System for coordinative security across multi-level networks
In some aspects, the disclosure is directed to methods and systems for providing coordinative security among network devices across multi-level networks. Shared cryptographic secrets among the network devices are used as the basis for mutual security authentication and peering among these devices. The cryptographic secrets can be embedded in the SoC devices for these devices or dynamically generated based on unique identification information and attributes of these SoC devices. The messages for authentication and peering can be communicated directly among the network devices or indirectly via a cloud security portal entity that acts as a messaging proxy. The mutual authentication and peering process can be carried out coordinately among the network devices and a cloud security portal in a one-to-one mesh relationship, or in a transitive layering relationship, where each network entity authenticates and peers with its direct subordinates in a multi-level network.
1. A method for hierarchical chain-of-security-monitoring of network devices, comprising:
receiving, by a control server device from each of a plurality of additional devices deployed in a physical multi-tier hierarchy, an identification of security capabilities of each of the plurality of additional devices, wherein a first additional device at a first level of the physical multi-tier hierarchy forwards an identification of security capabilities from a second additional device at a second, lower level of the physical multi-tier hierarchy, and the second additional device is a child of the first additional device in the physical multi-tier hierarchy;
determining, by the control server device, that a security capability of the second additional device exceeds a security capability of the first additional device;
responsive to the determination, assigning the second additional device to a first level of a logical multi-tier hierarchy and the first additional device to a second, lower level of the logical multi-tier hierarchy, by the control server device, wherein the first additional device is a child of the second additional device in the logical multi-tier hierarchy, the logical multi-tier hierarchy based on security capabilities of each additional device;
wherein the second additional device applies one or more security policies to data communicated with the first additional device by a third device, responsive to the first additional device being a child of the second additional device in the logical multi-tier hierarchy;
wherein the second additional device receives an identification of packets transmitted to or from the first additional device; and
wherein the second additional device directs the first additional device to discard a subset of the packets transmitted to or from the first additional device corresponding to a filtering policy.
2. The method of claim 1 , wherein the security policies comprise applying filtering policies to packets transmitted to or from the first additional device.
3. The method of claim 2 , wherein the filtering policies are generated by a machine learning system of the third device trained from a historical record of data communicated by the plurality of additional devices.
4. The method of claim 1 , wherein the second additional device directs the first additional device to discard the subset of the packets responsive to the packets transmitted to or from the first additional device exceeding a threshold corresponding to the filtering policy.
5. The method of claim 1 , wherein the second additional device receives the identification of packets transmitted to or from the first additional device via a first physical layer connection.
6. The method of claim 5 , further comprising receiving, by the control server device from the first additional device, the identification of packets transmitted to or from the first additional device; and forwarding, by the control server device to the second additional device, the received identification.
7. A system for hierarchical chain-of-security-monitoring of network devices, comprising:
a control server device in communication with a plurality of additional devices deployed in a physical multi-tier hierarchy configured to:
receive, from each additional device, an identification of security capabilities of the additional device, wherein a first additional device at a first level of the physical multi-tier hierarchy forwards an identification of security capabilities from a second additional device at a second, lower level of the physical multi-tier hierarchy, and the second additional device is a child of the first additional device in the physical multi-tier hierarchy;
determine that a security capability of the second additional device exceeds a security capability of the first additional device; and
responsive to the determination, assign the second additional device to a first level of a logical multi-tier hierarchy and the first additional device to a second, lower level of the logical multi-tier hierarchy, wherein the first additional device is a child of the second additional device in the logical multi-tier hierarchy, the logical multi-tier hierarchy based on security capabilities of each additional device;
wherein the second additional device applies one or more security policies to data communicated with the first additional device by a third device, responsive to the first additional device being a child of the second additional device in the logical multi-tier hierarchy;
wherein the second additional device receives an identification of packets transmitted to or from the first additional device; and
wherein the second additional device directs the first additional device to discard a subset of the packets transmitted to or from the first additional device corresponding to a filtering policy.
8. The system of claim 7 , wherein the security policies comprise applying filtering policies to packets transmitted to or from the first additional device.
9. The system of claim 8 , wherein the filtering policies are generated by a machine learning system of the third device trained from a historical record of data communicated by the plurality of additional devices.
10. The system of claim 7 , wherein the second additional device directs the first additional device to discard the subset of the packets responsive to the packets transmitted to or from the first additional device exceeding a threshold corresponding to the filtering policy.
11. The system of claim 10 , wherein the second additional device receives the identification of packets transmitted to or from the first additional device via a first physical layer connection.
12. The system of claim 11 , wherein the control server device is further configured to receive, from the first additional device, the identification of packets transmitted to or from the first additional device; and forward, to the second additional device, the received identification.