Back to results
US 11,601,459 B2Granted
Method for generating, sharing and enforcing network profiles for IoT devices
AssigneeCheck Point Software Technologies Ltd.
InventorsDaniel Cohen-Sason, Pini Shamgar, Yevgeny Fabrikant
Life of this patent
Estimating the term…
Abstract
A method and system is provided for setting network policies based on electronic devices connected to a network. The electronic devices present on the network are detected and their behavior is captured using profiles. These profiles are then used to generate network policies based on the electronic devices connected to the network. Instead of reacting to behavior of the electronic devices (e.g., anomaly detection to detect malware), the method and system sets the network policies to prevent unauthorized communications (e.g., before malware is present in the system).
Claims13
A method executed by circuitry for determining and sharing network profiles for electronic devices connected to a network, the method comprising:
- determining with the circuitry a make and a function of each of the electronic devices;
- for each of the electronic devices, using the circuitry to detect communications in the network involving the electronic device over a duration of time, wherein the detected communications include both incoming messages to the electronic device and outgoing messages from the electronic device;
- splitting the communications into external communications and internal communications, wherein:
- external communications have a source or a destination that is external to the network;
- and
- internal communications have a source and a destination that is internal to the network;
- and
- generating profiles for the electronic devices using the circuitry, comprising:
- for each of the electronic devices, determining properties of the detected communications involving the electronic device including:
- for each of the detected communications, determining at least one of a protocol of the communication, a source of the communication, or a destination of the communication;
- generate a profile for each of the electronic devices based on the determined properties of the detected communications, including:
- a make and function of the electronic device;
- and
- acceptable communications enabled by the profile, wherein each of the acceptable communications includes a protocol, a source, and a destination;
- and
- for at least one of the electronic devices, specifying:
- at least one approval external communication source or approval external communication destination, or
- at least one approved internal electronic source or approved internal communication destination;
- sending the generated profiles with the circuitry to a server.
16 more elements
A method executed by circuitry for determining and sharing network profiles for electronic devices connected to a network, the method comprising:
- determining with the circuitry a make and a function of each of the electronic devices:
- for each of the electronic devices, using the circuitry to detect communications in the network involving the electronic device over a duration of time, wherein the detected communications include both incoming messages to the electronic device and outgoing messages from the electronic device;
- generating profiles for the electronic devices using the circuitry, comprising:
- for each of the electronic devices, determining properties of the detected communications involving the electronic device including:
- for each of the detected communications, determining at least one of a protocol of the communication, a source of the communication, or a destination of the communication:
- generate a profile for each of the electronic devices based on the determined properties of the detected communications, including:
- a make and function of the electronic device;
- acceptable communications enabled by the profile, wherein each of the acceptable communications includes a protocol, a source, and a destination;
- sending the generated profiles with the circuitry to a server;
- receiving with the server a request for a profile, wherein the request includes a make, a function, and device specific detected communications of the detected communications for the make and the function of the request;
- and
- identifying a profile associated with the make and function of the request, and that enables the device specific detected communications included with the request;
- and
- outputting with the server the identified profile.
11 more elements
A detecting electronic device for determining and sharing network profiles for electronic devices connected to a network, the detecting electronic device comprising:
- a network interface configured to, for each of the electronic devices, detect communications in the network involving the electronic device over a duration of time, wherein the detected communications include both incoming messages to the electronic device and outgoing messages from the electronic device;
- and
- circuitry configured to:
- split the communications into external communications and internal communications, wherein:
- external communications have a source or a destination that is external to the network:
- and
- internal communications have a source and a destination that is internal to the network;
- determine a make and a function of each of the electronic devices;
- generate profiles for the electronic devices comprising:
- for each of the electronic devices, determining properties of the detected communications including:
- for each of the detected communications, determining at least one of a protocol of the communication, a source of the communication, or a destination of the communication;
- generate a profile for each of the electronic devices based on the determined properties of the detected communications, including:
- a make and function of the electronic device;
- and
- acceptable communications each comprising a protocol, a source, and a destination;
- and
- for at least one of the electronic devices, specifying:
- at least one approved external communication source or approved external communication destination;
- or
- at least one approved internal electronic source or approved internal communication destination;
- and
- output the generated profiles.
19 more elements
Dependencies are inferred from the claim text.