Private cloud control
Management of IoT devices through a private cloud. An IoT device is coupled to a gateway. A request from the IoT device to connect to a private cloud, wherein the private cloud is used to manage IoT devices, is received at a private cloud control center agent. An identification of the IoT device is determined. The IoT device is onboarded, using the identification, for management through the private cloud. A device profile of the IoT device is generated. The flow of data to and from the IoT device is regulated through application of IoT rules according to the device profile of the IoT device.
1. A method comprising:
monitoring, by a private cloud control center agent that is provided between a public network and a private cloud, a data transmission of an Internet of Things (IoT) device to an intended destination resource on the public network, wherein the monitoring is carried out through the private cloud in accordance with an IoT rule that is applied in the data transmission of the IoT device, the IoT device being connected for management thereof by the private cloud control center agent through the private cloud, wherein the private cloud control center agent is configured to modify at least a portion of the monitored data transmission before it is sent to the intended destination resource on the public network, wherein modifying the at least the portion of the monitored data transmission includes performing at least one action including removing or rewriting at least a portion of the monitored data transmission to remove at least one of: (1) a device type, (2) an operating system, or (3) a firmware version of the IoT device;
detecting, by the private cloud control center agent, security-risking behavior of the IoT device at least based on the monitored data transmission of the IoT device, wherein detecting the security-risking behavior of the IoT device includes comparing a previously determined device profile for the IoT device with the monitored data transmission, wherein the previously determined device profile describes previously determined normal behavior of the IoT device, and wherein the previously determined device profile was determined at least in part by a device profiling engine configured to:
monitor data collected by a device interposed between the IoT device and a remote resource, wherein the collected data comprises data transmitted from the IoT device to the remote resource;
generate an initial device profile for the IoT device; and
update the initial device profile based at least in part on observed data; and
upon detecting the security-risking behavior of the IoT device, performing, by the private cloud control center agent, a remedial action for the data transmission of the IoT device.
2. The method of claim 1 , wherein:
the security-risking behavior of the IoT device is detected based at least in part on comparison of a reference behavior with the monitored data transmission of the IoT device; and
the reference behavior is one or an applicable combination of: past behavior of the IoT device, behavior of other IoT devices managed by the private cloud control center agent, behavior of other IoT devices of a same type, or IoT devices used by users other than a user of the IoT device.
3. The method of claim 1 , wherein:
the security-risking behavior of the IoT device is detected based at least in part on comparison of a reference behavior with the monitored data transmission of the IoT device; and
the comparison includes comparison of at least one of: a destination of data transmitted through the data transmission, timing of the data transmission, an amount of data transmitted through the data transmission, or a bytes histogram of data transmitted through the data transmission.
4. The method of claim 1 , further comprising:
simulating an attack of a third party device attempting to gain control of the IoT device by sending data to the IoT device; and
determining a security-risking state of the IoT device based on a response, by the IoT device, to the data.
5. The method of claim 1 , wherein the remedial action includes quarantining the IoT device.
6. The method of claim 1 , wherein the remedial action includes alerting a user associated with the private cloud that the IoT device is behaving abnormally.
7. The method of claim 1 , wherein the data transmission of the IoT device includes data transmission between the IoT device and other IoT devices managed through the private cloud.
8. The method of claim 1 , wherein the data transmission of the IoT device includes data transmission between the IoT device and a source accessed through, at least in part, a public network.
9. The method of claim 1 , wherein the device interposed between the IoT device and the remote resource comprises a firewall.
10. The method of claim 1 , wherein the device interposed between the IoT device and the remote resource is configured to intercept the data transmitted from the IoT device to the remote resource.
11. A system comprising:
a private cloud control center agent, comprising a processor, provided between a public network and a private cloud and configured to:
monitor a data transmission of an Internet of Things (IoT) device to an intended destination resource on the public network, wherein the monitoring is carried out through the private cloud in accordance with an IoT rule that is applied in the data transmission of the IoT device, when the IoT device is connected for management thereof by the private cloud control center agent through the private cloud, wherein the private cloud control center agent is configured to modify at least a portion of the monitored data transmission before it is sent to the intended destination resource on the public network, wherein modifying the at least the portion of the monitored data transmission includes performing at least one action including removing or rewriting at least a portion of the monitored data transmission to remove at least one of: (1) a device type, (2) an operating system, or (3) a firmware version of the IoT device;
detect security-risking behavior or state of the IoT device at least based on the monitored data transmission of the IoT device, wherein detecting the security-risking behavior of the IoT device includes comparing a previously determined device profile for the IoT device with the monitored data transmission, wherein the previously determined device profile describes previously determined normal behavior of the IoT device, and wherein the previously determined device profile was determined at least in part by a device profiling engine configured to:
monitor data collected by a device interposed between the IoT device and a remote resource, wherein the collected data comprises data transmitted from the IoT device to the remote resource;
generate an initial device profile for the IoT device; and
update the initial device profile based at least in part on observed data; and
upon detecting the security-risking behavior or state of the IoT device, perform a remedial action for the data transmission of the IoT device.
12. The system of claim 11 , wherein
the security-risking behavior of the IoT device is detected based at least in part on comparison of a reference behavior with the monitored data transmission of the IoT device; and
the reference behavior is one or an applicable combination of: past behavior of the IoT device, behavior of other IoT devices managed by the private cloud control center agent, behavior of other IoT devices of a same type, or IoT devices used by users other than a user of the IoT device.
13. The system of claim 11 , wherein
the security-risking behavior of the IoT device is detected based at least in part on comparison of a reference behavior with the monitored data transmission of the IoT device; and
the comparison includes comparison of at least one of: a destination of data transmitted through the data transmission, timing of the data transmission, an amount of data transmitted through the data transmission, or a bytes histogram of data transmitted through the data transmission.
14. The system of claim 11 , wherein the private cloud control center agent is further configured to simulate an attack of a third party device attempting to gain control of the IoT device by sending data to the IoT device, and determine a security-risking state of the IoT device based on a response, by the IoT device, to the data.
15. The system of claim 11 , wherein the remedial action includes quarantining the IoT device.
16. The system of claim 11 , wherein the remedial action includes alerting a user associated with the private cloud that the IoT device is behaving abnormally.
17. The system of claim 11 , wherein the data transmission of the IoT device includes data transmission between the IoT device and other IoT devices managed through the private cloud.
18. The system of claim 11 , wherein the data transmission of the IoT device includes data transmission between the IoT device and a source accessed through, at least in part, a public network.
19. The system of claim 11 , wherein the device interposed between the IoT device and the remote resource comprises a firewall.
20. The system of claim 11 , wherein the device interposed between the IoT device and the remote resource is configured to intercept the data transmitted from the IoT device to the remote resource.