# US 2019/0319950 A1 · Apparatus and methods for micro-segmentation of an enterprise internet-of-things network

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0319950 A1
- Document ID: US20190319950A1
- Status: Published application
- Kind: A1
- Application number: 15/951,408
- Filed: 2018-04-12
- Published: 2019-10-17
- Earliest claimed: 2018-04-12
- Assignees: Bank of America Corporation
- Applicants: Bank of America Corporation
- Inventors: John Ryan Bowling
- Web page: https://patentgrep.com/patent/US20190319950A1

## CPC

- H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint}
- H04L 63/02: {for separating internal from external traffic, e.g. firewalls}
- H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes}
- G16Y 30/10: Security thereof
- H04L 41/0894: Policy-based network configuration management
- H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
- H04W 4/70: Services for machine-to-machine communication [M2M] or machine type communication [MTC]
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G16Y: INFORMATION AND COMMUNICATION TECHNOLOGY SPECIALLY ADAPTED FOR THE INTERNET OF THINGS [IoT]
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Apparatus, systems, architectures and methods for communication over an enterprise internet-of-things (EIoT) network are disclosed. Network(s) may be micro-segmented. Network segment(s) may be associated with distinct function(s). EIoT device(s) may be identified by type(s), class(es), functionality(ies), function(s) and/or security level(s). EIoT device protocol(s) may be translated/emulated. EIoT device(s) may be temporarily/permanently quarantined. Network gateway(s) may factor EIoT device/network data based on function(s) and/or specification(s). Data may be routed to network segment(s) based on associated function(s).

## Claims

### Claim 1

A method for facilitating secure electronic communication between an enterprise internet-of-things (EIoT) device and an enterprise network system, the method comprising:
segmenting the system into a plurality of segments associated with a plurality of segment functions, a first of the segments associated with a first segment function, and a second of the segments associated with a second segment function;
using an identification layer, identifying:
the EIoT device;
protocols of the EIoT device; and
at least one characteristic of the EIoT device corresponding to at least one of the segment functions associated with at least one of the system segments;
using a translation layer, translating the communication based on the identified EIoT device protocols to conform to requirements of the system; and
using an authentication layer, restricting the communication, via a gateway that factors the at least one EIoT device characteristic and the corresponding segment function, to at least one predetermined communication type with the identified EIoT device, the communication type corresponding to the at least one system segment.

### Claim 2 (depends on 1)

The method of claim 1 wherein:
the identifying of the at least one characteristic includes:
detecting a first characteristic corresponding to the first segment function; and
detecting a second characteristic corresponding to the second segment function;
the method further includes:
deconstructing the EIoT device into:
a first EIoT device component including the first characteristic; and
a second EIoT device component including the second characteristic;
the translating includes enabling the communication for both the first component and the second component; and
the at least one communication type includes:
a first communication type corresponding to the first component; and
a second communication type corresponding to the second component.

### Claim 3

A method for securing electronic communication over an enterprise internet-of-things (EIoT) network, the method comprising:
micro-segmenting the EIoT network into a plurality of segments associated with a plurality of functions including:
a first segment associated with a first of the functions; and
a second segment associated with a second of the functions, the second segment isolated from the first segment;
detecting presence, on the EIoT network, of an unsecured EIoT device;
identifying:
EIoT device data including at least one functionality of the EIoT device; and
protocols of the EIoT device;
translating the protocols to network-compatible form;
determining, based on the device data:
a correspondence of the one functionality with the first function; and
a lack of correspondence of the one functionality with the second function;
assigning the EIoT device to the first segment for information transfer involving the functionality;
based on the assigning and using the translating, allowing the information transfer between the EIoT device and the first segment; and
blocking the information transfer between the EIoT device and the second segment.

### Claim 4 (depends on 3)

The method of claim 3 wherein the blocking includes electronically quarantining the EIoT device to an isolated network segment.

### Claim 5 (depends on 4)

The method of claim 4 wherein the quarantining is virtual.

### Claim 6 (depends on 4)

The method of claim 4 wherein the quarantining is physical.

### Claim 7 (depends on 3)

The method of claim 3 further comprising:
determining that a second functionality of the EIoT device corresponds with one of the plurality of functions;
performing an assignment of the EIoT device to at least one segment of the plurality of segments, the at least one segment associated with the corresponding one function, the assignment for information exchange involving the second functionality; and
based on the assignment, allowing the information exchange between the EIoT device and the at least one segment.

### Claim 8 (depends on 4)

The method of claim 4 further comprising:
electronically isolating the EIoT device quarantined in the isolated network segment from an application previously quarantined in the isolated network segment.

### Claim 9 (depends on 3)

The method of claim 3 wherein the EIoT device includes a virtual EIoT device.

### Claim 10 (depends on 3)

The method of claim 3 wherein the EIoT device includes a physical EIoT device.

### Claim 11 (depends on 3)

The method of claim 3 wherein the translating of the EIoT protocols includes emulating the EIoT protocols.

### Claim 12

An enterprise internet-of-things (EIoT) secure communication system architecture comprising:
at least one EIoT device associated with an unsecured network; and
an enterprise system including:
at least one enterprise processor;
at least one enterprise network including software and hardware connections; and
at least one non-transitory computer-readable medium storing program code including machine-readable instructions for instructing the processor to perform a method for facilitating secure electronic communication over the network connections between the EIoT device and the system, the method including:
micro-segmenting the enterprise network into a plurality of network segments, each of the network segments associated with one of a plurality of network functions;
detecting presence of the EIoT device;
identifying protocols of the EIoT device;
translating the protocols for the communication with the system;
identifying functional characteristics of the EIoT device;
determining, based on the EIoT device characteristics, at least one of the network functions associated with the EIoT device; and
routing the communication to a segment corresponding to the at least one determined function.

### Claim 13 (depends on 12)

The system architecture of claim 12 further comprising:
an electronic display controlled by the at least one processor; and
an electronic input device in electronic communication with the at least one processor;
wherein:
the at least one non-transitory computer-readable medium further stores program code including machine-readable instructions for instructing the processor to present, via the display, a user interface including features configured for executing one or more steps of the method via the input device.

### Claim 14 (depends on 13)

The system architecture of claim 13 wherein the input device includes both hardware and software exclusively dedicated to performing the one or more steps of the method.

### Claim 15 (depends on 12)

The system architecture of claim 12 wherein the translating of the EIoT protocols includes emulating the EIoT protocols.