Combined network and physical security appliance
The present disclosure describes a combined network and physical security appliance. The appliance may be wired to or communicate with automation systems, IoT devices, physical sensors, computing devices and servers on an internal or local network, and other computing devices on an external network. By combining network security and physical security into a single device, a combination security appliance may correlate physical sensor signals with packet inspection results, providing enhanced protection against network threats to physical security systems, and physical protection against network threats.
1. A security system, comprising:
a physical security device deployed coupled to one or more physical security sensors via a sensor interface; and
a network security device coupled to a first network and a second network;
wherein the physical security device or the network security device is configured to identify a correlation between a signal of the one or more physical security sensors and a received network packet.
2. The security system of claim 1 , further comprising a display device; and an interface switch, selectively coupling the display device to the physical security device or the network security device.
3. The security system of claim 1 , wherein at least one of the physical security device and the network security device is a virtual security device, and further comprising:
a processor;
a memory device; and
a network interface; and
a hypervisor configured to provide shared access, to the at least one virtual security device, to a common hardware layer comprising the processor, memory device, and network interface.
4. The security system of claim 3 , further comprising a display; and
wherein the hypervisor is further configured to provide shared access to the display to the physical security device and the network security device.
5. The security system of claim 1 , further comprising a combination security application, executed by the processor, comprising a first physical security user interface for the physical security device and a second network security user interface for the network security device.
6. The security system of claim 1 , wherein the sensor interface comprises a general purpose input/output (GPIO) interface, a serial interface, an Ethernet interface, a power line communication (PLC) interface, or a wireless communication interface.
7. The security system of claim 1 , further comprising a first network interface coupled to the first network and a second network interface coupled to the second network.
8. The security system of claim 1 , wherein the network security device is configured to communicate via the first network to an automation device, the automation device associated with a physical security sensor of the one or more physical security sensors.
9. The security system of claim 8 , wherein the security system is further configured to identify a temporal correlation between a trigger of the physical security sensor and a received network packet, from one of the first network or the second network, associated with the automation device.
10. The security system of claim 9 , wherein the security system is further configured to generate an alert, responsive to the identification of the temporal correlation between the trigger of the physical security sensor and the received network packet.
11. The security system of claim 10 , wherein the security system is further configured to generate the alert, responsive to the trigger of the physical security sensor being received within a predetermined time period from the received network packet, and the trigger of the physical security sensor not being expected as a result of the received network packet.
12. The security system of claim 8 , wherein the security system is further configured to generate an alert, responsive to a lack of temporal correlation between a trigger of the physical security sensor and a received network packet, from one of the first network or the second network, associated with the automation device.
13. The security system of claim 12 , wherein the security system is further configured to generate the alert, responsive to a trigger of the physical security sensor not being received within a predetermined time period from the received network packet, the trigger of the physical security sensor being expected as a result of the received network packet.
14. A method, comprising:
receiving, by a combination physical security and network security system, a network packet;
identifying, by the combination physical security and network security system, an automation device as a source or destination of the network packet;
determining, by the combination physical security and network security system, that the network packet comprises an automation trigger;
forwarding, by the combination physical security and network security system, the network packet to the destination of the network packet; and
monitoring, by the combination physical security and network security system, an output of a physical security sensor associated with the automation device, responsive to the determination that the network packet comprises an automation trigger.
15. The method of claim 14 , further comprising:
generating, by the combination physical security and network security appliance, an alert, responsive to an absence of the signal from the security sensor prior to expiration of a timer.
16. The method of claim 14 , further comprising:
determining, by the combination physical security and network security appliance, that a signal is not expected from the security sensor responsive to execution, by the automation device, of the automation trigger.
17. The method of claim 16 , further comprising:
generating, by the combination physical security and network security appliance, an alert, responsive to detecting a signal from the security sensor prior to expiration of a timer.
18. The method of claim 14 , wherein the automation device is the source of the network packet and wherein forwarding the network packet to the destination further comprises forwarding the network packet via an external network to the destination.
19. The method of claim 14 , wherein the automation device is the destination of the network packet and wherein forwarding the network packet to the destination further comprises forwarding the network packet via an internal network.
20. The method of claim 14 , further comprising:
receiving, by the combination physical security and network security system, a second network packet;
identifying, by the combination physical security and network security system, that the automation device is neither a source nor destination of the second network packet; and
generating, by the combination physical security and network security appliance, an alert, responsive to detecting a signal from the physical security sensor associated with the automation device prior to expiration of a timer and responsive to identifying that the automation device is neither the source nor destination of the second network packet.