Information handling system threat management
View Patent ↗Plural Internet of Things (IoT) gateways detect, secure against and remediate malicious code with an autonomous communication of tokens between the IoT gateways on a time schedule. Detection of an invalid token or a token communication outside of a scheduled time indicates that malicious code may have interfered with token generation or communication. Verification of a token communication to an IoT gateway that failed in turn to pass the token to another IoT gateway indicates that the IoT gateway is a threat that may include malicious code.
1. A method for detecting malicious code at Internet of Things (IoT) nodes, the system comprising:
interfacing plural IoT nodes through wireless communications;
defining at each node a schedule for token transfers between the plural IoT nodes;
determining at a first IoT node a failure to receive a valid token transfer from a second IoT node at a scheduled time;
in response to the determining, querying from the first IoT node to a third IoT node for confirmation of a valid token transfer by the third IoT node to the second IoT node; and
in response to the querying, isolating the second IoT node if the third IoT node fails to confirm the valid token transfer to the second IoT node;
wherein determining at a first IoT node a failure to receive a valid token transfer from a second IoT node at a scheduled time further comprises either one of:
receiving a token having an invalid signature; or
receiving a token having a valid signature outside of a predetermined time window; and
wherein:
the predetermined time window recurs at an interval; and
the interval length varies depending at least in part on payload size communicated from one or more of the IoT nodes.
2. The method of claim 1 further comprising:
in response to the querying, failing to receive a response to the querying from the third IoT node to the first IoT node; and
isolating the third IoT node.
3. The method of claim 1 wherein isolating the second IoT node further comprises broadcasting from the first IoT node a threat status of the second IoT node.
4. The method of claim 1 wherein isolating the second IoT node further comprises broadcasting from the third IoT node a threat status of the second IoT node.
5. The method of claim 1 wherein the plural IoT nodes comprise plural gateways interfaced in a round robin configuration.
6. The method of claim 1 wherein the plural IoT nodes comprise plural gateways interfaced in a star configuration.
7. The method of claim 1 wherein the plural IoT nodes comprise plural gateways interfaced in a random configuration.
8. An IoT security system comprising:
non-transitory memory integrated in each of plural IoT devices;
a security module stored in the non-transitory memory in each of the plural IoT devices, the plural IoT devices interfaced by a network, each security module operable to send a token to one or more of the plural IoT devices at predetermined time windows;
a verification module stored in the non-transitory memory of each of the plural IoT devices, the verification module operable to receive tokens from one or more of the plural IoT devices, to store a receive time for each received token, and to compare each received token's content and receive time with expected content and expected receive time to validate the token; and
a security configuration module stored in the non-transitory memory of each of the plural IoT devices, the security configuration module operable to schedule one or more of the plural IoT devices as targets for the security module to send one or more tokens at one or more times, the security configuration module further operable to schedule the verification module to receive one or more tokens from one or more of the plural IoT devices at one or more expected receive times.
9. An IoT security system comprising:
non-transitory memory integrated in each of plural IoT devices;
instructions stored in the non-transitory memory that when executed on a processor provide a security module stored in the non-transitory memory in each of the plural IoT devices, the plural IoT devices interfaced by a network, each security module operable to send a token to one or more of the plural IoT devices at predetermined time windows;
instructions stored in the non-transitory memory that when executed on a processor provide a verification module stored in the non-transitory memory of each of the plural IoT devices, the verification module operable to receive tokens from one or more of the plural IoT devices, to store a receive time for each received token, and to compare each received token's content and receive time with expected content and expected receive time to validate the token; and
instructions stored in the non-transitory memory that when executed on a processor provide a security configuration module stored in the non-transitory memory of each of the plural IoT devices, the security configuration module operable to schedule one or more of the plural IoT devices as targets for the security module to send one or more tokens at one or more times, the security configuration module further operable to schedule the verification module to receive one or more tokens from one or more of the plural IoT devices at one or more expected receive times; and
a security configuration server interfaced with the network and operable to define a security configuration having token content and expected receive times at one or more of the plural IoT devices.
10. The IoT security system of claim 9 wherein the security configuration comprises plural IoT gateway devices interfaced in a round robin configuration, each IoT gateway device sending a token to one of the plural IoT gateway devices and receiving a token from another one of the plural IoT gateway devices.
11. An IoT security system comprising:
non-transitory memory integrated in each of plural IoT devices;
instructions stored in the non-transitory memory that when executed on a processor provide a security module stored in the non-transitory memory in each of the plural IoT devices, the plural IoT devices interfaced by a network, each security module operable to send a token to one or more of the plural IoT devices at predetermined time windows;
instructions stored in the non-transitory memory that when executed on a processor provide a verification module stored in the non-transitory memory of each of the plural IoT devices, the verification module operable to receive tokens from one or more of the plural IoT devices, to store a receive time for each received token, and to compare each received token's content and receive time with expected content and expected receive time to validate the token; and
instructions stored in the non-transitory memory that when executed on a processor provide a security configuration module stored in the non-transitory memory of each of the plural IoT devices, the security configuration module operable to schedule one or more of the plural IoT devices as targets for the security module to send one or more tokens at one or more times, the security configuration module further operable to schedule the verification module to receive one or more tokens from one or more of the plural IoT devices at one or more expected receive times; and
wherein the verification module is further operable to detect failure to receive a token at a receive time from a first of the plural IoT devices and, in response, to query a second of the plural IoT devices to verify that the second IoT device sent a token to the first IoT device.