Information handling system threat management and detection with scheduled token communication
Plural Internet of Things (IoT) gateways detect, secure against and remediate malicious code with an autonomous communication of tokens between the IoT gateways on a time schedule. Detection of an invalid token or a token communication outside of a scheduled time indicates that malicious code may have interfered with token generation or communication. Verification of a token communication to an IoT gateway that failed in turn to pass the token to another IoT gateway indicates that the IoT gateway is a threat that may include malicious code.
1. A method for securing plural IoT gateways interfaced with a network, the method comprising:
communicating information with wireless signals from each of plural IoT sensors to at least one of plural IoT gateways within a plurality of network topologies;
communicating information with wireless signals between the plural IoT gateways, the plural IoT gateways forming a security population of IoT gateways having at least a first IoT gateway, a second IoT gateway and a third IoT gateway;
storing an order for passing a token among the security population of plural IoT gateways or plural IoT sensors in non-transitory memory of each of the plural IoT gateways or plural IoT sensors of the security population;
storing a schedule for passing a token among the security population of the plurality of IoT gateways or plural IoT sensors in non-transitory memory of each of the plural IoT gateways or plural IoT sensors of the security population, the schedule including at least a first time to pass the token from the first IoT gateway to the second IoT gateway and a second time to pass the token from the second IoT gateway to a third IoT gateway;
monitoring at each of the plural IoT gateways or plural IoT sensors receipt of the token based upon the defined order and schedule; and
issuing a threat alert identifying the failed IoT gateway or IoT sensor from one of the plural IoT gateways or IoT sensors if the one of the plural IoT gateways or plural IoT sensors detects either an invalid token or a failure to receive a valid token at a scheduled time in the stored order;
wherein a cross check inquiry is performed to confirm failure before the failed IoT gateway or IoT sensor is quarantined.
2. The method of claim 1 further comprising:
monitoring port accesses at the plural IoT gateways; and
adjusting the schedule based upon the number and type of monitored port accesses.
3. The method of claim 1 further comprising:
adjusting a content of the token at each communication from each of the plural IoT gateways; and
verifying the content of the token at receipt of the token at each of the plural IoT gateways to determine the token as valid.
4. The method of claim 3 further comprising:
detecting a failure to receive a token at a scheduled time at one of the plural IoT gateways; and
in response to the detecting, adjusting content of the token to indicated the failure before communicating the token to another of the plural IoT gateways.
5. The method of claim 4 wherein the defining an order further comprises:
defining with logic at each of the plural IoT gateways at least first and second near-peers of each of the plural IoT gateways; and
coordinating at each of the plural IoT gateways to receive a token from at least one near-peer and to send a token to at least another of the near-peers.