Industrial device MAC authentication bypass bootstrapping
In one embodiment, an illustrative method herein may comprise: detecting, by a device, a new asset in a network with a media access control address; monitoring, by the device, the new asset to learn one or more contextual attributes of the new asset in the network; generating, by the device, a profile of the new asset based on the media access control address and the one or more contextual attributes; and using, by the device, the profile to define access and control over the new asset in the network.
1. A method, comprising:
detecting, by a device, a new asset in a network with a media access control address, wherein the new asset does not support authentication by a central authority;
monitoring, by the device, the new asset to learn one or more contextual attributes of the new asset in the network, wherein at least one of the one or more contextual attributes is based on control system behavioral analytics insights of the new asset and comprises a component or activity tag;
generating, by the device, a profile of the new asset based on the media access control address and the one or more contextual attributes; and
using, by the device, the profile to define access and control over the new asset in the network.
2. The method as in claim 1 , wherein using the profile to define access and control over the new asset in the network comprises:
sharing the profile with an administrative controller to accept or reject the new asset in the network.
3. The method as in claim 1 , wherein using the profile to define access and control over the new asset in the network comprises:
sharing the profile with a policy engine in the network to assign an appropriate network access and control for the new asset.
4. The method as in claim 1 , wherein using the profile to define access and control over the new asset in the network comprises:
denying access to the network for the new asset when the profile is invalid.
5. The method as in claim 1 , further comprising:
detecting a change in behavior of the new asset in the network;
generating a new profile of the new asset based on the change in behavior; and
using the new profile to redefine access and control over the new asset in the network.
6. The method as in claim 1 , further comprising:
detecting the new asset on a specific switch in the network, wherein one of the one or more contextual attributes is an indication of validity based on the new asset being detected on the specific switch.
7. The method as in claim 1 , further comprising:
detecting the new asset as a replacement to an old asset in the network, wherein one of the one or more contextual attributes is an indication of validity based on the new asset being a replacement to the old asset.
8. The method as in claim 1 , wherein one or more of the one or more contextual attributes are based on one or more network association characteristics of the new asset.
9. The method as in claim 8 , wherein the one or more network association characteristics of the new asset are selected from a group consisting of: an access type of the new asset; a location of the new asset; an authentication type of the new asset; and an authentication status of the new asset.
10. The method as in claim 1 , wherein one or more of the one or more contextual attributes are based on one or more ports and/or one or more protocols used by the new asset.
11. The method as in claim 10 , further comprising:
determining the one or more ports and/or one or more protocols used by the new asset by one or both of active probing of the new asset or passive scanning of the new asset.
12. The method as in claim 1 , wherein the device comprises one of either an access switch or an access point in the network.
13. The method as in claim 1 , wherein the device comprises a profiling device, the method further comprising:
receiving traffic from the new asset forwarded via one of either an access switch or an access point in the network.
14. A tangible, non-transitory, computer-readable medium having computer-executable instructions stored thereon that, when executed by a processor on a computer, cause the computer to perform a method comprising:
detecting a new asset in a network with a media access control address, wherein the new asset does not support authentication by a central authority;
monitoring the new asset to learn one or more contextual attributes of the new asset in the network, wherein at least one of the one or more contextual attributes is based on control system behavioral analytics insights of the new asset and comprises a component or activity tag;
generating a profile of the new asset based on the media access control address and the one or more contextual attributes; and
using the profile to define access and control over the new asset in the network.
15. The tangible, non-transitory, computer-readable medium as in claim 14 , wherein using the profile to define access and control over the new asset in the network comprises:
sharing the profile with an administrative controller to accept or reject the new asset in the network.
16. The tangible, non-transitory, computer-readable medium as in claim 14 , wherein using the profile to define access and control over the new asset in the network comprises:
sharing the profile with a policy engine in the network to assign an appropriate network access and control for the new asset.
17. The tangible, non-transitory, computer-readable medium as in claim 14 , wherein using the profile to define access and control over the new asset in the network comprises:
denying access to the network for the new asset when the profile is invalid.
18. The tangible, non-transitory, computer-readable medium as in claim 14 , wherein the method further comprises:
detecting a change in behavior of the new asset in the network;
generating a new profile of the new asset based on the change in behavior; and
using the new profile to redefine access and control over the new asset in the network.
19. An apparatus, comprising:
a processor configured to execute one or more processes; and
a memory configured to store a process that is executable by the processor, the process, when executed, configured to:
detect a new asset in a network with a media access control address, wherein the new asset does not support authentication by a central authority;
monitor the new asset to learn one or more contextual attributes of the new asset in the network, wherein at least one of the one or more contextual attributes is based on control system behavioral analytics insights of the new asset and comprises a component or activity tag;
generate a profile of the new asset based on the media access control address and the one or more contextual attributes; and
use the profile to define access and control over the new asset in the network.