Security for network computing environment using centralized security system
Systems, methods, and articles of manufacture comprising processor-readable storage media are provided for implementing security for a network environment using a centralized smart security system. For example, a method includes implementing a network comprising a plurality of network devices which collectively generate data that is utilized by a computing system to execute an application, and implementing a centralized security system as a computing node within the network to manage security operations within the network and to establish secured and trusted communications between the network devices and the computing system. The network devices may comprise wireless sensor devices operating in a wireless sensor network, wherein the computing system executes an IoT (Internet of Things) application which processes the data that is generated by the wireless sensor devices.
1. A method, comprising:
receiving, by a centralized security system which is configured to operate within a machine-to-machine communication network as a security layer between a plurality of devices operating within the network and a computing system which hosts an application that is utilized by the devices, a digital certificate from a given device requesting access to the computing system, the digital certificate being previously issued to the given device by the centralized security system in response to the given device registering with the centralized security system and being authenticated as a trusted device to operate within the network;
initiating, by the centralized security system, a secured communications channel between the centralized security system and the given device, in response to the centralized security system determining that the digital certificate received from the given device is valid;
receiving, by the centralized security system, a request from the given device over the secured communications channel to access the computing system to perform a requested operation, the received request being encrypted using a session key issued by the centralized security system, and the received request comprising device identifying information of the given device;
processing, by the centralized security system, the received request to determine if the requested operation is trusted;
denying, by the centralized security system, the received request to perform the requested operation, in response to determining that the requested operation is not trusted; and
sending, by the centralized security system, the received request to the computing system, in response to the centralized security system determining that the given device is valid based on the device identifying information in the received request and that the requested operation is trusted;
wherein the centralized security system comprises at least one processor operatively coupled to a memory having stored therein program code, wherein the program code is executable by the at least one processor to implement one or more of the above steps.
2. The method of claim 1 , wherein the machine-to-machine communication network comprises a wireless sensor network.
3. The method of claim 1 , wherein the plurality of devices operating within the network comprise wireless sensor devices.
4. The method of claim 1 , comprising determining whether the given device is valid by comparing the device identifying information in the received request against corresponding device identifying information associated with the digital certificate which was received from the given device and deemed valid by the centralized security system.
5. The method of claim 4 , comprising denying the received request, by the centralized security system, in response to the given device not being validated based on the extracted device identifying information.
6. The method of claim 5 , comprising invalidating the digital certificate of the given device, which was issued by the centralized security system to the given device, in response to the given device not being validated based on the extracted device identifying information.
7. The method of claim 1 , comprising:
registering the centralized security system with the computing system; and
registering the plurality of devices with the centralized security system.
8. The method of claim 7 , wherein:
registering the centralized security system with the computing system comprises:
generating, by the centralized security system, a certificate signing request;
transmitting, by the centralized security system, the certificate signing request to the computing system; and
receiving, by the centralized security system, a signed digital certificate which authenticates an identity of the centralized security system and which is utilized to establish secured communications between the centralized security system and the computing system; and
registering the plurality of devices with the centralized security system comprises:
receiving, by the centralized security system, a certificate signing request from a given device requesting registration as a trusted device; and
generating, by the centralized security system, a signed digital certificate, which authenticates an identity of the given device as a trusted device, and which is utilized to establish secured communications between the centralized security system and the given device.
9. The method of claim 1 , comprising:
receiving, by the centralized security system, device operational data from the plurality of devices operating within the network, wherein the device operational data comprises at least one of power usage data and resource usage data as reported by the devices operating within the network;
processing, by the centralized security system, the device operational data to detect anomalous behavior of the devices operating within the network; and
preventing, by the centralized security system, a given device from operating within the network in response to detecting that the given device is exhibiting anomalous behavior.
10. The method of claim 1 , comprising:
obtaining, by the centralized security system, a patch from the computing system; and
the centralized security system automatically installing the patch in one or more of the devices operating within the network.
11. An article of manufacture comprising a non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code is executable by one or more processors to implement a method comprising:
receiving, by a centralized security system which is configured to operate within a machine-to-machine communication network as a security layer between a plurality of devices operating within the network and a computing system which hosts an application that is utilized by the devices, a digital certificate from a given device requesting access to the computing system, the digital certificate being previously issued to the given device by the centralized security system in response to the given device registering with the centralized security system and being authenticated as a trusted device to operate within the network;
initiating, by the centralized security system, a secured communications channel between the centralized security system and the given device, in response to the centralized security system determining that the digital certificate received from the given device is valid;
receiving, by the centralized security system, a request from the given device over the secured communications channel to access the computing system to perform a requested operation, the received request being encrypted using a session key issued by the centralized security system, and the received request comprising device identifying information of the given device;
processing, by the centralized security system, the received request to determine if the requested operation is trusted;
denying, by the centralized security system, the received request to perform the requested operation, in response to determining that the requested operation is not trusted; and
sending, by the centralized security system, the received request to the computing system, responsive to the centralized security system determining that the given device is valid based on the device identifying information in the received request and that the requested operation is trusted.
12. The article of manufacture of claim 11 , further comprising program code which is executable by the one or more processors for determining whether the given device is valid by comparing the device identifying information in the received request against corresponding device identifying information associated with the digital certificate which was received from the given device and deemed valid by the centralized security system.
13. The article of manufacture of claim 12 , further comprising program code which is executable by the one or more processors for denying the received request, by the centralized security system, in response to the given device not being validated based on the extracted device identifying information.
14. The article of manufacture of claim 13 , further comprising program code which is executable by the one or more processors for invalidating the digital certificate of the given device, which was issued by the centralized security system to the given device, in response to the given device not being validated based on the extracted device identifying information.
15. The article of manufacture of claim 11 , further comprising program code which is executable by the one or more processors for:
registering the centralized security system with the computing system; and
registering the plurality of devices with the centralized security system.
16. The article of manufacture of claim 15 , wherein:
registering the centralized security system with the computing system comprises:
generating, by the centralized security system, a certificate signing request;
transmitting, by the centralized security system, the certificate signing request to the computing system; and
receiving, by the centralized security system, a signed digital certificate which authenticates an identity of the centralized security system and which is utilized to establish secured communications between the centralized security system and the computing system; and
registering the plurality of devices with the centralized security system comprises:
receiving, by the centralized security system, a certificate signing request from a given device requesting registration as a trusted device; and
generating, by the centralized security system, a signed digital certificate, which authenticates an identity of the given device as a trusted device, and which is utilized to establish secured communications between the centralized security system and the given device.
17. The article of manufacture of claim 11 , further comprising program code which is executable by the one or more processors for:
receiving, by the centralized security system, device operational data from the plurality of devices operating within the network, wherein the device operational data comprises at least one of power usage data and resource usage data as reported by the devices operating within the network;
processing, by the centralized security system, the device operational data to detect anomalous behavior of the devices operating within the network; and
preventing, by the centralized security system, a given device from operating within the network in response to detecting that the given device is exhibiting anomalous behavior.
18. A computing device, comprising:
at least one processor; and
at least one memory device configured to store program code, wherein the program code is executable by the at least one processor to implement a centralized security system which is configured to operate within a machine-to-machine communication network as a security layer between a plurality of devices operating within the network and a computing system which hosts an application that is utilized by the devices, wherein the centralized security system is configured to execute a process comprising:
receiving a digital certificate from a given device requesting access to the computing system, the digital certificate being previously issued to the given device by the centralized security system in response to the given device registering with the centralized security system and being authenticated as a trusted device to operate within the network;
initiating, a secured communications channel between the centralized security system and the given device, in response to the centralized security system determining that the digital certificate received from the given device is valid;
receiving a request from the given device over the secured communications channel to access the computing system to perform a requested operation, the received request being encrypted using a session key issued by the centralized security system, and the received request comprising device identifying information of the given device;
processing the received request to determine if the requested operation is trusted;
denying the received request to perform the requested operation, in response to determining that the requested operation is not trusted; and
sending the received request to the computing system, in response to the centralized security system determining that the given device is valid based on the device identifying information in the received request and that the requested operation is trusted.
19. The computing device of claim 18 , wherein the centralized security system is further configured to execute a process comprising:
determining whether the given device is valid by comparing the device identifying information in the received request against corresponding device identifying information associated with the digital certificate which was received from the given device and deemed valid by the centralized security system; and
denying the received request in response to the given device not being validated based on the extracted device identifying information.
20. The computing device of claim 19 , wherein the centralized security system is further configured to execute a process comprising invalidating the digital certificate of the given device, which was issued by the centralized security system to the given device, in response to the given device not being validated based on the extracted device identifying information.