US 12,724,470 B2Granted

Profiling of devices powered through power over ethernet for device security

AssigneePalo Alto Networks, Inc.

InventorsJeslin Antony Puthenparambil, Ramakrishnan Sankaranarayanan, Suryakant Devangan, Ashwini Ulhas Borikar, Arun Athrey Chandrasekaran

Life of this patent

Estimating the term…

patentgrep

Loading patent…

Abstract

Profiles of powered devices (PDs) are created based on monitoring device attributes and power consumption trends for connected PDs. An agent executing on power sourcing equipment (PSE) determines device attributes of connected PDs per port based on data received on each port of the PSE on which a PD is connected. The agent communicates device attributes determined for each port to a service that builds and maintains profiles for connected PDs. As the agent periodically reports monitored power consumption of connected PDs, the service tracks power consumption trends for each PD in association with the PD's profile. If the service detects deviations from the profile of a PD based on additional data received on the corresponding port that are reported by the agent, including substantial deviations from the power consumption trends and/or deviations from device attributes, the service generates alerts for the PD and port combination.

Claims20

Dependent claims

A method comprising:

creating a profile of a powered device (PD) connected to power sourcing equipment (PSE) based on first data received on a port of the PSE to which the PD is connected, wherein the profile of the PD comprises,
a first plurality of device attributes, wherein the first plurality of device attributes comprises attributes determined based on at least one of Ethernet frames, data exchanged during a handshake, and Link Layer Discover Protocol (LLDP) attributes determined based on LLDP protocol data units (PDUs), and
a plurality of power consumption measurements identified during a period of powering the PD;
evaluating second data received on the port based on the profile of the PD for deviations in the second data from the profile of the PD, wherein the second data comprise one or more power consumption measurements and a second plurality of device attributes, and wherein evaluating the second data against the profile of the PD comprises determining whether the one or more power consumption measurements of the second data indicate a rapid increase or decrease in power consumption not accompanied by an indication of a benign event based on comparing the one or more power consumption measurements and the second plurality of device attributes to the plurality of power consumption measurements and the first plurality of device attributes indicated in the profile of the PD;
and
based on determining that the second data received on the port deviate from the profile of the PD, indicating a deviation for the PD, wherein indicating the deviation for the PD comprises indicating that the PD has potentially been compromised, wherein determining that the second data received on the port deviate from the profile of the PD comprises determining that the one or more power consumption measurements indicate a rapid increase or decrease in power consumption not accompanied by an indication of a benign event.

3 more elements

One or more non-transitory machine-readable media having program code stored thereon, the program code comprising instructions to:

determine a Power over Ethernet (POE) fingerprint for a powered device (PD) connected to a port of power sourcing equipment (PSE) to which the PD is connected via Ethernet cabling and monitor PoE data corresponding to the PD for mismatches from the PoE fingerprint;
wherein the instructions to determine the PoE fingerprint for the PD comprise instructions to determine a set of device attributes and a set of power consumption measurements for inclusion in the PoE fingerprint based on first data received on the port of the PSE, wherein the first data received on the port of the PSE comprise at least one of Ethernet frames, data transmitted via the Ethernet cabling during a handshake between the PD and the PSE, and Link Layer Discovery Protocol (LLDP) protocol data units (PDUs),
wherein the instructions to monitor the PoE data comprise instructions to evaluate subsequent sets of PoE data corresponding to the PD to determine whether at least one of a device attribute has changed from the set of device attributes indicated in the fingerprint and one or more power consumption measurements have substantially changed from the set of power consumption measurements indicated in the fingerprint, wherein the instructions to evaluate subsequent sets of PoE data corresponding to the PD further comprise instructions to determine whether the one or more power consumption measurements indicate a rapid increase or decrease in power consumption not accompanied by an indication of a benign event based on comparison of the one or more power consumption measurements and the set of power consumption measurements indicated in the fingerprint;
and
based on a determination that at least one of a device attribute has changed and one or more power consumption measurements has changed substantially, indicate a fingerprint mismatch for the port of the PSE and that the PD has potentially been compromised, wherein the instructions to indicate the fingerprint mismatch comprise instructions to determine that the subsequent sets of PoE data corresponding to the PD indicate a rapid increase or decrease in power consumption not accompanied by an indication of a benign event.

2 more elements

An apparatus comprising:

a processor;
and
a machine-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to,
create a profile of a powered device (PD) connected to a port of power sourcing equipment (PSE) via Ethernet cabling based on first data received on the port, wherein the profile of the PD comprises a first plurality of device attributes and first power consumption data collected for the PD, wherein the instructions to create the profile of the PD comprise instructions to create the profile based on identification of the first plurality of device attributes from the at least one of Ethernet frames, power data, and Link Layer Discovery Protocol (LLDP) protocol data units (PDUs) exchanged during a handshake between the PD and PSE;
evaluate second data received on the port based on the profile of the PD to determine if the second data substantially differ from the profile of the PD, wherein the second data comprise second power consumption data and a second plurality of device attributes, and wherein the instructions to evaluate the second data against the profile of the PD comprise instructions to determine whether the second power consumption data indicates a rapid increase or decrease in power consumption not accompanied by an indication of a benign event based on comparison of the second power consumption data and second plurality of device attributes and the first power consumption data and the first plurality of device attributes indicated in the profile of the PD;
and
based on a determination that the second data received on the port substantially differ from the profile of the PD, generate an alert for the PD as potentially being compromised, wherein the instructions executable by the processor to generate the alert for the PD as potentially being compromised comprise instructions executable by the processor to cause the apparatus to determine that the second power consumption data indicates a rapid increase or decrease in power consumption not accompanied by an indication of a benign event.

4 more elements

Dependencies are inferred from the claim text.