US 2022/0239680 A1Published application

METHOD FOR GENERATING, SHARING AND ENFORCING NETWORK PROFILES FOR IoT DEVICES

AssigneeCheckpoint Software Technologies Ltd.

InventorsDaniel Cohen-Sason, Pini Shamgar, Yevgeny Fabrikant

Life of this patent

Estimating the term…

Loading patent…

Abstract

A method and system is provided for setting network policies based on electronic devices connected to a network. The electronic devices present on the network are detected and their behavior is captured using profiles. These profiles are then used to generate network policies based on the electronic devices connected to the network. Instead of reacting to behavior of the electronic devices (e.g., anomaly detection to detect malware), the method and system sets the network policies to prevent unauthorized communications (e.g., before malware is present in the system).

Claims20

Dependent claims

A method executed by circuitry for determining and sharing network profiles for electronic devices connected to a network, the method comprising:

determining with the circuitry a make and a function of each of the electronic devices;
for each of the electronic devices, using the circuitry to detect communications in the network involving the electronic device over a duration of time, wherein the detected communications include both incoming messages to the electronic device and outgoing messages from the electronic device;
generating profiles for the electronic devices using the circuitry, comprising:
for each of the electronic devices, determining properties of the detected communications involving the electronic device including:
for each of the detected communications, determining at least one of a protocol of the communication, a source of the communication, or a destination of the communication;
generate a profile for each of the electronic devices based on the determined properties of the detected communications, including:
a make and function of the electronic device;
acceptable communications enabled by the profile, wherein each of the acceptable communications includes a protocol, a source, and a destination;
sending the generated profiles with the circuitry to a server.

6 more elements

A server for sharing network profiles for electronic devices connected to a network, the server comprising:

a memory comprising a non-transitory computer readable medium configured to store profiles for the electronic devices, wherein each of the profiles is associated with a make and function, and includes at least two of a protocol, a source, and a destination for acceptable communications;
a network interface configured to receive a request for a profile including at least one make and function;
circuitry configured to:
identify applicable profiles comprising, for each of the received make and function of the request, identifying at least one profile associated with the make and function of the request as one of the applicable profiles;
generate a policy by combining each of the applicable profiles, wherein the combining of each of the applicable profiles includes:
identifying the acceptable communications included in the applicable profiles;
deduplicating the identified acceptable communications having a same protocol, source, and destination;
and
including in the policy the deduplicated acceptable communications.

6 more elements

A detecting electronic device for determining and sharing network profiles for electronic devices connected to a network, the detecting electronic device comprising:

a network interface configured to, for each of the electronic devices, detect communications in the network involving the electronic device over a duration of time, wherein the detected communications include both incoming messages to the electronic device and outgoing messages from the electronic device;
and
circuitry configured to:
determine a make and a function of each of the electronic devices;
generate profiles for the electronic devices comprising:
for each of the electronic devices, determining properties of the detected communications including:
for each of the detected communications, determining at least one of a protocol of the communication, a source of the communication, or a destination of the communication;
generate a profile for each of the electronic devices based on the determined properties of the detected communications, including:
a make and function of the electronic device;
and
acceptable communications each comprising a protocol, a source, and a destination;
output the generated profiles.

9 more elements

Dependencies are inferred from the claim text.

Facts

Application: 17/159,615Filed 27 Jan 2021
Published: 28 Jul 2022
Term ends: Not estimatedThe source records don’t support an estimate.

Classification8 codes

H04L 63/1425
By monitoring network traffic: traffic logging, e.g. anomaly detection
H04L 63/0236
Filtering policies: filtering by address, protocol, port number or service, e.g. IP-address or URL
H04L 63/20
Network architectures or network communication protocols for network security: for managing network security; network security policies in general
H04L 67/30
Architectures; Arrangements: profiles

Family

US 11,601,459 B2Related patent
US 2022/0239680 A1This patent

From the US filing history. Foreign family members aren’t listed.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key