Information handling system threat management

1. A method for isolating a selected of plural Internet of Things (IoT) gateway nodes, the method comprising:

interfacing plural IoT gateway nodes through wireless communications;

defining at each IoT gateway node a schedule for token transfers between the plural IoT nodes, the schedule including at least a first time to transfer the token from a first IoT gateway node to a second IoT gateway node and a second time to transfer the token from the second IoT gateway node to a third IoT gateway node;

monitoring token transfers for compliance with the schedule;

identifying a failed one of the plural IoT gateway nodes as associated with a token transfer failure, the failed token transfer at the second IoT gateway node identified by the third IoT gateway node failure to receive the token from the second IoT gateway node at the third time;

in response to the identifying, defining a quarantine schedule for token transfers that excludes the second IoT gateway node, the quarantine schedule including at least a fourth time to transfer the token from the first IoT gateway node to the third IoT gateway node;

monitoring token transfers for compliance with the quarantine schedule;

querying plural near-nodes of the second IoT gateway node for predetermined attributes; and

based upon the predetermined attributes, assigning one or more functions of the second gateway node to one or more of plural IoT gateway nodes.

2. The method of claim 1 wherein the querying and the assigning are performed by one of the plural IoT gateway nodes.

3. The method of claim 2 wherein the assigning further comprises assigning sensor IoT nodes from reporting to the second IoT gateway node to instead report to one or more of the plural near-nodes.

4. The method of claim 1 wherein the predetermined attributes comprise a load assigned to the second IoT gateway node.

5. The method of claim 1 wherein the predetermined attributes comprise a predefined map of the plural IoT gateway nodes.

6. The method of claim 1 wherein the predetermined attributes comprise a reporting cycle of sensor IoT nodes assigned to the second IoT gateway node, the method further comprising reducing the reporting cycle of the IoT sensors.

7. The method of claim 1 further comprising remediating the second IoT gateway node from a selected of the plural near-nodes by re-imaging the second IoT gateway node with an image retrieved out of band by the selected of the plural near-nodes.

8. The method of claim 1 further comprising:

receiving a valid token from the second IoT gateway node; and

in response to the valid token, re-defining a schedule for token transfer that includes the second IoT gateway node.

9. An IoT security system comprising:

non-transitory memory integrated in each of plural IoT gateway nodes;

a verification module stored in the non-transitory memory of each of the plural IoT gateway nodes, the verification module operable to receive tokens from one or more of the plural IoT gateway nodes and to compare each received token's content and receive time with expected content and expected receive time of a schedule to validate or invalidate the token, the schedule including at least a first time to transfer the token from a first IoT gateway node to a second IoT gateway node and a second time to transfer the token from the second IoT gateway node to a third IoT gateway node, the invalidated token including at least a failed token transfer at the second IoT gateway node identified by the third IoT gateway node failure to receive the token from the second IoT gateway node at the third time;

a quarantine module stored in the non-transitory memory of each of the plural IoT gateway nodes, the quarantine module operable to define a quarantine schedule for token transfers between the IoT gateway nodes that excludes a failed IoT gateway node associated with an invalidated token, the quarantine schedule including at least a fourth time to transfer the token from the first IoT gateway node to the third IoT gateway node; and

a function allocation module stored in the non-transitory memory of each of the plural IoT gateway nodes, the function allocation module operable to query near nodes of the failed IoT gateway node for predetermined attributes and to apply the predetermined attributes to assign one or more functions of the failed IoT gateway node to one or more of the plural near nodes.

10. The IoT security system of claim 9 wherein the predetermined attributes comprise a number of sensor IoT devices supported by each of the plural near nodes.

11. The IoT security system of claim 9 wherein the predetermined attributes comprise bandwidth used by each of the plural near nodes.

12. The IoT security system of claim 9 wherein the quarantine module identifies failed IoT nodes by issuing a check to each IoT gateway node on the schedule and identifying as failed all IoT gateway nodes that fail to acknowledge the check.

13. The IoT security system of claim 12 wherein the check comprises a token having a secret content.

14. An IoT gateway node quarantine method comprising:

defining a schedule to pass a token to each of plural IoT gateway nodes, the schedule including at least a first time to transfer the token from a first IoT gateway node to a second IoT gateway node and a second time to transfer the token from the second IoT gateway node to a third IoT gateway node;

detecting failure by one of the plural IoT gateway nodes to send the token according to the schedule, the failure including at least a failed token transfer at the second IoT gateway node identified by the third IoT gateway node failure to receive the token from the second IoT gateway node at the third time;

defining a quarantine schedule that excludes the failed one of the plural IoT gateway nodes, the excluding the failed one of the plural IoT gateway nodes including at least excluding the second IoT gateway node, the quarantine schedule including at least a fourth time to transfer the token from the first IoT gateway node to the third IoT gateway node;

monitoring token communications for failure of any of the plural IoT gateway nodes to communicate a token in accordance with the quarantine schedule; and

remediating the failed one of the plural IoT gateway nodes from a selected of the plural IoT gateway-nodes by re-imaging the failed one of the plural IoT gateway nodes with an image retrieved out of band by the selected of the plural IoT gateway-nodes.

15. The IoT gateway quarantine method of claim 14 further comprising:

detecting a valid token communication associated with the failed one of the plural IoT gateway nodes;

defining the schedule to pass a token to each of the plural IoT gateway nodes including the failed one of the plural IoT gateway nodes; and

monitoring token communications in accordance with the schedule.

16. The IoT gateway quarantine method of claim 14 wherein defining a quarantine schedule further comprises having the IoT gateway node in the schedule that passes the token to a failed IoT gateway node instead pass the token to the IoT gateway node in the schedule that receives the token from the failed IoT gateway node.

17. The method of claim 14 further comprising:

retrieving a copy of an image of executable code from the failed IoT gateway node to another of the IoT gateway nodes; and

sending the copy of the image through the network to a network location.

18. The method of claim 14 further comprising:

analyzing at one of the IoT gateway nodes attributes of the other IoT gateway nodes on the schedule; and

based upon the analyzing, assigning one or more functions of the failed IoT gateway node to the one or more of the other IoT gateway nodes.