Security system, device, and method for internet of things networks

A protection system for an Internet of things (IOT) system having a connected device, the protection system comprising:

• an input/output (I/O) interface that communicates with a source that provides control communication;
• and
• a security device that intercepts a communication between the connected device and the I/O interface over an IOT network,
• wherein the security device includes a memory and a processor electrically connected to the memory and configured to implement instructions stored in the memory to execute:
• a receiving task that receives an intercepted control communication from the I/O interface over the IOT network, the control communication including at least one control command to be sent to the connected device;
• a determining task that determines whether the received control communication contains an undesirable control command;
• a passing task that passes the received control communication to the connected device when the determining task does not determine that the received control communication contains an undesirable control command;
• a blocking task that blocks the received communication to the connected device when the determining task determines that the received control communication contains an undesirable control command;
• and
• a logging task that stores, in a storage device, forensic data for the connected device when the determining task determines that the received control communication contains an undesirable control command.

A method of protecting an Internet of things (IOT) system having connected hardware equipment, including at least a security device having a communication interface configured to communicate with a controller over an IOT network to receive a control communication for a connected device, the method comprising:

• a learning step of learning behavior patterns, the behavior patterns including normal behavior patterns of system processes operating in the IOT system and the connected hardware equipment in the IOT system and anomalous system behaviors and deviations in system state that indicate potential cyber incidents or general system failures, and differentiating therebetween;
• a receiving step of receiving control communication from the controller over the IOT network, the control communication including at least one control command to be sent to the connected device;
• a determining step of determining whether the received control communication contains an undesirable control command based at least on the learned behavior patterns;
• a passing step of passing the received control communication to the connected device when the first determining step does not determine that the received control communication contains an undesirable control command;
• and
• a blocking step of blocking the received control communication to the connected device when the first determining step detects that the received control communication contains an undesirable control command.

A method of protecting an Internet of things (IOT) system having connected hardware equipment, including at least a security device having a communication interface configured to communicate with a controller over an IOT network to receive a control communication for a connected device, the method comprising:

• a receiving step of receiving control communication from the controller over the IOT network, the control communication including at least one control command to be sent to the connected device;
• a maintenance step of providing integration of information from maintenance schedules, alarm conditions in the IOT system, and from lifecycle curves of connected hardware equipment operating within the IOT system to aid in anomaly detection where the failure occurs different from the expected lifecycle curve, wherein the information aids in addressing issues of false detections within incident detection algorithms used to evaluate the state in the IOT system;
• a determining step of determining, based at least on the integrated information provided by the maintenance step, whether the received control communication contains an undesirable control command;
• a passing step of passing the received control communication to the connected device when the first determining step does not determine that the received control communication contains an undesirable control command;
• and
• a blocking step of blocking the received control communication to the connected device when the first determining step detects that the received control communication contains an undesirable control command.

A method of protecting an Internet of things (IOT) system having a human machine interface (HMI) and connected hardware equipment, including at least a security device having a communication interface, a memory, and a processor electrically connected to the memory, the processor configured to implement instructions stored in the memory to execute steps of the method, the method comprising:

• an intercepting step of intercepting a communication between a controller and a connected device over an IOT network, the communication including a control communication for controlling the connected device;
• a determining step of determining whether the received control communication contains an undesirable control command;
• a passing step of passing the received control communication to the connected device when the first determining step does not determine that the received control communication contains an undesirable control command;
• a blocking step of blocking the received control communication to the connected device when the first determining step detects that the received control communication contains an undesirable control command;
• and
• an alarming step of sending an alarm to the HMI when the determining step determines that the received control communication contains an undesirable control command.

A method of protecting an Internet of things (IOT) system having connected hardware equipment, including at least a security device having a communication interface, a memory, and a processor electrically connected to the memory, the processor configured to implement instructions stored in the memory to execute steps of the method, the method comprising:

• an intercepting step of intercepting a communication between a controller and a connected device over an IOT network, the communication including a control communication for controlling the connected device;
• a first determining step of determining whether the received control communication contains an undesirable control command;
• an obtaining step of obtaining configuration information from the connected device;
• an analyzing step of analyzing the obtained configuration information;
• a second determining step of determining whether the obtained configuration information contains an undesirable configuration based on a result of analysis in the analyzing step;
• a passing step of passing the received control communication to the connected device when the first determining step does not determine that the received control communication contains an undesirable control command and the second determining step does not determine that the obtained configuration information contains an undesirable configuration;
• and
• a blocking step of blocking the received control communication to the connected device when the first determining step detects that the received control communication contains an undesirable control command or the second determining step does not determine that the obtained configuration information contains an undesirable configuration.

A method of protecting an Internet of things (IOT) system having connected hardware equipment, including at least a security device having a communication interface, a memory, and a processor electrically connected to the memory, the processor configured to implement instructions stored in the memory to execute steps of the method, the method comprising:

• an intercepting step of intercepting a communication between a controller and a connected device over an IOT network, the communication including a control communication for controlling the connected device;
• a determining step of determining whether the received control communication contains an undesirable control command;
• a passing step of passing the received control communication to the connected device when the first determining step does not determine that the received control communication contains an undesirable control command;
• and
• a blocking step of blocking the received control communication to the connected device and inserting a corrective communication into the connected device or into the communication to put the connected device or the communication into a different state when the determining step detects that the received control communication contains an undesirable control command.

A protection system for an Internet of things (IOT) system having connected hardware equipment, the protection system comprising:

• an input/output (I/O) interface that communicates with a source that provides control communication;
• and
• a security device that intercepts a communication between a connected device and the I/O interface over an IOT network,
• wherein the security device includes a memory and a processor electrically connected to the memory and configured to implement instructions stored in the memory to execute:
• a learning task that learns behavior patterns, the behavior patterns including normal behavior patterns of system processes operating in the IOT system and the connected hardware equipment in the IOT system and anomalous system behaviors and deviations in system state that indicate potential cyber incidents or general system failures, and differentiates therebetween;
• a receiving task that receives an intercepted control communication from the I/O interface over the IOT network, the control communication including at least one control command to be sent to the connected device;
• a determining task that determines whether the received control communication contains an undesirable control command;
• a passing task that passes the received control communication to the connected device when the determining task does not determine that the received control communication contains an undesirable control command;
• and
• a blocking task that blocks the received communication to the connected device when the determining task determines that the received control communication contains an undesirable control command.

A protection system for an Internet of things (IOT) system having a connected device, the protection system comprising:

• an input/output (I/O) interface that communicates with a source that provides control communication;
• and
• a security device that intercepts a communication between the connected device and the I/O interface over an IOT network,
• wherein the security device includes a memory and a processor electrically connected to the memory and configured to implement instructions stored in the memory to execute:
• a receiving task that receives an intercepted control communication from the I/O interface over the IOT network, the control communication including at least one control command to be sent to the connected device;
• a maintenance task that provides integration of information from maintenance schedules, alarm conditions in the IOT system, and from lifecycle curves of connected hardware equipment operating within the IOT system to aid in anomaly detection where the failure occurs different from the expected lifecycle curve, wherein the information aids in addressing issues of false detections within incident detection algorithms used to evaluate the state in the IOT system;
• a determining task that determines, based at least on the integrated information provided by the maintenance task, whether the received control communication contains an undesirable control command;
• a passing task that passes the received control communication to the connected device when the determining task does not determine that the received control communication contains an undesirable control command;
• and
• a blocking task that blocks the received communication to the connected device when the determining task determines that the received control communication contains an undesirable control command.

A protection system for an Internet of things (IOT) system having a connected device, the protection system comprising:

• a human machine interface (HMI);
• an input/output (I/O) interface that communicates with a source that provides control communication;
• and
• a security device that intercepts a communication between the connected device and the I/O interface over an IOT network,
• wherein the security device includes a memory and a processor electrically connected to the memory and configured to implement instructions stored in the memory to execute:
• a receiving task that receives an intercepted control communication from the I/O interface over the IOT network, the control communication including at least one control command to be sent to the connected device;
• a determining task that determines whether the received control communication contains an undesirable control command;
• a passing task that passes the received control communication to the connected device when the determining task does not determine that the received control communication contains an undesirable control command;
• a blocking task that blocks the received communication to the connected device when the determining task determines that the received control communication contains an undesirable control command;
• and
• an alarming task of sending an alarm to the HMI when the determining task determines that the received control communication contains an undesirable control command.

A protection system for an Internet of things (IOT) system having a connected device, the protection system comprising:

• an input/output (I/O) interface that communicates with a source that provides control communication;
• and
• a security device that intercepts a communication between the connected device and the I/O interface over an IOT network,
• wherein the security device includes a memory and a processor electrically connected to the memory and configured to implement instructions stored in the memory to execute:
• a receiving task that receives an intercepted control communication from the I/O interface over the IOT network, the control communication including at least one control command to be sent to the connected device;
• a first determining task that determines whether the received control communication contains an undesirable control command;
• an obtaining task that obtains configuration information from the connected device;
• an analyzing task that analyzes the obtained configuration information;
• a second determining task that determines whether the obtained configuration information contains an undesirable configuration based on a result of analysis in the analyzing task;
• a passing task that passes the received control communication to the connected device when the first determining task does not determine that the received control communication contains an undesirable control command and the second determining task does not determine that the obtained configuration information contains an undesirable configuration;
• and
• a blocking task that blocks the received communication to the connected device when the first determining task determines that the received control communication contains an undesirable control command or the second determining task does not determine that the obtained configuration information contains an undesirable configuration.

A protection system for an Internet of things (IOT) system having a connected device, the protection system comprising:

• an input/output (I/O) interface that communicates with a source that provides control communication;
• and
• a security device that intercepts a communication between the connected device and the I/O interface over an IOT network,
• wherein the security device includes a memory and a processor electrically connected to the memory and configured to implement instructions stored in the memory to execute:
• a receiving task that receives an intercepted control communication from the I/O interface over the IOT network, the control communication including at least one control command to be sent to the connected device;
• a determining task that determines whether the received control communication contains an undesirable control command;
• a passing task that passes the received control communication to the connected device when the determining task does not determine that the received control communication contains an undesirable control command;
• and
• a blocking task that blocks the received communication to the connected device and inserts a corrective communication into the connected device or into the communication to put the connected device or the communication into a different state when the determining task determines that the received control communication contains an undesirable control command.