Combined network and physical security appliance
The present disclosure describes a combined network and physical security appliance. The appliance may be wired to or communicate with automation systems, IoT devices, physical sensors, computing devices and servers on an internal or local network, and other computing devices on an external network. By combining network security and physical security into a single device, a combination security appliance may correlate physical sensor signals with packet inspection results, providing enhanced protection against network threats to physical security systems, and physical protection against network threats.
1 . A device, comprising:
one or more processors in communication with a physical security sensor; and
one or more network interfaces in communication with a first network and a second network; and
wherein the one or more processors are configured to:
communicate via the first network to an automation device, the automation device associated with the physical security sensor;
identify a temporal correlation or lack of a temporal correlation between a timestamp of a trigger of the physical security sensor associated with the automation device and a timestamp associated with a network packet received by the automation device received via the first network or the second network.
2 . The device of claim 1 , further comprising a display device.
3 . The device of claim 2 , further comprising an application, executed by the one or more processors, comprising a first user interface configured to display a status of the physical security sensor, and a second user interface configured to display a status of the one or more network interfaces.
4 . The device of claim 1 , further comprising a general purpose input/output (GPIO) interface, a serial interface, an Ethernet interface, a power line communication (PLC) interface, or a wireless communication interface coupled to the one or more processors and the physical security sensor.
5 . The device of claim 1 , further comprising a first network interface coupled to the first network and a second network interface coupled to the second network.
6 . The device of claim 1 , wherein the one or more processors are further configured to generate an alert, responsive to identifying a temporal correlation between the timestamp of the trigger of the physical security sensor associated with the automation device and the timestamp associated with the network packet received by the automation device.
7 . The device of claim 6 , wherein the one or more processors are further configured to generate the alert, responsive to the trigger of the physical security sensor being received within a predetermined time period from the received network packet, and the trigger of the physical security sensor not being expected as a result of the received network packet.
8 . The device of claim 1 , wherein the one or more processors are further configured to generate an alert, responsive to identifying the lack of temporal correlation between the timestamp of the trigger of the physical security sensor associated with the automation device and the timestamp associated with the network packet received by the automation device via one of the first network or the second network.
9 . The device of claim 8 , wherein the one or more processors are further configured to generate the alert, responsive to the trigger of the physical security sensor not being received within a predetermined time period from the received network packet, the trigger of the physical security sensor being expected as a result of the received network packet.
10 . A method, comprising:
receiving, by a first device, a network packet;
identifying, by the first device, a second device as a source or destination of the network packet;
monitoring, by the first device, an output of a physical sensor associated with the second device, responsive to receipt of the network packet;
receiving, by the first device, a signal from the physical sensor; and
identifying, by the first device, a temporal correlation or a lack of temporal correlation between a timestamp of the signal from the physical sensor associated with the second device and a timestamp associated with the network packet.
11 . The method of claim 10 , further comprising determining, by the first device, that the network packet comprises an automation trigger; and wherein monitoring the output of the physical sensor is performed responsive to the determination that the network packet comprises an automation trigger.
12 . The method of claim 10 , further comprising forwarding, by the first device, the network packet to the destination of the network packet.
13 . The method of claim 10 , wherein the destination of the network packet comprises the second device.
14 . The method of claim 10 , further comprising:
generating, by the first device, an alert, responsive to an absence of a signal from the physical sensor prior to expiration of a timer.
15 . The method of claim 10 , further comprising:
determining, by the first device, that the signal is not expected from the physical sensor responsive to execution, by the second device, of an automation trigger.
16 . The method of claim 15 , further comprising:
generating, by the first device, an alert, responsive to detecting the signal from the physical sensor prior to expiration of a timer.
17 . The method of claim 10 , further comprising:
receiving, by the first device, a second network packet;
identifying, by the first device, that the second device is neither a source nor destination of the second network packet; and
generating, by the first device, an alert, responsive to detecting the signal from the physical sensor associated with the second device prior to expiration of a timer and responsive to identifying that the second device is neither the source nor destination of the second network packet.
18 . The method of claim 17 , further comprising:
transmitting, by the first device to the second device, an automation trigger responsive to generating the alert.