Patent Description:
Cyber security threats have escalated dramatically in the past few years. Many networked devices, such as IoT (Internet of Things) devices, may be vulnerable to cyber security threats. Such devices may need to be protected against unauthorized interference from people and/or other devices. Unauthorized access may allow cyber criminals to modify parameters of a user's devices and thus to make their life miserable, for example.

Cyber security systems have been described in several publications. For example, <CIT> describes a method and an apparatus for propagating protection within a network. The method comprises monitoring data being transmitted from a portion of the network to another portion of the network. This data is analyzed to determine whether it represent a threat to the network. The analysis is performed by a sensor device comprising a bridge module containing two interfaces, two transceivers and a failsafe module.

A first interface is connected to a first portion of the network and a second interface is connected to a second portion of the network. Under normal operation, the bridging module isolates the first interface from the second interface. Data from the first portion of the network is received via the first interface by the first transceiver module and transmitted to a data analyzer module. If the data analyzer module determines that the data does not represent a threat, the data is transmitted to the second transceiver module and, via the second interface, to the second portion of the network.

In the case the bridge module receives no power or in failure conditions, the failsafe module connects the first interface with the second interface using a relay switch that is normally closed in the unpowered state. When the switch is closed, the data flows directly from the first interface to the second interface with no processing by the bridge module.

To determine the presence of a threat, the sensor device monitors the traffic and captures a "snapshot" of connection statistics and compares that snapshot with a baseline. When comparison indicates an abnormal behavior, a threat is considered as being present. When a threat is detected, the sensor device can terminate traffic flows that are deemed harmful.

In order to enable the sensor device to establish statistics and to detect an abnormal behavior, it must be connected most of the time and the switch must be closed by default.

A cyber security system is also described in the US publication <CIT> which concerns a device and a method for providing a network access control. The device includes one or more hardware relays. Each relay controls exactly one physical line. When the relay is closed, traffic flows freely. When the relay is open, network traffic only flows through a packet filter, which may be implemented in software or hardware. This mode is slower than the full rate of the network line. When the relay is closed and traffic flows at full speed, the device checks for specially-formatted "alert" packets. When such an alert packet is detected, the device automatically opens the relay and resumes packet inspection and filtering.

In this invention, the normal working way consists in transmitting data at full speed. When an alert packet is detected, data is checked before transmission, but the communication is not interrupted.

The European patent application <CIT> also describes a method and a device for transmitting data from a transmitting computer to a receiving computer over a one-way link. In this invention, a physical path between the transmitting computer and the receiving computer is divided into portions comprising one-way links. A data security engine is placed between the one-way links. The transmitting computer is configured to transmit data to the data security engine over a first one-way link. The data security engine is configured to validate data by performing various security tests prior to transmitting the data to the receiving computer over a second one-way link. Invalid data is rejected. Transmissions over the one-way links are set to occur at designated times, such that transmissions do not occur over both the first and second one-way links at the same time.

Relays may optionally be used to physically connect and disconnect each one-way link, thereby ensuring that at least one portion of the physical path is always disconnected. A switch controller may be configured to control the physical relays. The designated times for transmission over each of the one-way links may be established by the transmission of special control signals to the switch controller from the data security engine.

In this invention, there is a need for a specific security engine, which is not suitable for IoT. Moreover, there is always a delay between the emission of data and the reception by the transmission of data receiving computer as the one-way links are not active at the same time.

<FIG> is a network <NUM> according to an embodiment of the disclosure. Some components of network <NUM> may include the cloud <NUM>, which may include one or more servers <NUM> and/or other devices configured to provide persistent network services through the Internet or another publicly-accessible network. Elements configured to communicate using cloud <NUM> may include user remote server <NUM>, data analytics system <NUM>, user mobile device <NUM> (e.g., smart phone, tablet, laptop, etc.), and/or Internet gateway <NUM> of IoT network <NUM>. IoT network <NUM> may be a local network allowing one or more IoT devices to access cloud <NUM> through Internet gateway <NUM>. For example, such devices may include local hub or switch <NUM>, sensors <NUM>, and/or actuators <NUM>.

One weak point in the architecture of <FIG> may arise because the IoT sensors <NUM> and actuators <NUM> are connected to the cloud server <NUM> via the Internet gateway <NUM>, which may have weak software protection (e.g., firewall, encryption etc.) and, accordingly, the entire IoT network <NUM> may rely exclusively on software security tools. This may be contrasted with industrial applications/systems that may use a multi-layered security system that involves firewalls, encryption, honeypots, intrusion detection/prevention systems (IDS/IPS), anti-malware scanners, security information and event management (SIEM), and/or highly trained security teams who may be available at all times. Critical infrastructure, for example big plants and/or governmental facilities, where the safety is an important issue may even be organized based on a M2M (machine to machine) architecture, wherein all communication is implemented on layers and levels with the input and output gateways being very well protected.

<FIG> is a cyber security system <NUM> according to an embodiment of the disclosure. Cyber security system <NUM> may protect IoT connected devices with limited resources. In some embodiments, cyber security system <NUM> may add an additional, independent communication channel which may control a physical communication line between the IoT devices and the cloud (e.g., a physical Ethernet line). In some embodiments, cyber security system <NUM> may select IoT connected device(s) that are allowed to connect and may establish the right of IoT connected device(s) to read data from sensors and/or modify status of actuators.

Cyber security system <NUM> may be connected between any network (e.g., Ethernet-connected) switch/router <NUM> and one or more network-enabled IoT devices <NUM>/<NUM>. Cyber security system <NUM> may include mobile telephony communication transceiver <NUM> (e.g., which may be configured to communicate via GSM, GPRS, <NUM>, <NUM>, <NUM>, etc.), microcontroller <NUM>, Ethernet or other network connection controller <NUM> (which may be read only in some embodiments), Ethernet or other network connection connectors <NUM>, circuit breaker <NUM>, relay <NUM>, relay actuator <NUM>, power supply <NUM>, and/or communication antenna <NUM>. Cyber security system <NUM> may be connected between switch/router <NUM> and one or more network-enabled IoT devices <NUM>/<NUM> on any physical transmission line (e.g., Ethernet line) through connectors <NUM>.

<FIG> is a cyber security method <NUM> according to an embodiment of the disclosure. Cyber security method <NUM> may be performed by cyber security system <NUM>. While cyber security method <NUM> is presented in the context of managing an Ethernet connection, system <NUM> may be used in the same manner for the protection of sensors and actuators which are connected through CAN, Modbus, etc..

At <NUM>, cyber security system <NUM> may be in an initial status wherein the physical transmission line is disrupted by the normally open contacts of relay <NUM>. During this time, network controller <NUM> may monitor network traffic data through switch/router <NUM>. Microcontroller <NUM> may analyze the traffic.

If, at <NUM>, microcontroller <NUM> detects one or more illegitimate activities in the traffic, process <NUM> may proceed to <NUM> where microcontroller <NUM> may warn the IoT network <NUM> owner and/or admin, using transceiver <NUM> and antenna <NUM> (e.g., through SMS messages or other communications), that it may be unsafe to connect the IoT devices <NUM>/<NUM> to the router <NUM>. Microcontroller <NUM> may also lock the system traffic (e.g., by maintaining relay <NUM> open).

If, at <NUM>, microcontroller <NUM> does not detect illegitimate activities for an established period of time, microcontroller <NUM> may cause actuator <NUM> to close relay <NUM> in some embodiments.

In some embodiments, cyber security system <NUM> may be configured to respond to user requests to allow communications by the IoT device <NUM>/<NUM>. For example, at <NUM>, microcontroller <NUM> may wait for a command from a user. At <NUM>, transceiver <NUM> may detect a command from the user. For example, the owner and/or admin may send an SMS message or other communication to unlock the transmission line.

At <NUM>, microcontroller <NUM> may verify the telephone number to determine whether it is a number recognized as belonging to a valid owner and/or admin (e.g., microcontroller <NUM> may have been preconfigured with knowledge of this number in memory). If the phone number is not valid, process <NUM> may proceed to <NUM> where microcontroller <NUM> may warn the IoT network <NUM> owner and/or admin, using transceiver <NUM> and antenna <NUM> (e.g., through SMS messages or other communications), that it may be unsafe to connect the IoT devices <NUM>/<NUM> to the router <NUM>. Microcontroller <NUM> may also lock the system traffic (e.g., by maintaining relay <NUM> open).

If the identity of the owner or admin is confirmed at <NUM>, the second step of safety may be to verify the content of SMS message. At <NUM>, microcontroller <NUM> may examine the content of the SMS message to determine whether it matches an established message (e.g., microcontroller <NUM> may have been preconfigured with knowledge of this message in memory). If the message is not valid, process <NUM> may proceed to <NUM> where microcontroller <NUM> may warn the IoT network <NUM> owner and/or admin, using transceiver <NUM> and antenna <NUM> (e.g., through SMS messages or other communications), that it may be unsafe to connect the IoT devices <NUM>/<NUM> to the router <NUM>. Microcontroller <NUM> may also lock the system traffic (e.g., by maintaining relay <NUM> open). Note that in some embodiments, number and message validation steps may be performed in a reverse order from that described here (e.g., verify message first, then number).

If the content of the message corresponds to the one established, at <NUM>, microcontroller <NUM>, through relay actuator <NUM>, may command the relay <NUM> to close. Thus the transmission line may be opened and data may flow between IoT devices <NUM>/<NUM> and router <NUM>. The transmission line may be connected for an established period of time and, when the time elapses, at <NUM>, microcontroller <NUM>, through relay actuator <NUM>, may command relay <NUM> to open and interrupt the transmission line.

While various embodiments have been described above, it should be understood that they have been presented by way of example and not limitation. It will be apparent to persons skilled in the relevant art(s) that various changes in form and detail can be made therein without departing from the scope. In fact, after reading the above description, it will be apparent to one skilled in the relevant art(s) how to implement alternative embodiments. For example, other steps may be provided, or steps may be eliminated, from the described flows, and other components may be added to, or removed from, the described systems. Accordingly, other implementations are within the scope of the following claims.

In addition, it should be understood that any figures which highlight the functionality and advantages are presented for example purposes only. The disclosed methodology and system are each sufficiently flexible and configurable such that they may be utilized in ways other than that shown.

Although the term "at least one" may often be used in the specification, claims and drawings, the terms "a", "an", "the", "said", etc. also signify "at least one" or "the at least one" in the specification, claims and drawings.

Claim 1:
A security system (<NUM>) comprising:
a normally open relay (<NUM>) between an external network connection and at least one internal network connection;
a network controller (<NUM>) configured to monitor for malicious activity on an external network accessible through the external network connection; and
a microcontroller (<NUM>) configured to:
cause the normally open relay to temporarily close in response to the network controller failing to detect the malicious activity for a predetermined amount of time; and
cause the normally open relay to remain open and generate an alert in response to the network controller detecting the malicious activity.