Containerized architecture to manage internet-connected devices
A containerized architecture to secure and manage Internet-connected devices, such as “Internet of Things” devices, is disclosed. In various embodiments, one or more containerized applications are run, e.g., on an Internet of Things gateway, subject to management by the management server. At least one of the containerized applications is a management agent configured to participate, subject to control of the management server, in management of one or more other of said containerized applications.
1. A system, comprising:
a communication interface; and
a processor coupled to the communication interface and configured to:
communicate via the communication interface with a management server;
install one or more containerized applications on an Internet of Things (IoT) gateway, at least one of said containerized applications comprising a management agent, wherein one or more of said containerized applications other than said management agent each comprises a sensor driver application; and
run the one or more containerized applications subject to management by the management server, wherein the management agent is configured to participate, subject to control of the management server, in management of one or more other of said containerized applications including by:
communicating via a security proxy with one or more associated backend services remote from the management server based at least in part on security posture data received from the management server indicating whether the gateway is compliant with a security policy, and
configuring at least one of the sensor driver applications to implement the security posture data by permitting or denying access to an associated sensor, including by designating one or more specific backend applications as being permitted to communicate with one or more specific sensors, wherein at least one of the one or more specific backend applications is configured to:
gather sensor data locally at the IoT gateway, and
in response to the sensor data meeting a threshold, send the sensor data to the associated backend services via the security proxy.
2. The system of claim 1 , wherein the sensor driver application functions as an input/output (I/O) multiplexer for a physical interface via which said sensor is connected.
3. The system of claim 1 , wherein one or more other of said containerized applications other than the management agent each comprises an Internet-of-Things (IoT) smart application configured to receive and use sensor data generated by said sensor, subject to management by one or both of said management server and said management agent.
4. The system of claim 3 , wherein each of said IoT smart applications is configured to communicate via a security proxy with one or more associated backend services.
5. The system of claim 4 , wherein said security proxy is configured to enforce one or more policies associated with said communications by said smart application.
6. The system of claim 5 , wherein said security proxy is configured to take a responsive action with respect to communications by said smart application based at least in part on a security posture data received from said management server.
7. The system of claim 6 , wherein said management server is configured to determine said security posture data based at least in part on data received from the system.
8. The system of claim 1 , wherein the system comprises the Internet of Things (IoT) gateway, and further comprising installing said one or more containerized application on the gateway.
9. The system of claim 1 , wherein an IoT gateway app store interface and server are used to install said one or more containerized applications.
10. The system of claim 9 , wherein said one or more containerized applications are included in a set of containerized applications presented via said IoT gateway app store interface as being available to be installed on said gateway.
11. The system of claim 10 , wherein said set of containerized applications are selected to be presented via said IoT gateway app store interface as being available to be installed on said gateway based at least in part on one or both of a policy and a user or other group with which the gateway is determined to be associated.
12. A method, comprising:
communicating via a communication interface with a management server;
installing one or more containerized applications on an Internet of Things (IoT) gateway, at least one of said containerized applications comprising a management agent, wherein one or more of said containerized applications other than said management agent each comprises a sensor driver application; and
running the one or more containerized applications subject to management by the management server, wherein the management agent is configured to participate, subject to control of the management server, in management of one or more other of said containerized applications including by:
communicating via a security proxy with one or more associated backend services remote from the management server based at least in part on security posture data received from the management server indicating whether the gateway is compliant with a security policy, and
configuring at least one of the sensor driver applications to implement the security posture data by permitting or denying access to an associated sensor, including by designating one or more specific backend applications as being permitted to communicate with one or more specific sensors, wherein at least one of the one or more specific backend applications is configured to:
gather sensor data locally at the IoT gateway, and
in response to the sensor data meeting a threshold, send the sensor data to the associated backend services via the security proxy.
13. The method of claim 12 , wherein one or more of said containerized applications other than said management agent each comprises a sensor driver application configured by one or both of said management server and said management agent to provide managed access to a sensor associated with a system including said containerized applications.
14. The method of claim 13 , wherein one or more other of said containerized applications other than the management agent each comprises an Internet-of-Things (IoT) smart application configured to receive and use sensor data generated by said sensor, subject to management by one or both of said management server and said management agent.
15. The method of claim 14 , wherein each of said IoT smart applications is configured to communicate via a security proxy with one or more associated backend services.
16. The method of claim 15 , wherein said security proxy is configured to enforce one or more policies associated with said communications by said smart application.
17. The method of claim 16 , wherein said security proxy is configured to take a responsive action with respect to communications by said smart application based at least in part on a security posture data received from said management server.
18. A computer program product embodied in a non-transitory computer readable medium and comprising computer instructions for:
communicating via a communication interface with a management server;
installing one or more containerized applications on an Internet of Things (IoT) gateway, at least one of said containerized applications comprising a management agent, wherein one or more of said containerized applications other than said management agent each comprises a sensor driver application; and
running the one or more containerized applications subject to management by the management server, wherein the management agent is configured to participate, subject to control of the management server, in management of one or more other of said containerized applications including by:
communicating via a security proxy with one or more associated backend services remote from the management server based at least in part on security posture data received from the management server indicating whether the gateway is compliant with a security policy, and
configuring at least one of the sensor driver applications to implement the security posture data by permitting or denying access to an associated sensor, including by designating one or more specific backend applications as being permitted to communicate with one or more specific sensors, wherein at least one of the one or more specific backend applications is configured to:
gather sensor data locally at the IoT gateway, and
in response to the sensor data meeting a threshold, send the sensor data to the associated backend services via the security proxy.
19. The computer program product of claim 18 , wherein one or more of said containerized applications other than said management agent each comprises a sensor driver application configured by one or both of said management server and said management agent to provide managed access to a sensor associated with a system including said containerized applications.