Non-interfering access layer end-to-end encryption for IOT devices over a data communication network

1. A network switch device communicatively coupled to a plurality of headless endpoint devices for providing proxy encryption services for end-to-end encrypted communications for the plurality of headless endpoint devices with destinations over a data communication network, the network switch device comprising:

a processor;

a network interface communicatively coupled to the processor and to the data communication network to receive inbound data packets for a plurality of headless endpoint devices and to receive outbound data packets from a plurality of headless endpoint devices; and

a memory, communicatively coupled to the processor and storing:

an endpoint connection manager to register MAC addresses for the plurality of headless endpoint devices;

a DPI module to determine whether to proxy encrypt the data packets, on behalf of a specific headless endpoint device from the plurality of headless endpoint devices for a session, based on analysis of payload data of a data packet from a session;

a port configuration module to, responsive to a determination to proxy encrypt data packets, set up encryption attributes between a local data port on the network switch device and a remote data port on a remote network device as parsed from a header of the data packet;

an encryption module to parse outbound data packets of the session and encrypt OSI layers 5 to 7 of the outbound data packets of the session according to the encryption attributes, and generate encrypted outbound data packets; and

a decryption module to parse inbound data packets of the session and decrypt layers 5 to 7 of the inbound data packets according to the encryption attributes, and generate decrypted inbound data packets,

wherein the network interface transmits the encrypted outbound data packets from the specific headless endpoint device, and transmits the decrypted inbound data packets to the specific headless endpoint device.

2. The network switch device of claim 1 , wherein the DPI module determines to proxy encrypt the data packets responsive to the analysis of the data packet payload detecting HTTP only mod bus only, or bacnet.

3. The network switch device of claim 1 , wherein the DPI module determines not to proxy encrypt the data packets responsive to the analysis of the data packet payload.

4. The network switch device of claim 1 , wherein a first OT device is authenticated with the access point and a second OT device is authenticated with a second access point, wherein a Wi-Fi controller manages both the access point and the second access point.

5. The network switch device of claim 1 , wherein the endpoint device sending the data packets of the session is incapable of encryption.

6. The network switch device of claim 1 , wherein the encryption module encrypts HTTP data packets with HTTPS.

7. The network switch device of claim 1 , wherein the endpoint device sending the data packets of the session is a headless device.

8. The network switch device of claim 1 , wherein the encryption module does not interfere with OSI layers 1 to 3 of the data packet.

9. The network switch device of claim 1 , wherein the specific headless endpoint device connects wirelessly to the network interface of the network device.

10. The network switch device of claim 1 , wherein the network device is also communicatively coupled to the Internet.

11. A method in a network switch device, implemented at least partially in hardware and communicatively coupled to a plurality of headless endpoint devices, for providing proxy encryption services for end-to-end encrypted communications for the plurality of headless endpoint devices with destinations over a data communication network, the method comprising the steps of:

registering MAC addresses for the plurality of headless endpoint devices;

determining whether to proxy encrypt the data packets, on behalf of a specific headless endpoint device from the plurality of headless endpoint devices for a session, based on analysis of payload data of a data packet from a session;

responsive to a determination to proxy encrypt data packets, setting-up encryption attributes between a local data port on the network switch device and a remote data port on a remote network device as parsed from a header of the data packet;

parsing outbound data packets of the session and encrypt OSI layers 5 to 7 of the outbound data packets of the session according to the encryption attributes, and generate encrypted outbound data packets; and

parsing inbound data packets of the session and decrypt layers 5 to 7 of the inbound data packets according to the encryption attributes, and generate decrypted inbound data packets,

wherein the network interface transmits the encrypted outbound data packets from the specific headless endpoint device, and transmits the decrypted inbound data packets to the specific headless endpoint device.

12. A non-transitory computer-readable media in a network switch device, implemented at least partially in hardware and communicatively coupled to a plurality of headless endpoint devices for, when executed by a processor, for providing proxy encryption services for end-to-end encrypted communications for the plurality of headless endpoint devices with destinations over a data communication network, the method comprising the steps of:

registering MAC addresses for the plurality of headless endpoint devices;

determining whether to proxy encrypt the data packets, on behalf of a specific headless endpoint device from the plurality of headless endpoint devices for a session, based on analysis of payload data of a data packet from a session;

responsive to a determination to proxy encrypt data packets, setting-up encryption attributes between a local data port on the network switch device and a remote data port on a remote network device as parsed from a header of the data packet;

parsing outbound data packets of the session and encrypt OSI layers 5 to 7 of the outbound data packets of the session according to the encryption attributes, and generate encrypted outbound data packets; and

parsing inbound data packets of the session and decrypt layers 5 to 7 of the inbound data packets according to the encryption attributes, and generate decrypted inbound data packets,

wherein the network interface transmits the encrypted outbound data packets from the specific headless endpoint device, and transmits the decrypted inbound data packets to the specific headless endpoint device.