Edge device assisted mitigation of publish-subscribe denial of service (DoS) attacks
Methods, apparatuses, and computer program products for edge device assisted mitigation of publish-subscribe denial of service (DoS) attacks are disclosed. An edge device hosts a virtualized copy of an Internet-of-Things (IoT) device subscribed to one or more publish-subscribe topics. When the edge device receives an indication to activate the virtualized copy of the IoT device, for example, during a DoS attack on the IoT device, the edge device activates the virtualized copy of the IoT device, which receives traffic from the publish-subscribe topic. The virtualized copy of the IoT device applies security policies to incoming traffic received from the subscription topics and transmits to the IoT device sanitized traffic obtained from the received incoming subscription content traffic.
1. A method comprising:
hosting, on an edge device, a virtualized copy of an Internet-of-Things (IoT) device configured to assist in mitigating publish-subscribe denial of service (DoS) attacks;
receiving, by the edge device and from the IoT device, an indication to activate the virtualized copy of the IoT device;
activating, by the edge device and based on the indication, the virtualized copy of the IoT device, including subscribing, by the virtualized copy of the IoT device, to one or more topics subscribed to by the IoT device and unsubscribing the IoT device from the one or more topics;
applying, by the virtualized copy of the IoT device, security policies to incoming traffic received from one or more subscription topics; and
transmitting, by the virtualized copy of the IoT device to the IoT device, sanitized traffic obtained from the received incoming traffic.
2. The method of claim 1 , wherein hosting, on the edge device, the virtualized copy of an IoT device includes hosting a copy of a software stack of the IoT device.
3. The method of claim 1 , wherein receiving, from the IoT device, the indication to activate the virtualized copy of the IoT device includes receiving a report of a DoS attack on the IoT device.
4. The method of claim 1 , wherein applying, by the virtualized copy of the IoT device, security policies to incoming traffic received from the one or more subscription topics includes:
identifying an application-specific threat in the incoming traffic; and
implementing an application-specific security policy that mitigates the identified threat.
5. The method of claim 1 , further comprising:
providing a discoverable service for application-specific traffic filtering to the IoT device;
authenticating the edge device to the IoT device;
installing the virtualized copy of the IoT device; and
establishing a cryptographic communication channel with the IoT device.
6. The method of claim 1 , wherein the edge device is at least one of an edge server, a router, and a routing switch, and wherein the IoT device is an end-point device.
7. An apparatus comprising a computer processor,
a computer memory operatively coupled to the computer processor, the computer memory having disposed within it computer program instructions that, when executed by the computer processor, cause the apparatus to:
host, on an edge device, a virtualized copy of an Internet-of Things (IoT) device configured to assist in mitigating publish-subscribe denial of service (DoS) attacks;
receive, by the edge device and from the IoT device, an indication to activate the virtualized copy of the IoT device;
activate, by the edge device and based on the indication, the virtualized copy of the IoT device, including subscribing, by the virtualized copy of the IoT device, to one or more topics subscribed to by the IoT device and unsubscribing the IoT device from the one or more topics;
apply, by the virtualized copy of the IoT device, security policies to incoming traffic received from one or more subscription topics; and
transmit, by the virtualized copy of the IoT device to the IoT device, sanitized traffic obtained from the received incoming traffic.
8. The apparatus of claim 7 , wherein hosting, on the edge device, the virtualized copy of an IoT device includes hosting a copy of a software stack of the IoT device.
9. The apparatus of claim 7 , wherein receiving, from the IoT device, the indication to activate the virtualized copy of the IoT device includes receiving a report of a DoS attack on the IoT device.
10. The apparatus of claim 7 , wherein applying, by the virtualized copy of the IoT device, security policies to incoming traffic received from the one or more subscription topics includes:
identify an application-specific threat in the incoming traffic; and
implement an application-specific security policy that mitigates the identified threat.
11. The apparatus of claim 7 , the memory further comprising computer program instructions that, when executed by the computer processor, cause the apparatus to:
provide a discoverable service for application-specific traffic filtering to the IoT device;
authenticate the edge device to the IoT device;
install the virtualized copy of the IoT device; and
establish a cryptographic communication channel with the IoT device.
12. The apparatus of claim 7 , wherein the edge device is at least one of an edge server, a router, and a routing switch, and wherein the IoT device is an end-point device.
13. A computer program product, the computer program product comprising a non-volatile computer readable medium and computer program instructions stored therein that are configured to, when executed by a processor, cause a computer to perform operations comprising:
host, on an edge device, a virtualized copy of an Internet-of Things (IoT) device configured to assist in mitigating publish-subscribe denial of service (DoS) attacks;
receive, by the edge device and from the IoT device, an indication to activate the virtualized copy of the IoT device;
activate, by the edge device and based on the indication, the virtualized copy of the IoT device, including subscribing, by the virtualized copy of the IoT device, to one or more topics subscribed to by the IoT device and unsubscribing the IoT device from the one or more topics;
apply, by the virtualized copy of the IoT device, security policies to incoming traffic received from one or more subscription topics; and
transmit, by the virtualized copy of the IoT device to the IoT device, sanitized traffic obtained from the received incoming traffic.
14. The computer program product of claim 13 , wherein hosting, on the edge device, the virtualized copy of an IoT device includes hosting a copy of a software stack of the IoT device.
15. The computer program product of claim 13 , wherein receiving, from the IoT device, the indication to activate the virtualized copy of the IoT device includes receiving a report of a DoS attack on the IoT device.
16. The computer program product of claim 13 , wherein applying, by the virtualized copy of the IoT device, security policies to incoming traffic received from the one or more subscription topics includes:
identify an application-specific threat in the incoming traffic; and
implement an application-specific security policy that mitigates the identified threat.
17. The computer program product of claim 13 further comprising computer program instructions that, when executed, cause the computer to:
provide a discoverable service for application-specific traffic filtering to the IoT device;
authenticate the edge device to the IoT device;
install the virtualized copy of the IoT device; and
establish a cryptographic communication channel with the IoT device.