System and method for fingerprint-based network mapping of cyber-physical assets
A system and method for fingerprint-based network mapping of cyber-physical assets, including a distributed operating system, parameter evaluation engine, at least one cyber-physical asset, at least one crypt-ledger, a network, and a scanner that retrieves stored fingerprint records and performs scans of cyber-physical assets to compare against corresponding fingerprints and update a cyber-physical graph based on the success or failure of fingerprint matching.
1. A system for fingerprint-based network mapping of cyber-physical assets, comprising:
a first computing device coupled to a physical asset and comprising a first processor, a first memory, a geolocation device, and a first plurality of programming instructions that, when operating on the first processor, cause the first computing device to:
periodically determine a geographical location of the physical asset using the geolocation device;
generate an encrypted asset status update message, the status update message comprising a device identifier of the first computing device and the geographical location of the physical asset; and
transmit the encrypted asset status update message via a network to a second computing device; and
a port scanner comprising at least a second processor, a second memory, and a second plurality of programming instructions that, wherein the second programmable instructions, when operating on the second processor, cause the port scanner to:
receive the encrypted asset status update message from the first computing device;
retrieve a plurality of stored fingerprint records from the second memory or a database, at least one of the plurality of fingerprint records corresponding to the first computing device;
perform a scan of one or more ports of the first computing device, the scan being based on the corresponding fingerprint record;
analyze the results of the scan;
if the analysis indicates that the results do not match the corresponding fingerprint record, transmit an encrypted failure notification to the second computing device; and
if the analysis indicates that the results match the corresponding fingerprint record, transmit an encrypted success notification to the second computing device;
wherein the second computing device verifies the authenticity of the received encrypted success and failure notifications and, for each verified encrypted success notification, modifies a cyber-physical graph based upon the encrypted asset status update message.
2. The system of claim 1 , wherein the cyber-physical graph is stored a multidimensional time-series database and is configured to:
receive data asynchronously from multiple sources over a period of time; and
establish graph-series data structures using the received data.
3. The system of claim 2 , wherein the scan results are stored with attached time-series metadata.
4. The system of claim 3 , wherein the attached time-series metadata comprises the time when the corresponding fingerprint record was created.
5. The system of claim 3 , wherein the attached time-series metadata comprises the time at which the corresponding fingerprint was retrieved.
6. The system of claim 3 , wherein the attached time-series metadata comprises the time at which the scan was initiated.
7. The system of claim 3 , wherein the attached time-series metadata comprises the time at which the scan was completed.