Patent Description:
The number of loT devices that are being connected to each other and to the "Cloud" over the Internet is estimated to be in the tens of billions. Furthermore, the use of loT devices, particularly for sensing the environment, is growing. Many of these loT devices have low processing power (and are, for example, based around a Raspberry PiRTM a small factor PC or an Application-Specific Integrated Circuit). Accordingly, loT devices typically transmit their data to a nearby gateway that has more compute, battery and/or network resources, and which is then responsible for communicating the data on to a remote server for providing a service for that data (e.g. storing, processing and/or responding) by means an application operating on the remote server.

As a result of the relatively rudimentary nature of loT devices, loT devices (especially those that operate in public areas) are prone to compromise by means of a malicious attack. Known malicious attacks include: denial of service; man-in-the-middle; malware; and botnets. For example, malware may be introduced as part of a malicious attack on a network or even by way of physical tampering. A single compromised device can then spread malware to other devices and networks resulting in attacks being replicated very quickly. Beyond malicious attacks, poor design and/or malfunction of an loT device can also cause an loT device, and in turn a network, to be compromised with detrimental consequences.

At the same time, in order to ensure efficient utilisation of computational resources, it may be desirable to configure a network such that an loT device and its network connection have a sufficient, but also appropriate, level of security.

It is an aim of the present invention to at least alleviate some of the aforementioned problems.

<CIT> discloses a method for managing the use of gateways on a network includes authenticating a user, determining and managing a path between a user computing device and a destination computing device, the path including at least one of the gateways, and managing user traffic on the path according to a policy associated with the user.

According to a first aspect of the present invention, there is provided a method of operating a telecommunications network, the telecommunications network comprising a client device, a server configured to provide a service for the client device, and a plurality of network nodes communicatively connecting the client device and the server, in which said method comprises the steps of: identifying: characteristic information associated with the client device, wherein said characteristic information is retrieved from a network location provided by the client device, and in which said characteristic information is pre-defined and is comprised within a Manufacturer Usage Description, MUD, file; the service for the client device; in dependence upon the identified service and characteristic information, a service capability requirement for the provision of the identified service to the client device; and capability information for each of the plurality of network nodes; determining a given network node of the plurality of network nodes to be suitable in response to the capability information of said network node satisfying the identified service capability requirement; and subsequently routing network communications associated with the identified service between the client device and the server via at least one of the plurality of network nodes that is determined to be suitable.

Preferably, the determined suitability of a network node is subsequently stored as a part of the characteristic information associated with the client device.

Optionally, the method further comprises the step of, for each network node, comparing the service capability requirement and the capability information, thereby subsequently to perform the determining step.

Optionally, the method is performed by: an edge device for providing an access network for the client device to access the plurality of network nodes; the server; and/or by at least one of the plurality of network nodes.

Optionally, the capability information is identified in response to a request for retrieval and communication of capability information, said retrieval being performed by the network node to which the capability information pertains, from an entity from which said request originated.

Optionally, the service capability requirement is identified in response to a request for retrieval and communication of the service capability requirement, said retrieval being performed by the server, from an entity from which said request originated.

Optionally, a suitable network node sufficiently, but not excessively, satisfies the identified service capability requirement, at least in comparison to a threshold requirement and/or to another network node of the plurality of network nodes.

Optionally, the service is requested by the client device or pushed to client device by the server. Optionally, the plurality of network nodes are interconnected so as to provide a plurality of routes for network communications to be communicated between the client device and the server.

Optionally, the pre-defined information is provided directly by the client device or by a remote network resource identified by the client device.

Preferably, the characteristic information comprises observed characteristic information that is generated in dependence on monitored network communications associated with the client device within the telecommunications network.

Preferably, the network communications are monitored as to: data protocols; time and/or frequency of communication; bandwidth usage; network addresses; encryption type; and/or packet content.

Preferably, the characteristic information is indicative of a/an: type of the client device; function of the client device; type of data that is output by the client device; and/or operating status of the client device.

Preferably, the capability information is indicative of a security capability. Optionally, the security capability is a capability to provide and/or a particular type of: firewall functionality; encryption functionality; Virtualised Private Network functionality; packet processing function (for example, deep packet inspection); and/or remediation functionality (for example, microsegmentation). Optionally, the capability information is identified in dependence upon the identified service.

Preferably, the service capability requirement is a required security capability.

Preferably, the service capability requirement is a required network function. Optionally, said network function is a/an: routing function, such as for determining a routing policy; and/or network quality assurance function.

Preferably, the capability information is indicative of the client device generating Personally Identifiable Information (PII).

Preferably, the routing of network communications is only performed via the at least one network node that is determined to be suitable. Preferably, the at least one network node provides an end-to-end connection between the client device and the server.

Preferably, the service is a network function and/or a data processing function. Preferably, said service is performed by a remote distributed computing system, and for example by a cloud computing system.

According to another aspect of the invention, there is provided a computer-readable carrier medium comprising a computer program, which, when the computer program is executed by a computer, causes the computer to carry out the steps of a method as described above.

According to yet another aspect of the invention, there is provided an apparatus for a telecommunications network, said telecommunications network comprising a client device, a server configured to provide a service for the client device, a plurality of network nodes communicatively connecting the client device and the server, the apparatus comprising: a processor configured to perform the steps of: identifying: characteristic information associated with the client device, wherein said characteristic information is retrieved from a network location provided by the client device, and in which said characteristic information is pre-defined and is comprised within a Manufacturer Usage Description, MUD, file; the service for the client device; in dependence upon the identified service and characteristic information, a service capability requirement for the provision of the service by the server to the client device; and capability information for each of the plurality of network nodes; determining a given network node to be suitable in response to the capability information of said network node satisfying the identified service capability requirement; and subsequently routing network communications associated with the identified service between the client device and the server via at least one of the plurality of network nodes that is determined to be suitable. Preferably, the client device is in the form of an "Internet of Things" ("loT") device. Preferably, each network node is available to be in the form of a/an: network access point; router; gateway; switch; firewall; server; database; controller; processor; and/or virtualised network function.

Preferably, the apparatus comprises a communications interface for communicatively connecting to the telecommunications network, and at least the client device and/or server. Preferably, the apparatus is in the form of an edge device for providing an access network for the client device to access the plurality of network nodes, wherein the processor is provided, at least, as part of the edge device. Optionally, the client device is configured to access the plurality of network nodes only via the edge device, and more preferably said edge device is in the form of a gateway.

Any apparatus feature may also be provided as a corresponding step of a method, and vice versa. As used herein, means plus function features may alternatively be expressed in terms of their corresponding structure, for example as a suitably-programmed processor.

As used throughout, the word 'or' can be interpreted in the exclusive and/or inclusive sense, unless otherwise specified.

The invention is defined solely by the independent claims.

The present invention is now described, purely by way of example, with reference to the accompanying diagrammatic drawings, in which:.

<FIG> shows an exemplary telecommunications system <NUM>, which comprises a/an: client device <NUM>; Edge Device (ED) <NUM>; a wide area telecommunications network <NUM>, comprising a plurality of nodes <NUM>; and a sever <NUM>.

The client device <NUM> is available communicatively to connect to the ED <NUM>, which in turn is configured to provide the client device with access to the wide area network <NUM>. The client device <NUM> is in the form of: a personal computer (laptop or desktop); mobile telecommunications device; and/or Internet of Things (IoT) device.

The ED <NUM> is available to be a wireless or wired access point for the wide area network <NUM>, and is configured to provide a local area network (e.g. by means of Wi-FiRTM, BluetoothRTM, ZigBeeRTM, etc.) and/or cellular connectivity. The ED is therefore available to comprise a router, modem and/or network gateway. The ED is arranged in-line with user traffic that flows between the client device <NUM> and the wide area network <NUM>, and is configured to process such traffic.

The wide area network <NUM> comprises a broadband and/or cellular telecommunications network that allows access to, at least, the server <NUM>. The wide area network comprises a plurality of network nodes <NUM>, which are functional components that help facilitate operation of the network <NUM>, including routing of traffic within the network, and therefore between the ED <NUM> and the server <NUM>. The nodes <NUM> are connected via a plurality of interconnections (shown in <FIG> as double-headed arrows), which provide different pathways for routing traffic within the network <NUM>. A network node is available to be in the form of a: router (including a Multiprotocol Label Switching router); switch; firewall; gateway; access point; database; controller or processor; or virtualised network function.

The server <NUM> is configured to provide a service to the client device <NUM>, for example in response to a service request from the client device. Services that are available to be provided by the server include data processing (e.g. storage, retrieval, transfer, analysis, manipulation, transformation and inspection) and a network service (e.g. routing, network configuration and security functions). Services are available to be provided by applications running on the server <NUM>. The server <NUM> is available to form part of a plurality of interconnected servers, and in particular a Cloud system. The server <NUM> is accessible to the client device via the wide area network <NUM>.

By means of the aforementioned components, and according to the method shown in, and described with reference to, <FIG>, the ED is configured to route traffic between the client device and the server via network nodes <NUM> that are selected so as to meet requirements demanded by a service that is requested by the client device from the server; this is performed with the aim of improving network resource utilisation, secure data transport and processing.

In more detail, the ED <NUM> comprises a: Client Device Inspection Function (CDIF) <NUM>; Service Requirement Identifier (SRI) <NUM>; Policy Creator and Orchestrator (PCO) <NUM>; and Capability Inspection Function (CIF) <NUM>.

The CDIF <NUM> is provided so as to compile characteristic information associated with the client device <NUM>. The CDIF is a device discovery and a traffic monitoring function that is configured to identify each client device connected to the ED, retrieve pre-defined characteristic information, and to monitor traffic to and from each client device so as to generate observed characteristic information for those client devices.

The pre-defined characteristic information for the client device is defined by an operator, manufacturer and/or vendor of the client device. In particular, the pre-defined characteristic information is static and is provided by the client device itself. For example, the pre-defined characteristic information is in the form of a Manufacturer Usage Description (MUD) file, as typically retrieved from a network resource accessible to the ED via the wide area network <NUM>, for example, on the Internet via a URL provided by, or associated with the client device <NUM>, or by inspecting DHCP traffic associated with the client device.

The CDIF is configured to inspect traffic to and/or from the client device <NUM>, and based on said traffic, the CDIF is also configured to generate observed characteristic information for the client device <NUM>. The observed characteristic information represents a dynamic behaviour profile for the client device based on analysis of network communications between the client device and the ED <NUM>, wide area network <NUM> and/or the server <NUM>. For example, the observed client device information is available to include:.

The Service Requirement Identifier (SRI) <NUM> function is configured to retrieve service requirement information (also herein referred to as "service capability requirement") regarding a computational service that the server <NUM> is configured to perform.

Service requirement information are requirements, and particularly computational requirements, of the wide area network <NUM> (and specifically, the plurality of network nodes <NUM>) for the server to provide a given service over the wide area network <NUM>. In one example, the service requirement information is provided to, and stored at, the SRI by the server <NUM>.

The service requirement information for a given service is available to depend upon the characteristic information associated with the client device <NUM>, such that different service requirement information is output for different types of client devices seeking the same service.

In a specific example, the service requirement information requires that: only certain types of client devices and network nodes may be used to communicate network communications associated with a given service and/or such network communications are configured according to a particular protocol, format and/or level of encryption.

The Capability Inspection Function (CIF) <NUM> is configured to retrieve computational capability information associated with a network node <NUM>. The capability information is received at the CIF <NUM> from each of the network nodes in the wide area network <NUM>; this may be performed by the network nodes "pushing" such information to the CIF <NUM> or by the CIF requesting, and then receiving, the information from each network node.

A computational capability pertains to computational characteristics and functionalities, and in particular in relation to security, such as: firewall, encryption, remediation, and VPN functionality, and/or to hardware and/or software version characteristics.

The PCO <NUM> is configured to identify a suitable route through the wide area network <NUM> for communications between the client device <NUM> and the server <NUM>, based on reconciliation of the service requirement information and the capability information, and then to enforce such routing. For example, the PCO is available to configure: network routing policies; firewall parameters; a VPN; proxies; and DHCPs.

In this way, by using service requirement information, the ED <NUM> is capable of dynamically creating bespoke secure network communication paths to help securely route communications between the client device <NUM> and server <NUM> in a resource-efficient manner.

<FIG> shows an exemplary process <NUM> for operating the telecommunications network <NUM>.

At a first step <NUM>, the client device <NUM> establishes a connection with the wide area network <NUM>, via the ED <NUM>. In this way, the client device may communicate with the server <NUM>. The client device subsequently communicates a service request so as to request a service from the server.

At a next step <NUM>, prior to the server <NUM> executing the requested service, the ED identifies, by means of the CDIF <NUM>, the client device <NUM> and subsequently determines characteristic information associated with the client device (i.e. by retrieving pre-defined characteristic information and/or by retrieving and/or generating observed characteristic information).

Furthermore, by means of the SRI <NUM>, the ED identifies the requested service, for example, based on a destination network address of the service request (e.g. IP address, port number, URL, etc.). In dependence upon the identity of the requested service and the identified characteristic information for the client device <NUM>, the SRI retrieves the service requirement information for the requested service.

The ED also retrieves, by means of the CIF <NUM>, capability information in relation to the plurality of network nodes <NUM>.

At a subsequent step <NUM>, the PCO <NUM> compares the capability information of each network node <NUM> and the service requirement information so as to identify whether a given network node has capabilities that meets the requirements as provided in the retrieved service requirement information. The PCO subsequently selects a set of network nodes that are determined to be suitable (i.e. have the computational capabilities required by the requested service) and then routes network communications between the client device and the server using the suitable network nodes <NUM>.

In a specific example, the client device <NUM> is a network-enabled personal medical mentoring device (e.g. a wearable heart monitor), that requests a data storage and processing service from the server <NUM>. The client device therefore generates personally-sensitive medical data (or "Personally Identifiable Information"); this is determined from the pre-defined characteristic information, which is in the form of a Manufacturer Usage Description (MUD) file. The ED retrieves from the server service requirement information for the requested service, and in turn identifies that, for such devices, the requested service requires that data is only communicated using sufficient encryption and only using sufficient firewall capability.

In another example, the client device is a network-enabled CCTV security camera that requests a facial recognition service from the server <NUM>. Again, in this example, the characteristic information for the client device provides that the data from the client device comprises sensitive personal data. As such, for such devices, then service requirement information requires that the data is only communicated using a TCP protocol, to a pre-defined endpoint, using a secure connection having Transport Layer Security, and with a bandwidth of at least 2Mbits/s.

In both specific examples, according to the processing described with reference to steps <NUM> and <NUM>, the PCO <NUM> therefore identifies, using the retrieved capability information, network nodes that are determined to be suitable for the requested service, and the PCO accordingly only routes data from the client device for the requested service via those suitable network nodes.

In an alternative, the SRI <NUM>, PCO180 and the CIF <NUM> reside, instead of only within the ED <NUM>, at least in part, within a or each network node <NUM>; as a result, a/the network node/s is/are available to ascertain the service requirement information and capability information, and then to determine suitability pertaining to a given requested service.

In one example, the capability information and the service requirement information are in the forms of scores indicative of an extent to which a capability is provided. Accordingly, the network nodes for routing network communications associated with a requested service are selected so that the capability information score is at least equal to the service requirement information score. For efficiency, the difference between the capability information score and the service requirement information is minimised.

Claim 1:
A method (<NUM>) of operating a telecommunications network (<NUM>), the telecommunications network comprising a client device (<NUM>), a server (<NUM>) configured to provide a service for the client device, and a plurality of network nodes (<NUM>) communicatively connecting the client device and the server, in which said method comprises the steps of:
identifying:
characteristic information associated with the client device (<NUM>), wherein said characteristic information comprises pre-defined characteristic information retrieved from a network location provided by the client device, and in which said pre-defined characteristic information is comprised within a Manufacturer Usage Description, MUD, file;
the service for the client device (<NUM>);
in dependence upon the identified service and characteristic information, a service capability requirement for the provision of the identified service to the client device (<NUM>); and
capability information for each of the plurality of network nodes (<NUM>);
determining a given network node of the plurality of network nodes to be suitable in response to the capability information of said network node satisfying the identified service capability requirement (<NUM>); and
subsequently routing network communications associated with the identified service between the client device and the server via at least one of the plurality of network nodes that is determined to be suitable (<NUM>).