US 11,681,812 B2
IoT device risk assessment
Gong Cheng, Sunnyvale, CA (US); Mayuresh Ektare, Santa Clara, CA (US); and Mei Wang, Saratoga, CA (US)
Assigned to Palo Alto Networks, Inc., Santa Clara, CA (US)
Filed by Palo Alto Networks, Inc., Santa Clara, CA (US)
Filed on Apr. 26, 2022, as Appl. No. 17/730,055.
Application 17/730,055 is a continuation of application No. 17/342,950, filed on Jun. 9, 2021.
Application 17/342,950 is a continuation of application No. 16/538,787, filed on Aug. 12, 2019, granted, now 11,087,005, issued on Aug. 10, 2021.
Application 16/538,787 is a continuation of application No. 15/357,989, filed on Nov. 21, 2016, granted, now 10,380,348, issued on Aug. 13, 2019.
Prior Publication US 2022/0253535 A1, Aug. 11, 2022
Int. Cl. G06F 21/57 (2013.01); H04L 9/40 (2022.01)
CPC G06F 21/577 (2013.01) [H04L 63/0227 (2013.01); H04L 63/1425 (2013.01)] 30 Claims
OG exemplary drawing
 
1. A computer-implemented method for a first device to govern operation of a second device based on a network security risk posed by the second device, the second device disposed locally to the first device and in local network communication with the first device, the first device being in network communication with a cloud-based computational service, the method comprising:
collecting, over a local network, first information about the second device using the first device;
communicating second information based on the collected first information about the second device to and from the cloud-based computational service, wherein the cloud-based computational service performs at least a portion of a risk assessment analysis of the second device based on packets sent or received from the second device, at least two weighted risk assessment factors, and contents of an event log management system, wherein weights are assigned to the risk assessment factors with varying granularity, including for a type of the second device, and wherein the local network includes a third device having a different type from the second device that is assigned different weighted risk assessment factors based at least in part on its having the different type; and
deciding permissions of the second device based on the risk assessment analysis, said permissions governing permissible destinations for packets sent from the second device.