that are open, a network protocol, and source and destination URLs (Uniform Resource Locators). ### Claim 14 (depends on 9) The computing device of claim 9, wherein the verified Block Chain is immutable, requiring administrative privileges in order be modified, and wherein dynamically changing fields of the verified entry, including the location, are not included in the providing. ### Claim 15 (depends on 9) The computing device of claim 9, wherein the computing device is further to synchronize the verified and unverified Block Chains with a plurality of additional, geographically-dispersed instances of each. ### Claim 16 (depends on 15) The computing device of claim 15, wherein the computing device is further to us a democratic process to confirm accuracy and detect an attempt to maliciously update the verified Block Chain, wherein the democratic process comprises comparing the verified Block Chain with each of the plurality of additional instances of the Block Chain. ### Claim 17 A non-transitory computer-readable medium containing instructions to which a computing device is to perform a method comprising: scanning a network and generating a signature based on Internet of Things (IoT) device traits discovered during the scan; determining whether the signature is already in a verified or an unverified Block Chain; in response to determining that the signature exists in the verified Block Chain, providing a verified entry comprising at least the IoT device type; in response to determining that the signature exists in the unverified Block Chain, providing an unverified entry comprising at least the IoT device type, incrementing a verification count associated with the unverified entry, and promoting the unverified entry to the verified Block Chain when the verification count reaches a verification threshold; and in response to determining that the signature is not already in the verified or unverified Block Chains, using the traits to guess and attempt to confirm the IoT device type, generating a new entry comprising the signature of the IoT device type, the IoT device type, a device counter, a location of the IoT device, and a timestamp, and storing the new entry in the unverified Block Chain. ### Claim 18 (depends on 17) The non-transitory computer-readable medium of claim 17, wherein the verified Block Chain is immutable, requiring administrative privileges in order be modified, and wherein dynamically changing fields of the verified entry, including the location, are not included in the providing. ### Claim 19 (depends on 17) The non-transitory computer-readable medium of claim 17, wherein the computing device is to further respond to the instructions by synchronizing the verified and unverified Block Chains with a plurality of additional, geographically-dispersed instances of each. ### Claim 20 (depends on 17) The non-transitory computer-readable medium of claim 17, wherein the computing device is to further respond to the instructions by using a democratic process to confirm accuracy and detect an attempt to maliciously update the verified Block Chain, wherein the democratic process comprises comparing the verified and unverified Block Chains with a plurality of additional, geographically-dispersed instances of each.