Centralized security for connected devices

Techniques are described that generally relate to centralized vulnerability discovery and management of disparate network-connected devices. A computing device connected to a network determines vulnerabilities for devices connected to the network. The computing device identifies the devices connected to the network and determines vulnerability information for the network-connected devices using one or more remote sources of vulnerability information. For example, the computing device may access websites containing vulnerability or security information, e.g., by performing web searches on a periodic basis, subscribing to one or more web-based feeds of vulnerability information, or the like. The computing device performs a variety of operations (e.g., ranking vulnerabilities, applying patches, sending notifications, or the like) for the network-connected devices based on the vulnerability information.

TECHNICAL FIELD

The invention relates to network security for networked computing devices.

BACKGROUND

A network may include a variety of disparate devices. For example, a home network may include a wide variety of devices such as personal computing devices including desktop computers, laptop computers, mobile telephones, and gaming devices. In addition, a variety of home appliances, such as thermostats, refrigerators, washing machines, ovens, toasters, lights, sprinkler systems, or other devices may also be able to connect to the network. Such network-connected devices may be referred to as “smart” devices or “Internet of Things” devices. The devices may be subject to a variety of different vulnerabilities, e.g., a weakness or security flaw that a party may exploit with potentially harmful results.

SUMMARY

The techniques of this disclosure generally relate to centralized vulnerability discovery and management of disparate network-connected devices. According to aspects of this disclosure, a computing device connected to a network determines vulnerabilities for devices connected to the network. The computing device identifies the devices connected to the network and determines vulnerability information for the network-connected devices using one or more remote sources of vulnerability information. For example, the computing device may access websites containing vulnerability or security information, e.g., by performing web searches on a periodic basis, subscribing to one or more web-based feeds of vulnerability information, or the like. The computing device performs a variety of operations (e.g., ranking vulnerabilities, applying patches, sending notifications, or the like) for the network-connected devices based on the vulnerability information. In this way, the techniques may enhance efficiency by providing a centralized vulnerability discovery and management source that is capable of managing a wide variety of network-connected devices.

In an example, a computer-implemented method comprises determining, by a computing device configured to communicate with a plurality of connected computing devices, characteristic data for respective connected computing devices of the plurality of connected computing devices; determining, based on the characteristic data, vulnerability information for the respective connected computing devices, wherein determining the vulnerability information comprises accessing one or more remote sources of information; and performing at least one operation based on the vulnerability information.

In another example, a device comprises a memory configured to store characteristic data for respective connected computing devices of a plurality of connected computing devices connected to a network; and one or more processors configured to communicate with the memory, wherein the one or more processors are further configured to: determine the characteristic data for the respective connected computing devices of the plurality of connected computing devices; determine, based on the characteristic data, vulnerability information for the respective connected computing devices, wherein, to determine the vulnerability information, the one or more processors are configured to access one or more remote sources of information; and perform at least one operation based on the vulnerability information.

In another example, a non-transitory computer-readable medium has instructions stored thereon that, upon execution, cause one or more processors to determine characteristic data for respective connected computing devices of a plurality of connected computing devices connected to a network; determine, based on the characteristic data, vulnerability information for the respective connected computing devices, wherein, to determine the vulnerability information, the instructions cause the one or more processors to access one or more remote sources of information; and perform at least one operation based on the vulnerability information.

DETAILED DESCRIPTION

A wide variety of network-connected devices may connect to a home network. For example, the network-connected devices may connect to a Wi-Fi network established using a modem and a wireless router. Network-connected devices may include appliances (e.g., thermostats, refrigerators, washer/dryer, or the like), televisions, smartphones, smartwatches, IP cameras, or other devices. The network-connected devices may operate using a variety of operating systems and communication protocols, which may result in different vulnerabilities for each device.

The techniques of this disclosure generally relate to centralized vulnerability discovery and management of disparate network-connected devices. According to aspects of this disclosure, a computing device connected to a network determines vulnerabilities for devices connected to the network. The computing device identifies the devices connected to the network and determines vulnerability information for the devices using one or more remote sources of vulnerability information. For example, the computing device may access websites containing vulnerability or security information, e.g., by performing web searches on a periodic basis, subscribing to one or more web-based feeds of vulnerability information, or the like.

According to aspects of this disclosure, the computing device performs one or more operations based on the determined vulnerability information. For example, the computing device may output a visual representation of the vulnerability information. In some examples, the computing device may generate a list of vulnerability information, including software updates or patches for addressing the vulnerabilities indicated by the vulnerability information. The computing device may rank the list of vulnerability information, e.g., from most important/critical to least important. In some instances, the computing device may generate notifications based on the vulnerability information and transmit the notifications to one or more computing devices designated by an administrator of the computing device. In still other examples, the computing device may obtain and push patches that address the vulnerabilities indicated by the vulnerability information directly to the connected devices.

In this way, the techniques may enhance efficiency by providing a centralized vulnerability discovery and management source that is capable of managing a wide variety of network-connected devices. For example, a computing device may access a plurality of electronic repositories of vulnerability information associated with a wide variety of electronic devices, which may reduce the need to separately seek out and manage vulnerability information for each device.

FIG. 1is a block diagram illustrating an example computing system10having a computing device12for identification and management of vulnerabilities of connected computing devices, in accordance with the techniques of this disclosure. The example ofFIG. 1includes computing device12, home network14, connected devices16A-16N (collectively, connected devices16), one or more vulnerability information sources18having vulnerability data20, and network22.

Computing device12may include a variety of devices for processing and/or manipulating data. For example, in general, the functionality of computing device12may be implemented in a device that includes one or more processing units, such as one or more microprocessors. The functionality of computing device12may be implemented in hardware or in a combination of software and hardware, where requisite hardware may be provided to store and execute software instructions. Such hardware may include, for example, a processing unit and a computer-readable storage medium. Other hardware may include digital signal processors (DSPs), application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), or any other equivalent integrated or discrete logic circuitry, as well as any combinations of such components.

While illustrated separately from home network14for purposes of explanation, it should be understood that, in some instances, computing device12may be component of home network14. For example, as described in greater detail below, home network14may be a private network that is associated with a residence. In some instances, computing device12may be incorporated in a network hub, switch, router, or other component responsible for managing data of home network14.

In some instances, home network14may be a private network that is associated with a residence of a user. However, while described with respect to a residential network, it should be understood that the techniques described herein are not strictly limited to residential applications. Home network14may comprise one or more of a virtual private network (VPN), a LAN, a WLAN (e.g., a Wi-Fi network), or a wireless personal area network (WPAN) (e.g., a Bluetooth® network). Home network14may provide access to network22for connected devices16.

Network22may comprise any combination of public and private networks. That is, although illustrated as a single entity, network22may comprise any combination of public and/or private telecommunications networks, and any combination of computer or data networks and wired or wireless telephone networks. In some examples, network22may comprise one or more of a wide area network (WAN) (e.g., the Internet), a virtual private network (VPN), a LAN, a WLAN (e.g., a Wi-Fi network), a wireless personal area network (WPAN) (e.g., a Bluetooth® network), or the public switched telephone network (PTSN). Further, although specific network devices are not shown for ease of explanation, it should be understood that network22may include a variety of network and/or computing devices such as, for example, one or more switches, routers, hubs, gateways, security devices such as firewalls, servers, computer terminals, databases, wireless access points, bridges, cable modems, or other network devices.

Connected devices16may include any of a wide variety of electronic devices capable of connecting to a network such as the Internet. In some instances, connected devices may be referred to as “Smart” devices or “Internet of Things” devices. Example connected devices include portable devices such as a cellular phone or other wireless communication device, a laptop computer, a tablet, a portable gaming device, a portable media player, an e-book reader, a watch, as well as a non-portable device such as a desktop computer. Connected devices16may also include a variety of appliances such as thermostats, refrigerators, microwaves, washing machines, dryers, ovens, toasters, lights, sprinkler systems, or the like).

In the illustrated example, connected devices16include microwave oven16A, personal computing devices16B and16C, mobile computing devices16D-16F, washer/dryer16G, refrigerator16H, television16I, and air conditioner16N. As noted above, in other examples, connected devices16may include a wide variety of other devices. While connected devices16may typically communicate via the Internet, in other examples, connected devices16may communicate via any suitable network.

Vulnerability information sources18may be associated with a wide variety of sources of information that may be accessed via a network22. For example, vulnerability information sources18may include computing systems of manufacturers of connected devices16. In this example, vulnerability data20may be stored to databases maintained by the manufacturers and indicate vulnerabilities of connected devices16known to the manufacturer. In other examples, vulnerability information sources18may include a variety of other sources that are not associated with the manufacturer of connected devices16. For example, vulnerability information sources18may be associated with non-profit or for-profit sources of cybersecurity information. Vulnerability information sources18may include trusted websites (which may have associated web feeds such as Rich Site Summary (RSS) feeds for publishing updated information), mailing lists, or other sources of security information.

Non-limiting examples of vulnerability information sources18associated with private vendors include the Microsoft Cyber Trust Blog, the Cisco Security Blog and RSS feed, or the SecureWorks Blog. Non-limiting examples of public vulnerability information sources include databases maintained by the Federal Bureau of Investigation (FBI), the website KrebsonSecurity (www.krebsonsecurity.com), the website DARKReading (www.darkreading.com), the SANS Internet Storm Center, the Defense Cyber Crime Center, the website ThreatBrief (www.threatbrief.com), databases maintained by Industrial Control Systems Cyber Emergency Response Team (ICS-CERT), the Bugtraq mailing list, or the like.

In some instances, vulnerability data20may also include firmware or software patches for addressing the vulnerabilities. For example, upon becoming aware of vulnerabilities, manufacturers of connected devices16(or other parties) may generate firmware or software updates that address the vulnerabilities so that the vulnerabilities can no longer be exploited. Such firmware or software updates may be included with vulnerability data20and may be available for download via network22.

According to aspects of this disclosure, computing device12may determine vulnerability information for connected devices16and perform one or more operations based on the vulnerability information. In some examples, computing device12may initially perform a device discovery process to identify connected devices16connected to home network14. For example, computing device12may poll any device connected to home network14to determine characteristic data for connected devices16.

As described herein, characteristic data generally refers to any data that identifies connected devices16in a manner that allows computing device12to determine applicable vulnerability information. For example, characteristic data may identify one or more hardware or software components of connected devices16. In some examples, characteristic data may include a name or feature that identifies firmware or software executed by connected devices16. In addition, characteristic data may include firmware or software revision information of firmware or software executed by connected devices16. In other examples, characteristic data may include a make, model, and/or serial number (or other identifying information, such as a product or feature name) associated with hardware of connected devices16.

Computing device12may determine, based on the determined characteristic data, vulnerability information for respective connected devices16. For example, computing device12may obtain vulnerability data20for each of connected devices16by accessing vulnerability information sources18. As noted above, in some instances, vulnerability information sources18may be associated with a manufacturer of connected devices16, while in other instances vulnerability information sources18may be associated with a wide variety of other public or private sources of security information.

According to aspects of this disclosure, computing device12may perform one or more operations based on the determined vulnerability information. For example, computing device12may output a visual representation of the vulnerability information, such as a graphical user interface (GUI) that includes a list of vulnerability information, including software or firmware updates or patches for addressing the vulnerabilities indicated by the vulnerability information. In some instances, computing device12may rank the list of vulnerability information, e.g., from most important/critical to least important.

In some examples, computing device12may generate notifications based on the vulnerability information. For example, computing device12may generate an electronic message that includes information regarding the vulnerabilities indicated by the vulnerability information. Computing device12may transmit the notifications to one or more computing devices, such as personal computing devices16B and16C or mobile computing devices16D-16F, designated by an administrator of computing device12.

In some instances, computing device12may generate and transmit notifications that permit a user of the computing device receiving the notifications to perform an action. For example, computing device12may transmit a notification that includes a description of the vulnerability, as well as an option to take the appropriate one of connected devices16offline, e.g., disconnect the appropriate one of connected devices16from network22. In an example for purposes of illustration, computing device12may generate and transmit a short message service (SMS) or another text-based message to which a user may respond to perform the action.

As another example, as described herein, computing device12may obtain vulnerability data20that includes a firmware or software update for addressing a vulnerability. In such an example, computing device12may transmit a notification that includes a description of the vulnerability, as well as an option to push the update to the appropriate one of connected devices16. Again, computing device12may generate and transmit a short message service (SMS) or another text-based message to which a user may respond to apply the update.

In still other examples, computing device12may obtain and push updates or patches included in vulnerability data20directly to connected devices16. For example, upon determining that an update is available, computing device12may prompt the appropriate one of connected devices16to apply the update. Computing device12may download and transmit the update to the appropriate one of connected devices16or instruct the appropriate one of connected devices16to perform the download.

In some examples, the particular operations performed by computing device12may be configurable. For example, computing device12may generate an interface that allows an administrator of computing device12to individually configure the operation performed by computing device12. In this example, the administrator of computing device12may select the operation that is performed based on the vulnerability information on a per-device basis.

FIG. 2is a block diagram illustrating several components of computing system10ofFIG. 1in greater detail. For example, computing device12includes one or more processors32, one or more interfaces34, and one or more storage units36. In the example shown inFIG. 2, computing device12also includes device discovery unit38, vulnerability determination unit40, vulnerability information42, and output unit44. Although not shown inFIG. 2, the components, units or modules of computing device12are coupled (physically, communicatively, and/or operatively) using communication channels for inter-component communications. In some examples, the communication channels may include a system bus, a network connection, an inter-process communication data structure, or any other method for communicating data.

The architecture of computing device12(and, more broadly, computing system10) illustrated inFIG. 2is shown for exemplary purposes only. In other examples, computing system10and computing device12may be configured in a variety of other ways having additional, fewer, or alternative components than those shown inFIG. 2. For example, while computing device12is illustrated in the example ofFIG. 2as a single computing device, in other examples computing device12may have multiple components, e.g., in a distributed computing environment.

Processors32, in one example, are configured to implement functionality and/or process instructions for execution within computing device12. For example, processors32may be capable of processing instructions stored by storage units36. Processors32may include, for example, microprocessors, digital signal processors (DSPs), application specific integrated circuits (ASICs), field-programmable gate array (FPGAs), or equivalent discrete or integrated logic circuitry.

Computing device12may utilize interfaces34to communicate with external devices via one or more wired or wireless connections. In some examples, computing device12utilizes interfaces34to communicate with external devices. Interfaces34may be network interfaces cards, universal serial bus (USB) interfaces, optical interfaces, or any other type of interfaces capable of sending and receiving information via TCP/IP. Examples of such network interfaces may include Ethernet, Wi-Fi, or Bluetooth radios.

Storage units36may store an operating system (not shown) that controls the operation of components of computing device12. For example, the operating system may facilitate the communication of device discovery unit38, vulnerability determination unit40, and output unit44with processors32, interfaces34, and storage units36. In some examples, storage units36are used to store program instructions for execution by processors32. Storage units36may also be configured to store information within computing device12during operation. Storage units36may be used by software or applications (e.g., device discovery unit38, vulnerability determination unit40and output unit44) running on processors32of computing device12to temporarily store information during program execution.

Storage units36may include a computer-readable storage medium or computer-readable storage device. In some examples, storage units36include one or more of a short-term memory or a long-term memory. Storage units36may include, for example, random access memories (RAM), dynamic random access memories (DRAM), static random access memories (SRAM), magnetic hard discs, optical discs, flash memories, or forms of electrically programmable memories (EPROM) or electrically erasable and programmable memories (EEPROM).

Device discovery unit38may include instructions executed by one or more processors32of computing device12to perform the functions described with respect to device discovery unit38. Device discovery unit38may initially perform a device discovery process to identify connected devices16connected to home network14. For example, device discovery unit38may implement simple network management protocol (SNMP) or another protocol to collect characteristic information from connected devices16. Again, characteristic data generally refers to any data that identifies connected devices16in a manner that allows computing device12to determine applicable vulnerability information.

In other examples, device discovery unit38may receive characteristic information from connected devices16, e.g., in a communication session initiated by connected devices16. For example, an administrator may configure connected devices16to transmit characteristic data to computing device12. Device discovery unit38may identify connected devices16based on the received data.

Vulnerability determination unit40may include instructions executed by one or more processors32of computing device12to perform the functions described with respect to vulnerability determination unit40. Vulnerability determination unit40may determine, based on the characteristic data, vulnerability information42for respective connected devices16. Vulnerability information42generally refers to any data that indicates a computing vulnerability of connected devices16. That is, vulnerability information42may be any data that indicates a potential weakness in connected devices16that, when exploited, results in a potentially negative impact to the confidentiality, integrity, or availability of connected devices16. While shown as a separate component for purposes of illustration, in some instances, vulnerability information42may be stored by storage units36.

Vulnerability determination unit40may determine vulnerability information42based on vulnerability data20, e.g., data stored by other computing devices associated with a plurality of vulnerability information sources18. That is, vulnerability determination unit40may store vulnerability data20relevant to connected devices16as vulnerability information42. As noted above, vulnerability information sources18may be associated with a manufacturer of connected devices16or a wide variety of other public or private sources of security information. In some examples, an administrator of computing device12may provide an indication of vulnerability information sources18to vulnerability determination unit40. For example, upon connecting one of connected devices16to home network14, the administrator may register a website of a manufacturer of the connected device16with vulnerability information unit40as one of vulnerability information sources18.

In other examples, vulnerability determination unit40may be responsible for determining vulnerability information sources18and associated vulnerability data20. For example, vulnerability determination unit40may be configured to access a wide variety of websites or other vulnerability information sources18. In this example, vulnerability determination unit40may, based on the characteristic data determined by device discovery unit38, search for relevant vulnerability data20in a configurable set of vulnerability information sources18. For instance, vulnerability determination unit40may be preconfigured to identify a set of vulnerability information sources18, and an administrator of computing device12may alter the set of vulnerability information sources18based on the perceived trustworthiness of vulnerability information sources18.

In some examples, vulnerability determination unit40may search for relevant vulnerability data20on a periodic basis. For example, vulnerability determination unit40may search for relevant vulnerability data20as frequently as necessary (e.g., every minute, 15 minutes, 30 minutes, or the like) to identify the most recent vulnerabilities of connected devices16. Vulnerability determination unit40may additionally or alternatively be configured to subscribe to one or more web-based feeds associated with vulnerability information sources18or be pushed vulnerability data20from vulnerability information sources18. Vulnerability determination unit40may determine the relevant vulnerability data20based on characteristic data from connected devices16.

Output unit44may include instructions executed by one or more processors32of computing device12to perform the functions described with respect to output unit44. According to aspects of this disclosure, output unit44may perform one or more operations based on vulnerability information42. For example, output unit44may output a visual representation of the vulnerability information, such as a graphical user interface (GUI) that includes a list of vulnerability information42, including software or firmware updates or patches for addressing the vulnerabilities indicated by vulnerability information42.

In some instances, output unit44may rank the list of vulnerability information42, e.g., from most important/critical to least important. For example, in some instances, output unit44may determine a device classification for each of connected devices16. The device classification may be based on a device type or functionality of connected devices16. For example, a personal computing device (such as personal computing devices16B and16C or mobile computing devices16D-16F) may have a different classification than an appliance device (such as refrigerator16H). In some instances, the device classification may be based on the type of data stored by connected devices16. That is, connected devices16storing confidential or personal data may have a different classification than connected devices16storing benign operational data. In any case, output unit44may determine the ranking of vulnerability information42based on the determined device classification. For example, output unit44may rank vulnerability information42for certain device classifications (e.g., personal computing devices storing confidential or personal data) higher than other device classifications (e.g., appliance devices storing benign operational data).

Output unit44may additionally or alternatively determine the ranking of vulnerability information42based on a device ranking. For example, in some instances, output unit44may be configured to rank connected devices16, e.g., bases on the type, functionality, or data stored by connected devices16. In another example, an administrator of computing device12may provide an initial ranking of devices or modify an initial ranking determined by output unit44.

In some examples, output unit44may generate one or more notifications46based on vulnerability information42. For example, output unit44may generate an electronic message that includes information regarding vulnerabilities indicated by vulnerability information42. Output unit44may transmit notification46to one or more connected devices, e.g., mobile computing device16D, or another device designated by an administrator of computing device12.

In some instances, output unit44may generate and transmit notifications46that permit a user of the connected device to receive notifications46to perform an action. For example, output unit44may transmit a notification that includes a description of the vulnerability, as well as an option to perform an action. For example, the action may be to disconnect the appropriate one of connected devices16from network22, power down the appropriate one of connected devices16, or perform any other action to reduce the potential for exploitation of the indicated vulnerability. In an example for purposes of illustration, output unit44may generate and transmit an SMS or other electronic message to which a user may respond to perform the action (e.g., “type9to disconnect the device from the network”).

Output unit44may additionally or alternatively obtain vulnerability data20that includes a firmware or software update48(also referred to herein as a “patch”) for addressing a vulnerability and store the updates as vulnerability information42. Output unit44may push update48directly to connected devices16. For example, upon determining that update48is available, output unit44may prompt television16I (in the illustrated example) to apply update48. In some instances, output unit44(or another component of computing device12) may download the appropriate updates from websites of the manufacturers of connected devices16or from other trusted sources.

In some instances, prior to pushing update48, output unit44may transmit a notification that includes a description of the vulnerability, as well as an option to push update48. Again, output unit44may generate and transmit an electronic message to which a user may respond to apply update48.

In some examples, the particular operations performed by output unit44may be configurable. For example, output unit44may generate an interface that allows an administrator of computing device12to individually configure the operation performed by computing device12. In this example, the administrator of computing device12may select the operation that is performed based on the vulnerability information on a per-device basis.

In other examples, output unit44may determine the appropriate operation to perform from a set of operations (e.g., apply update, generate notification, take device offline, or the like) based on the criticality of vulnerability information42. Criticality may be determined based on the source of vulnerability information42. Output unit44may automatically apply critical updates (as designated by the manufacturer or another trusted party), but may simply generate a notification that an update is available for non-critical updates.

FIG. 3is a flow diagram illustrating an example process for maintenance, repair or replacement of a connected device, in accordance with the techniques of this disclosure. While described with respect to computing device12of the computing system10illustrated inFIGS. 1 and 2, it should be understood that the process described with respect toFIG. 3may be carried out by a variety of computing devices.

In the illustrated example, computing device12determines characteristic data for respective connected computing devices16(60). Again, characteristic data generally refers to any data that identifies connected devices16in a manner that allows computing device12to determine applicable vulnerability information. For example, characteristic data may identify one or more hardware or software components or features of connected devices16.

Computing device12determines, based on the characteristic data, vulnerability information42for the respective connected computing devices16, where determining vulnerability information42includes accessing one or more remote vulnerability information sources18(62). Vulnerability information42may be any data that indicates a potential weakness in connected devices16that, when exploited, results in a potentially negative impact to the confidentiality, integrity, or availability of connected devices16. Vulnerability information sources18may be associated with a wide variety of sources of information that may be accessed via a network22. Hence, computing device12may determine, by searching vulnerability information sources18for relevant data based on the characteristic data, applicable vulnerability information42for connected devices16.

Computing device12performs at least one operation based on the vulnerability information (64). For example, as described herein, computing device12may generate one or more notifications that provide information regarding vulnerabilities and/or that allow an administrator to take action. In other examples, computing device12may automatically perform one or more operations, e.g., such as pushing an update or taking connected devises16offline. In still other examples, computing device12may generate a ranking of vulnerability information42and present the ranking, thereby allowing an administrator to selectively address vulnerability information42for each of connected devices16.

Instructions may be executed by one or more processors, such as one or more digital signal processors (DSPs), general purpose microprocessors, application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), or other equivalent integrated or discrete logic circuitry, as well as any combination of such components. Accordingly, the term “processor,” as used herein may refer to any of the foregoing structures or any other structure suitable for implementation of the techniques described herein. In addition, in some aspects, the functionality described herein may be provided within dedicated hardware and/or software modules. Also, the techniques could be fully implemented in one or more circuits or logic elements.