# US 2019/0173955 A1 · Sub-networks based security method, apparatus and product > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2019/0173955 A1 - Document ID: US20190173955A1 - Status: Published application - Kind: A1 - Application number: 16/260,453 - Filed: 2019-01-29 - Published: 2019-06-06 - Earliest claimed: 2015-11-23 - Assignees: Dojo-Labs Ltd - Applicants: Dojo-Labs Ltd - Inventors: Shmulik Bachar; Yossi Atias - Web page: https://patentgrep.com/patent/US20190173955A1 ## CPC - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04L 63/102: {Entity profiles} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 67/303: Terminal profiles - H04L 67/535: {Tracking the activity of the user (network monitoring arrangements H04L43/00; recording of computer activity G06F11/34)} - H04L 61/5014: using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method, apparatus and product for sub-networks based cyber security. One method comprises detecting a device connecting to a local network which is divided into subnets; determining a usage profile of the device; automatically selecting a subnet to connect the device based on the usage profile; and connecting the device to the selected subnet in the local network. Another method comprises monitoring communication traffic of devices in each of the subnets of a local network; performing anomaly detection to detect an abnormal communication of a device connected to a subnet; blocking the abnormal communication of the device; and removing the device from the subnet and connecting the device to a quarantine subnet of the local network, whereby reducing connectivity of the device with other devices connected to the local network. ## Claims ### Claim 1 A method comprising: detecting a device connecting to a local network, wherein the local network is divided into subnets; determining a usage profile of the device, wherein the usage profile is indicative of content of packets transmitted by the device; automatically selecting a subnet of the subnets of the local network to connect the device based on the usage profile of the device; and connecting the device to the selected subnet in the local network. ### Claim 2 (depends on 1) The method of claim 1, wherein the subnets comprise a guest subnet and at least one non-guest subnet, wherein guest devices are connected temporarily to the guest subnet, wherein non-guest devices are connected to the non-guest subnet, whereby the guest and non-guest devices are automatically separated; wherein the device is a non-guest device, wherein said automatically selecting comprises selecting the subnet from the at least one non-guest subnet. ### Claim 3 (depends on 2) The method of claim 2, wherein the guest devices in the guest subnet are blocked from accessing other subnets of the local network and are allowed to access an external network, whereby blocking potential malicious activity by the guest devices. ### Claim 4 (depends on 1) The method of claim 1, wherein the subnets comprise an Internet of Things (IoT) subnet, wherein the IoT subnet is a subnet to which only IoT devices are connected; wherein the device is an IoT device, wherein said determining the usage profile comprises determining a usage profile that is consistent with the device being the IoT device, wherein said automatically selecting comprises selecting the IoT subnet for the IoT device. ### Claim 5 (depends on 1) The method of claim 1, wherein the subnets comprise two or more Internet of Things (IoT) subnets, wherein each of the two or more IoT subnets is a subnet to which only IoT devices are connected, wherein said automatically selecting comprises selecting one of the two or more IoT subnets for an IoT device, wherein the selected IoT subnet is selected based on the IoT device being expected to communicate with other IoT devices in the selected IoT subnet and based on the IoT device being restricted from communicating with IoT devices in other subnets of the two or more IoT subnets. ### Claim 6 (depends on 1) The method of claim 1 further comprising: monitoring network activity in each of the subnets of the local network, wherein said monitoring comprises applying different security rules to each of the subnets. ### Claim 7 (depends on 1) The method of claim 1, wherein said determining the usage profile comprises: performing fingerprinting of the device to detect expected functionality of the device. ### Claim 8 (depends on 1) The method of claim 1, wherein said determining the usage profile comprises identifying a cloud server with which the device communicates, wherein the cloud server is in a network external to the local network. ### Claim 9 (depends on 1) The method of claim 1, wherein said determining the usage profile comprises: determining a fingerprint of the device; obtaining an expected usage profile based on crowd-sourced data that corresponds to devices having similar fingerprints to the fingerprint of the device, whereby the automatic subnet selection is based on the crowd-sourced data. ### Claim 10 (depends on 1) The method of claim 1, wherein said determining the usage profile of the device is performed in response to the device being connected to the local network; wherein said determining the usage profile comprises determining a first usage profile based on a fingerprint of the device; wherein said method further comprises: monitoring traffic pattern of the device when the device is connected to the selected subnet; determining a second usage profile based on the traffic pattern of the device; and in response to said determining the second usage profile, removing the device from the selected subnet and connecting the device to a second selected subnet. ### Claim 11 (depends on 1) The method of claim 1, wherein said determining the usage profile comprises: determining a type of the device, wherein the type is a class of an electric device the device implements, whereby obtaining an implicit expected usage profile based on the type of the device, whereby the automatic subnet selection is based on the type of the device. ### Claim 12 A computer program product comprising a computer readable storage medium retaining program instructions, which program instructions when read by a processor, cause the processor to perform a method comprising: detecting a device connecting to a local network, wherein the local network is divided into subnets; determining a usage profile of the device, wherein the usage profile is indicative of content and target of packets transmitted by the device; automatically selecting a subnet of the local network to connect the device based on the usage profile of the device; and connecting the device to the selected subnet in the local network. ### Claim 13 (depends on 12) The computer program product of claim 12, wherein the subnets comprise a guest subnet and a non-guest subnet, wherein guest devices are connected temporarily to the guest subnet, wherein non-guest devices are connected to the non-guest subnet, whereby the guest and non-guest devices are automatically separated, wherein the guest devices in the guest subnet are blocked from accessing other subnets of the local network and are allowed to access an external network, whereby blocking potential malicious activity by the guest devices. ### Claim 14 (depends on 12) The computer program product of claim 12, wherein the subnets comprise an Internet of Things (IoT) subnet, wherein the IoT subnet is a subnet to which only IoT devices are connected, wherein said automatically selecting comprises selecting the IoT subnet for an IoT device. ### Claim 15 (depends on 12) The computer program product of claim 12, wherein the subnets comprise two or more Internet of Things (IoT) subnets, wherein each of the two or more IoT subnets is a subnet to which only IoT devices are connected, wherein said automatically selecting comprises selecting one of the two or more IoT subnets for an IoT device, wherein the selected IoT subnet is selected based on the IoT device being expected to communicate with other IoT devices in the selected IoT subnet. ### Claim 16 (depends on 12) An apparatus comprising a processor and a memory, wherein said memory retaining the computer program product of claim 12, whereby the processor is configured to perform the method. ### Claim 17 An apparatus comprising a processor coupled to memory, wherein the apparatus is connectable to a local network that is connected to an external network, wherein the processor being configured to perform: shutting down a Dynamic Host Configuration Protocol (DHCP) functionality of a networking device, wherein the networking device is the DHCP server of the local network; becoming the DHCP server of the local network instead of the networking device; creating at least two subnets for the local network; selecting, for each device connected to the local network, a subnet based on a usage profile of the device and connecting the device thereto, whereby dividing the local network into two or more sub-networks; and monitoring communication traffic in the local network, wherein said monitoring comprises applying a different set of security rules for different subnets. ### Claim 18 (depends on 17) The apparatus of claim 17, wherein the communication traffic in the local network is selected from the group consisting of: communication between two devices that are connected to the local network; and communication between a local device and an external device, wherein the local device is connected to the local network, wherein the external device is not connected to the local network and is connected, directly or indirectly, to the external network, wherein the communication between the local device and the external device is routed via the external network. ### Claim 19 (depends on 17) The apparatus of claim 17, wherein said creating at least two subnets for the local network comprises creating an Internet of Things (IoT) subnet and a user device subnet; wherein said selecting, for each device, a subnet based on a usage profile of the device and connecting the device thereto comprises: identifying user devices and connecting the user devices to the user device subnet; identifying IoT devices and connecting the IoT devices to the IoT subnet; whereby separating user devices and IoT devices to be on different subnets in the local network, and limiting communication therebetween.