US 12,192,175 B2
Intent-based security for industrial IoT devices
Robert Edgar Barton, Richmond (CA); Thomas Szigeti, Vancouver (CA); Jerome Henry, Pittsboro, NC (US); Ruben Gerald Lobo, Raleigh, NC (US); Laurent Jean Charles Hausermann, Lyons (FR); Maik Guenter Seewald, Nuremberg (DE); and Daniel R. Behrens, Chardon, OH (US)
Assigned to Cisco Technology, Inc., San Jose, CA (US)
Filed by Cisco Technology, Inc., San Jose, CA (US)
Filed on Apr. 2, 2020, as Appl. No. 16/838,822.
Claims priority of provisional application 62/951,645, filed on Dec. 20, 2019.
Prior Publication US 2021/0194851 A1, Jun. 24, 2021
Int. Cl. H04L 9/40 (2022.01); G05B 19/05 (2006.01); G06Q 10/0875 (2023.01); H04L 12/46 (2006.01); H04L 41/0803 (2022.01); H04L 41/0893 (2022.01); H04L 43/026 (2022.01); H04L 47/20 (2022.01); H04L 47/2441 (2022.01); H04L 47/32 (2022.01)
CPC H04L 63/0263 (2013.01) [G05B 19/05 (2013.01); G06Q 10/0875 (2013.01); H04L 12/4641 (2013.01); H04L 41/0803 (2013.01); H04L 41/0893 (2013.01); H04L 43/026 (2013.01); H04L 47/20 (2013.01); H04L 47/2441 (2013.01); H04L 47/323 (2013.01); H04L 63/20 (2013.01)] 18 Claims
OG exemplary drawing
 
1. A method comprising:
identifying, by a device in a network, a packet sent via the network towards an endpoint as being a control packet for the endpoint, wherein a sensor module executed by the device analyzes the packet by performing deep packet inspection to identify use of an automation protocol by the packet;
extracting, by the device, one or more control parameter values from the control packet;
assigning, by the device, and to the endpoint, one or more component tags that identify a type and software of the endpoint and one or more activity tags that identify what the endpoint is doing at a protocol level;
comparing, by the device, the one or more control parameter values to a policy associated with the endpoint, wherein the policy associated with the endpoint defines an expected behavior of the endpoint based on the one or more component tags and the one or more activity tags assigned to the endpoint; and
initiating, by the device, a corrective measure, based on a determination that the one or more control parameter values violate the policy associated with the endpoint.