Intent-based security for industrial IoT devices

An apparatus, comprising:

• one or more network interfaces to communicate with a network;
• a processor coupled to the one or more network interfaces and configured to execute one or more processes;
• and
• a memory configured to store a process that is executable by the processor, the process when executed configured to:
• identify a packet sent via the network towards an endpoint as being a control packet for the endpoint, wherein a sensor module executed by the apparatus analyzes the packet by performing deep packet inspection to identify use of an automation protocol by the packet;
• extract one or more control parameter values from the control packet;
• assign to the endpoint one or more component tags that identify a type and software of the endpoint and one or more activity tags that identify what the endpoint is doing at a protocol level;
• compare the one or more control parameter values to a policy associated with the endpoint, wherein the policy associated with the endpoint defines an expected behavior of the endpoint based on the one or more component tags and the one or more activity tags assigned to the endpoint;
• and
• initiate a corrective measure, based on a determination that the one or more control parameter values violate the policy associated with the endpoint.

A tangible, non-transitory, computer-readable medium storing program instructions that cause a device in a network to execute a process comprising:

• identifying, by the device in the network, a packet sent via the network towards an endpoint as being a control packet for the endpoint, wherein a sensor module executed by the device analyzes the packet by performing deep packet inspection to identify use of an automation protocol by the packet;
• extracting, by the device, one or more control parameter values from the control packet;
• assigning, by the device, and to the endpoint, one or more component tags that identify a type and software of the endpoint and one or more activity tags that identify what the endpoint is doing at a protocol level;
• comparing, by the device, the one or more control parameter values to a policy associated with the endpoint, wherein the policy associated with the endpoint defines an expected behavior of the endpoint based on the one or more component tags and the one or more activity tags assigned to the endpoint;
• and
• initiating, by the device, a corrective measure, based on a determination that the one or more control parameter values violate the policy associated with the endpoint.