TECHNICAL FIELD

The present systems and processes relate generally to the identification and management of internet of things (IoT) devices.

BACKGROUND

Previous approaches to managing IoT devices fail to provide systems and processes for identifying and managing IoT devices from a single, centralized interface. Consequently, previous solutions may not provide suitable infrastructure for supporting regular evaluation and maintenance of all IoT devices of a system, thereby potentially rendering each IoT device and the overall system vulnerable to attack and misuse. IoT devices can function as points of vulnerability when not managed properly and regularly. For example, failure to regularly audit and update credential policies, security settings, firmware versions, and other configuration properties of an IoT device can increase a risk that the IoT device will be accessed by unauthorized entities using known vulnerabilities. The exploitation of an IoT device by attackers can threaten not only the function of the individual device but may also render a system connected to the IoT device vulnerable to malicious activities. For example, an IoT device configured for access using default credentials or having a known vulnerability may be exploited by a malicious attacker that uses the IoT device as an access point from which other attacks are launched against a larger system connected to the IoT device. In another example, an IoT device may include an open port by which an attacker can communicate with the device.

Effective management of IoT devices can be challenging due to a variety of factors including, but not limited to, difficulties in tracking and configuring most-current or most-optimal settings and firmware on a variety of devices, difficulties in preventing employees from connecting unknown IoT devices to a network, difficulties in knowing when an IoT device may have a vulnerability (e.g., a printer may run a Linux operating system with security vulnerabilities if not updated), difficulties in identifying proper credentials for accessing devices. Because a system may include tens to thousands of IoT devices of varying make, model, and function, the large and diverse volume of devices can drastically increase the potential time and effort required to efficiently access, evaluate, and update each device.

Therefore, there is a long-felt but unresolved need for a system or process that allows for effective and efficient identification and management of IoT devices.

BRIEF SUMMARY OF THE DISCLOSURE

The present systems and processes relate generally to identifying devices on a network, performing a deep analysis of capabilities of the devices, determining and initiating updates of the identified devices. Briefly described, and according to one embodiment, aspects of the present disclosure generally relate to systems and processes for secure identification, evaluation, and maintenance of IoT devices.

In at least one embodiment, as used herein, “IoT device” can refer to a device connected to a networked environment with the ability to transfer data over a network without requiring human-to-human or human-to-computer interaction. In the proceeding description, IoT devices are generally referred to as devices. Non-limiting examples of such devices include consumer electronics, peripherals, appliances, home/office automation, communications/networking equipment, entertainment systems, alarm systems, and any other systems including embedded processors or computing technology.

Systems and processes described herein can support the identification and management of one or more devices. Identification includes, for example, scanning networks, or other operating environments, for devices that may be represented by network addresses. In one example, the system determines makes, models, and versions of detected devices, based on network addresses thereof, to support their identification and management. The system can use various data sources, as well as heuristics-, rules-, and/or machine learning-based techniques for device identification. For example, the system can include a data store comprising information describing various device families (e.g., classes of devices corresponding to a similar or identical model, grouping, make, or manufacturer). In another example, the system leverages signature analysis techniques across multiple feature spaces and modalities to securely identify devices.

Management includes, for example, securely upgrading versions of firmware, drivers, and etc., updating policies for configuration of credentials, and disabling settings that, when enabled, may render a device more vulnerable to attack. The system can determine upgrade paths for upgrading elements of a device, such as firmware, from a first version (e.g., that may be outdated and introduce security vulnerabilities) to a second version, such as a most-recently released version of firmware from a manufacturer of the device. The system can communicate with a Privileged Asset Management (PAM) system to update credential rules and policies that are used to control the generation of credentials for accessing specific devices or families of devices. Machine learning (either supervised or unsupervised) and/or heuristics techniques may be used for matching devices with configured firmware, credentials, and other configuration updates.

The system can perform a deep asset identification process to detect and interrogate devices. The system can scan one or more networks and identify one or more devices connected to the networks. For each identified device, the system can determine a corresponding device family associated therewith and, further, can determine properties of the device family, such as, for example, an interrogation profile that provides specific details for how to interrogate devices corresponding to the device family. For example, the interrogation profile can allow the system to implement computer-based use of a user interface and/or utilize an application programming interface (API) for managing various aspects of devices of the device family. Based on the interrogation profile of the corresponding device family, the system can interrogate each device, determine device data thereof, such as a current firmware image and configuration properties, and perform updates or modifications of the current properties or firmware to ensure the device is secure against attacks.

The system can perform a managed updated process to update or modify various properties, software, and firmware of various devices. The system can determine (e.g., based on device data from an interrogation process) a version of a current firmware image, configuration properties, and other settings of a device. Based on the current firmware image, configuration properties, or other settings, the system can determine an optimal or configured version of the firmware image, configuration properties, or other settings to which the device may be updated or changed. In one example, a sequence of firmware image versions are stored in a blockchain ledger store and the system obtains and verifies a firmware image from the blockchain ledger store when changing the firmware of a device from a current (“first”) firmware image to a second firmware image. In the same example, based on an upgrade path, the system can update the first firmware image to an intermediary firmware image and, finally, to a second firmware image. The determination of upgrade or downgrade paths (both referred to herein as upgrade path) allows for a device to be properly upgraded or downgraded, for example, in instances where the device was disconnected from an upgrade management system, initially installed with a default version, or neglected by an administrator and, thus, has experienced multi-version lapses in upgrading from previous versions of firmware or other configuration properties that may leave the device vulnerable to attacks. Similarly, the system can skip or avoid specific versions of firmware based on the upgrade path. The upgrade path may include an indication that one or more versions of firmware contain vulnerabilities or bugs that should be avoided.

The system can manage credentials for devices on one or more networks (e.g., the devices having been identified and interrogated). The system can generate and apply credential or password policies based on policies for specific devices or families in a data store, heuristics, machine learning processes, or combinations thereof, to enforce the use of credentials and passwords optimized for ensuring device security. The system can determine credential or password requirements for each family of devices on the one or more networks and can update credentials on devices thereof according to the requirements and policies. In various embodiments, the system may not generate or store credentials or passwords and, instead, credentials and passwords are generated and securely stored in a privileged asset management (PAM) system. The PAM system may be unaware of the specific devices and is only aware of credentials as well as the requirements and policies provided by the system in requests for generation or retrieval of corresponding credentials.

The system can perform various functions on a system-wide or network-wide basis in which all devices connected to one or more networks are identified, individually interrogated, and/or individually updated to a particular version of firmware or other configuration. It will be understood that, in addition to system-wide updates, updates can correspond to a subset of devices or device families identified by the system.

These and other aspects, features, and benefits of the claimed systems and processes will become apparent from the following detailed written description of the preferred embodiments and aspects taken in conjunction with the following drawings, although variations and modifications thereto may be effected without departing from the spirit and scope of the novel concepts of the disclosure.

