Configuring contextually aware IoT policies
In one embodiment, a device in a network loads a selectable lexicon. The device receives a command that uses the loaded lexicon. The device interprets the command using the loaded lexicon. The device generates a configuration for one or more network nodes in the network based on the interpreted command. The device causes the one or more network nodes to implement the configuration.
1. A method, comprising:
loading, by a device in a network, a selectable lexicon associated with an operational technology (OT) policy manager;
receiving, at the device, a command that uses the loaded lexicon and specifies an OT policy;
interpreting, by the device, the command using the loaded lexicon by translating the received command from the loaded lexicon into an intermediate representation of the receive command that maps one or more tokens from the selectable lexicon to a network infrastructure;
dynamically generating, by the device, a network configuration for one or more network nodes in the network based on the intermediate representation of the received command and a topology of the one or more network nodes in the network obtained by a network topology discovery service, wherein the generated network configuration translates, via a compiler, the OT policy into network policy definitions and configurations to be applied dynamically to the network; and
sending, by the device, the network configuration to the one or more network nodes via an application programming interface (API) to cause the one or more network nodes to implement the generated network configuration.
2. The method as in claim 1 , wherein translating includes:
parsing, by the device, the received command to identify a lexical token in the command; and
comparing, by the device, the identified lexical token to a set of lexical tokens in the loaded lexicon, to determine whether the received command is valid.
3. The method as in claim 1 , further comprising:
retrieving, by the device, network topology information regarding the network, wherein the network topology information identifies the one or more network nodes and a configuration of the one or more network nodes.
4. The method as in claim 3 , wherein generating the network configuration for the one or more network nodes comprises:
mapping, by the device, the interpreted command to the network configuration of the one or more network nodes according to a generation ruleset.
5. The method as in claim 1 , wherein the selectable lexicon is a loadable plug-in.
6. The method as in claim 1 , wherein the implemented network configuration controls access to a sensor or an actuator.
7. The method as in claim 6 , wherein the network configuration controls access to the sensor or the actuator based on a location of a requesting device.
8. The method as in claim 1 , wherein the one or more network nodes comprise at least one of: a router, a firewall, a programmable logic controller, or an intrusion protection system.
9. An apparatus, comprising:
one or more network interfaces to communicate with a network;
a processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed configured to:
load a selectable lexicon associated with an operational technology (OT) policy manager;
receive a command that uses the loaded lexicon and specifies an OT policy;
interpret the command using the loaded lexicon by translating the received command from the loaded lexicon into an intermediate representation of the receive command that maps one or more tokens from the selectable lexicon to a network infrastructure;
dynamically generate a network configuration for one or more network nodes in the network based on the intermediate representation of the received command and a topology of the one or more network nodes in the network obtained by a network topology discovery service, wherein the generated network configuration translates, via a compiler, the OT policy into network policy definitions and configurations to be applied dynamically to the network; and
send the network configuration to the one or more network nodes via an application programming interface (API) the one or more network nodes to implement the network configuration.
10. The apparatus as in claim 9 , wherein translating includes:
parsing the received command to identify a lexical token in the command; and
comparing the identified lexical token to a set of lexical tokens in the loaded lexicon, to determine whether the received command is valid.
11. The apparatus as in claim 9 , wherein the process when executed is further configured to:
retrieve network topology information regarding the network, wherein the network topology information identifies the one or more network nodes and a current configuration of the one or more network nodes.
12. The method as in claim 11 , wherein generating the network configuration for the one or more network nodes comprises:
mapping the interpreted command to the network configuration of the one or more network nodes according to a policy generation ruleset.
13. The apparatus as in claim 9 , wherein the selectable lexicon is a loadable plug-in.
14. The apparatus as in claim 9 , wherein the network configuration controls access to a sensor or an actuator.
15. The apparatus as in claim 14 , wherein the network configuration controls access to the sensor or the actuator based on a location of a requesting device.
16. The apparatus as in claim 9 , wherein the one or more network nodes comprise at least one of: a router, a firewall, a programmable logic controller, or an intrusion protection system.
17. A tangible, non-transitory, computer-readable medium storing program instructions that, when executed by a device in a network, causes the device to:
load a selectable lexicon associated with an operational technology (OT) policy manager;
receive a command that uses the loaded lexicon and specifies an OT policy;
interpret the command using the loaded lexicon by translating the received command from the loaded lexicon into an intermediate representation of the receive command that maps one or more tokens from the selectable lexicon to a network infrastructure;
dynamically generate a network configuration for one or more network nodes in the network based on the intermediate representation of the received command and a topology of the one or more network nodes in the network obtained by a network topology discovery service, wherein the generated network configuration translates, via a compiler, the OT policy into network policy definitions and configurations to be applied dynamically to the network; and
send the network configuration to the one or more network nodes via an application programming interface (API) the one or more network nodes to implement the network configuration.
18. The computer-readable medium as in claim 17 , wherein translating includes:
parse the received command to identify a lexical token in the command; and
compare the identified lexical token to a set of lexical tokens in the loaded lexicon, to determine whether the received command is valid.