Method and framework for internet of things network security
A method for Internet of Things (IoT) network security includes collecting information for each network device (device), determining a minimum viable resource allocation for each device based on the information, which defines the minimum resources needed by each device to engage the IoT network and handle data, and for each device, distributing minimum viable resource allocations and rules, determining monitoring sets, monitoring using the monitoring set, collecting updated information based partially on the monitoring set, analyzing the updated information to determine trends and insights relative to the devices and the IoT network, updating the monitoring set, minimum viable resource allocation, and rules based on the analyzed updated information, checking compliance with a current minimum viable resource allocation and rules, identifying devices having violations, and performing same on a continuous as it and automatic basis. The method establishes and maintains a chain of custody for data traversing through multiple network segments.
1 . A method for network security, the method comprising:
determining, by a rules node, a minimum viable resource allocation for each network device in or comprising a network, wherein the minimum viable resource allocation defines, for each network device, minimum resources needed to engage the network and to handle data collected by network devices on the network;
updating, by the rules node, the minimum viable resource allocation for at least one network device based on updated information associated with each of the at least one network device and the network;
detecting, by the rules node, one or more network devices having violations and under threat based on non-compliance of the one or more network devices with an applicable minimum viable resource allocation;
configuring, by the rules node, the detected network devices based on non-compliance with the applicable minimum viable resource allocation;
establishing, by applicable associated network devices of the network devices using applicable sets of rules, security associations and mutual trust with other associated network devices of the network device;
wherein compliance with the applicable sets of rules and the applicable minimum viable resource allocations establishes a chain of custody between the associated network devices, and
wherein the chain of custody differs based on traffic flow direction by using different sets of rules and minimum viable resource allocations for different traffic flow directions between the associated network devices.
2 . The method of claim 1 , wherein the applicable sets of rules, security associations and mutual trust with other associated network devices of the network devices are at interfaces between two network segments in the network, and wherein successful establishment of the security associations and the mutual trust provide end-to-end security between the two network segments.
3 . The method of claim 2 , wherein the set of rules includes at least security rules, transmission rules, access rules, authorization rules, security authorization rules, communication rules, and security rules.
4 . The method of claim 3 , further comprising:
checking, by at least one of the rules node and each pair of the network devices at the interfaces, compliance of other network devices at the interfaces using the applicable minimum viable resource allocations and the applicable sets of rules to establish the chains of custody.
5 . The method of claim 4 , further comprising:
continuously monitoring, by the rules node, changes in information associated with each of the network device and the network.
6 . The method of claim 1 , wherein the minimum viable resource allocation for each of the network device is based on at least connectivity, bandwidth, amount of transmitted data, frequency of transmission, authorization to connect to other network devices and network functions, level of and access to data by the network device, time when access to data is permitted for the network device, and location where access to data is permitted by the network device.
7 . The method of claim 6 , wherein a type of the network device includes at least devices, network edge devices, network access devices, network core devices, and application devices or servers.
8 . The method of claim 1 , further comprising:
automatically and continuously performing minimum viable resource allocation determinations, compliance confirmations for each of the network device, and configuration of the network devices and of the network.
9 . The method of claim 1 , wherein insights of the network are determined by a machine learning model.
10 . A network for transferring data, comprising:
functional network slices, each functional network slice including devices which have visibility and authorization limited to the functional network slice; and
a network security processor configured to allocate a minimum viable resource allocation and a set of rules to each of the devices, wherein the minimum viable resource allocation is a threshold for each of the devices to use the network and process data collected by the devices on the network,
wherein appropriate pairs of the devices form, between pairs of the functional network slices, security associations, minimum viable resource allocation confirmation, and mutual trust between the appropriate pairs of the devices, which provide end-to-end security between a source functional network slice and a destination functional network slice in the network upon successful establishment of the security associations and establishment of the mutual trust by all of the appropriate pairs of the devices, and wherein the appropriate pairs of the devices transfer data upon successful confirmation of the security associations and device and data compliance, the device and data compliance establishing a chain of custody between the appropriate pairs of the devices at each of the functional network slices, and
wherein the chain of custody and the security associations and the mutual trust between the appropriate pairs of the devices differ based on traffic flow direction by using different sets of rules and minimum viable resource allocations for different traffic flow directions between the appropriate pairs of the devices.
11 . The network of claim 10 , the network security processor further configured to:
identify at least one device or data having violations based on at least one of unsuccessful security association and the mutual trust.
12 . The network of claim 11 , the network security processor further configured to:
correlate metrics in the network to detect and mitigate suspicious activity; and
isolate the devices, applications, and functional network slices impacted by detected suspicious activity at a point of impact.
13 . The network of claim 11 , the network security processor further configured to:
detect the devices in violation of an appropriate minimum viable resource allocation and appropriate set of rules for the device; and
configure the identified devices based on non-compliance with the appropriate minimum viable resource allocations and the appropriate sets of rules.
14 . The network of claim 10 , wherein the chain of custody is an end-to-end chain of custody and includes at least establishment of the mutual trust, mutual authentication, and data security.
15 . The network of claim 10 , wherein the minimum viable resource allocation for the device is based on information gathered for the device.
16 . The network of claim 15 , wherein the information for each of the devices includes at least connectivity, bandwidth, amount of transmitted data, frequency of transmission, authorization to connect to other devices and network functions, level of and access to data by the device, timing parameters related to the device, location parameters related to the device, device type, security protocols, transmission protocols, access protocols, authorization protocols, security authorization protocols, transmission protocols, communication protocols, and security protocols.
17 . The network of claim 15 , wherein the set of rules is based on the information, the set of rules including at least security rules, transmission rules, access rules, authorization rules, security authorization rules, transmission rules, communication rules, and security rules.
18 . A network comprising:
network devices;
a memory;
a processor in communication with the network devices, the processor configured to:
determine a minimum viable resource allocation for each of the network devices in or comprising a network, wherein the minimum viable resource allocation defines, for each of the network devices, minimum resources needed to engage the network and to handle data collected by network devices on the network;
update the minimum viable resource allocation for at least one of the network devices based on updated information associated with each of the at least one network devices and the network;
detect one or more network devices having violations and under threat based on non-compliance of the one or more network devices with an applicable minimum viable resource allocation;
configure the detected network devices based on non-compliance with the applicable minimum viable resource allocation;
establish, by applicable associated network devices of the network devices using applicable sets of rules, security associations and mutual trust with other associated network devices of the network devices;
wherein a compliance with the applicable sets of rules and the applicable minimum viable resource allocations establishes a chain of custody between the associated network devices, and
wherein the chain of custody differs based on traffic flow direction by using different sets of rules and minimum viable resource allocations for different traffic flow directions between an appropriate pairs of the devices.