Granted Patent B2

US 12,438,844 · App. 17/951,357 · Granted Oct 7, 2025

Inventors: Konstantin M. Filatov (Moscow, RU); Victor V. Yablokov (Moscow, RU)

Assignee: AO Kaspersky Lab

H04L63/0236G06F8/65H04L63/1416H04L63/1425H04L63/1441G16Y30/10

Abstract

Claims (53)

1. A method for securing a plurality of IoT devices using a gateway comprising:

intercepting, by a gateway, information about interactions between a first IoT device and at least one of: a second IoT device, a computer server, and a computer service;

detecting, by the gateway, one or more cyber security threats based on the intercepted information and based on information stored in at least one of a first database and a second database, wherein the first database is configured to store information about IoT devices and wherein the second database is configured to store information about cyber security threats;

identifying, by the gateway, one or more cyber security threat mitigation actions to address the detected one or more cyber security threats including at least one of: updating password of the first IoT device, updating firmware of the first IoT device, checking access to the first IoT device via Telnet/SSH port, and checking access to the first IoT device by guessing passwords; and

performing, by the gateway, the identified one or more cyber security threat mitigation actions.

2. The method of claim 1 , wherein intercepting information further comprises at least one of:

intercepting at least one of a DNS request, HTTP request, HTTPS request transmitted from the first IoT device to the second IoT device;

extracting domain name information and a URL information from the intercepted at least one of the DNS request, HTTP request and HTTPS request;

intercepting traffic received by the first IoT device on a predefined set of TCP/UDP ports;

determining whether the first IoT device has open TCP/UDP ports, wherein the open TCP/UDP ports provide remote access to the first IoT device.

3. The method of claim 1 , wherein the one or more cyber security threat mitigation actions are configured to be applied to traffic across entire network, and wherein the one or more cyber security threat mitigation actions comprise at least one of:

blocking the first IoT device from connecting to other IoT devices in the network; and

blocking first IoT device's connections to domains and URLs.

4. The method of claim 3 , wherein identifying the one or more cyber security threat mitigation actions configured to be applied to the traffic across entire network further comprises:

blocking first IoT device's connections to domains and URLs, in response to detecting the domains and URLs in the traffic outgoing from the first IoT device and in response to finding the domains and URLs in the second database; and

blocking connections associated with an anomaly, in response to detecting the anomaly in the intercepted traffic.

5. The method of claim 1 , further comprising determining a description of the first IoT device based on the intercepted information, wherein the description of the first IoT device comprises at least one of: a type of the first IoT device, manufacturer of the first IoT device, model of the first IoT device, firmware version of the first IoT device; information about the first IoT device received from a security service.

6. The method of claim 4 , wherein identifying the one or more cyber security threat mitigation actions configured to be applied to the first IoT device further comprises:

checking access to the first IoT device by guessing passwords using the first database based on data provided by a security service, in response to detecting open Telnet/SSH ports;

updating password of the first IoT device, in response to detecting a weak password of the first IoT device; and

updating firmware version of the first IoT device, in response to receiving information from the security service indicating release of a new firmware version of the first IoT device.

7. The method of claim 1 , wherein the first database is configured to store at least the following information: descriptions of IoT devices, firmware versions of IoT devices, and a list of weak passwords for IoT devices.

8. The method of claim 1 , wherein the second database is configured to store at least the following information: domains and URLs used by malicious device applications, device-specific open Telnet/SSH ports.

9. The method of claim 1 , wherein the one or more cyber security threat mitigation actions are identified by a security service.

10. A system for securing a plurality of IoT devices comprising:

a memory and a hardware processor of a gateway configured to:

intercept information about interactions between a first IoT device and at least one of: a second IoT device, a computer server, and a computer service;

detect one or more cyber security threats based on the intercepted information and based on information stored in at least one of a first database and a second database, wherein the first database is configured to store information about IoT devices and wherein the second database is configured to store information about cyber security threats;

identify one or more cyber security threat mitigation actions to address the detected one or more cyber security threats including at least one of: updating password of the first IoT device, updating firmware of the first IoT device, checking access to the first IoT device via Telnet/SSH port, and checking access to the first IoT device by guessing passwords; and

perform the identified one or more cyber security threat mitigation actions.

11. The system of claim 10 , wherein the hardware processor configured to intercept information is further configured to:

intercept at least one of a DNS request, HTTP request, HTTPS request transmitted from the first IoT device to the second IoT device;

extract domain name information and a URL information from the intercepted at least one of the DNS request, HTTP request and HTTPS request;

intercept traffic received by the first IoT device on a predefined set of TCP/UDP ports;

determine whether the first IoT device has open TCP/UDP ports, wherein the open TCP/UDP ports provide remote access to the first IoT device.

12. The system of claim 10 , wherein the one or more cyber security threat mitigation actions are configured to be applied to traffic across entire network, and wherein the one or more cyber security threat mitigation actions comprise at least one of:

blocking the first IoT device from connecting to other IoT devices in the network; and

blocking first IoT device's connections to domains and URLs.

13. The system of claim 12 , wherein the hardware processor configured to identify the one or more cyber security threat mitigation actions configured to be applied to the traffic across entire network is further configured to:

block first IoT device's connections to domains and URLs, in response to detecting the domains and URLs in the traffic outgoing from the first IoT device and in response to finding the domains and URLs in the second database; and

block connections associated with an anomaly, in response to detecting the anomaly in the intercepted traffic.

14. The system of claim 10 , wherein the hardware processor is further configured to determine a description of the first IoT device based on the intercepted information, wherein the description of the first IoT device comprises at least one of: a type of the first IoT device, manufacturer of the first IoT device, model of the first IoT device, firmware version of the first IoT device; information about the first IoT device received from a security service.

15. The system of claim 10 , wherein the hardware processor configured to identify the one or more cyber security threat mitigation actions configured to be applied to the first IoT device further is further configured to:

check access to the first IoT device by guessing passwords using the first database based on data provided by the security service, in response to detecting open Telnet/SSH ports;

update password of the first IoT device, in response to detecting a weak password of the first IoT device; and

update firmware version of the first IoT device, in response to receiving information from the security service indicating release of a new firmware version of the first IoT device.

16. The system of claim 10 , wherein the first database is configured to store at least the following information: descriptions of IoT devices, firmware versions of IoT devices, and a list of weak passwords for IoT devices.

17. The system of claim 10 , wherein the second database is configured to store at least the following information: domains and URLs used by malicious device applications, device-specific open Telnet/SSH ports.

18. A non-transitory computer readable medium storing thereon computer executable instructions for securing a plurality of IoT devices using a gateway, including instructions for:

intercepting, by a gateway, information about interactions between a first IoT device and at least one of: a second IoT device, a computer server, and a computer service;

detecting, by the gateway, one or more cyber security threats based on the intercepted information and based on information stored in at least one of a first database and a second database, wherein the first database is configured to store information about IoT devices and wherein the second database is configured to store information about cyber security threats;

identifying, by the gateway, one or more cyber security threat mitigation actions to address the detected one or more cyber security threats including at least one of: updating password of the first IoT device, updating firmware of the first IoT device, checking access to the first IoT device via Telnet/SSH port, and checking access to the first IoT device by guessing passwords; and

performing, by the gateway, the identified one or more cyber security threat mitigation actions.

Assignments (1)

Priority Claims (1)

Continuity (1)

References Cited (16)