Patent Description:
Monitoring data communications occurring on a network can be useful in many applications including cybersecurity and debugging. Data transmitted over the network can be collected and analyzed to identify problems associated with the network. For example, by analyzing the data transmitted on the network, attacks launched against one or more devices on the network can be identified or improper configurations causing communication issues between network devices can be discovered.

To collect the communication data, network tap devices can be deployed to the network to listen to the communications occurring over the network. However, existing network listening mechanisms use network tap devices that are placed near network devices of the network being monitored but are not part of the network. As a result, for a secured network, the network tap devices in the existing listening mechanisms can only access the content of non-encrypted data which significantly limits the amount and type of data that can be collected. Consequently, the analysis based on the limited communication data leads to many security and other network issues remaining undetected. <CIT> describes methods, systems, and computer readable media for monitoring encrypted packet flows with a virtual network environment. <CIT> describes an in-line network tap.

Systems and methods are disclosed for monitoring a secured network by joining network tap devices to the secured network to collect data. In one example, a system includes a headend system configured for managing network devices in a monitored network and an access point configured for managing communications between a subset of the network devices in the monitored network, and a network tap device. The subset of the network devices includes network nodes and a network tap device. The network tap device is in connection with the access point through the monitored network and managed by the access point and the headend system. The network tap device is configured for joining the monitored network as a network device of the monitored network. Joining the monitored network includes communicating with the access point to obtain security keys of the monitored network, and communicating with the access point to obtain a network address for the network tap device. The network tap device is further configured for collecting network data for the monitored network, which includes detecting network traffic including encrypted data and unencrypted data on the monitored network, decrypting the encrypted data in the network traffic using the security keys to generate decrypted data, and adding the decrypted data and unencrypted data to the network data. The network tap device is further configured for connecting to a monitoring workstation via a data transmission network different from the monitored network; and transmitting the collected network data to the monitoring workstation via the data transmission network.

In another example, a network tap device includes a transceiver configured to communicate both in a monitored network and in a data transmission network different from the monitored network. The network tap device is configured for joining the monitored network as a leaf node of the monitored network, including communicating with a network manager to obtain security keys of the monitored network and communicating with the network manager to obtain a network address for the network tap device. The network tap device is further configured for collecting network data for the monitored network, comprising: detecting, on the monitored network, network traffic including encrypted data and unencrypted data, decrypting the encrypted data in the network traffic using the security keys to generate decrypted data, and adding the decrypted data and unencrypted data to the network data. The network tap device is further configured for transmitting the collected network data to a monitoring workstation via the data transmission network.

In yet another example, a method performed by a network tap device includes joining a monitored network as a leaf node of the monitored network, comprising: communicating with a network manager of the monitored network to obtain security keys of the monitored network, and communicating with the network manager to obtain a network address for the network tap device. The method further includes collecting network data for the monitored network, comprising: detecting network traffic on the monitored network, the network traffic comprising encrypted data and unencrypted data, decrypting the encrypted data in the network traffic using the security keys to generate decrypted data, and adding the decrypted data and unencrypted data to the network data. The method also includes connecting to a monitoring workstation via a data transmission network different from the monitored network, and transmitting the collected network data to the monitoring workstation via the data transmission network.

These illustrative aspects and features are mentioned not to limit or define the invention, but to provide examples to aid understanding of the inventive concepts disclosed in this application. Other aspects, advantages, and features of the present invention will become apparent after review of the entire application.

These and other features, aspects, and advantages of the present disclosure are better understood when the following Detailed Description is read with reference to the accompanying drawings, where:.

Systems and methods are provided for monitoring a secured network by joining network tap devices to the secured network to collect data. A network tap device can be deployed to the location to be monitored and further joins the secured network as a network device of the secured network by following the normal joining process of the secured network. As a result, the network tap device can obtain the network keys and credentials. The network tap device can thus listen both encrypted and non-encrypted traffic data on the secured network. The network tap device can use the network keys to decrypt the encrypted traffic and to validate the integrity checks on the network traffic. The collected traffic data can be sent to a monitoring workstation for further analysis. During the monitoring, the network tap devices can be managed by a central or headend system of the secured network to allow for or forbid the network tap devices to join the secured network, or to remove the network tap devices from the secured network.

In one example, a system includes a headend system configured for managing network devices in a secured network that includes multiple network devices communicating with each other through the secured network. To monitor the secured network, one or more network tap devices are deployed at different locations of the secured network. Each of the network tap devices is configured to join the monitored network by communicating with a corresponding access point of the secured network to obtain security keys and security credentials for the monitored network. The network tap device further communicates with the access point to exchange routing information and to obtain a network address for the network tap device.

After joining the secured network, each of the network tap devices operates as a passive leaf node on the secured network and does not participate in network operations in the monitored network such as the routing of the network. The network tap device also minimizes its transmission as much as possible and focuses on listening to network traffic data on the monitored network at its location. These network traffic data may include both encrypted data and unencrypted data. For the encrypted data, the network tap device decrypts the encrypted data using the security keys to generate decrypted data. The decrypted data and unencrypted data are both included in the collected network data.

To transmit the collected network data, each of the network tap devices joins a data transmission network different from the monitored network and establishes a secure channel between the network tap device and a monitoring workstation in the data transmission network. As the network data from the secured network are collected at the network tap devices, each of the network tap devices transmits the collected data to the monitoring workstation through the respective secure channels in the data transmission network. The monitoring workstation can analyze the received network data to identify issues or characteristics associated with the secured network for purposes such as debugging or network security. Based on the analysis results, the monitoring workstation may recommend or instruct the headend system to modify the secured network by, for example, moving certain network devices to different locations, removing certain network devices from the network, adding new network devices to the network, or reconfiguring the network devices in the network to improve the performance, security or other aspects of the network.

As described herein, certain aspects provide improvements to network monitoring. Utilizing a secured and authenticated join of a network tap device to a secured network allows the network tap device to decrypt and validate the authentication of networking traffic. This provides more comprehensive data in the collected network data, which enables a more accurate analysis of the secured network. Since the network tap device joins the monitored network as a passive leaf node, it does not participate in routing or network control traffic and thus has minimal impact on the network. Joining the network tap device as a node on the secure network also allows the network tap device to be managed through the headend system to ensure controlled join, tracking, and removal of a network tap device, thereby reducing the security risks caused by the network tap devices and also for the maintenance of the network tap devices, such as firmware update, without locally accessing these devices.

These illustrative examples are given to introduce the reader to the general subject matter discussed here and are not intended to limit the scope of the disclosed concepts. The following sections describe various additional aspects and examples with reference to the drawings in which like numerals indicate like elements.

The features discussed herein are not limited to any particular hardware architecture or configuration. A computing device can include any suitable arrangement of components that provide a result conditioned on one or more inputs. Suitable computing devices include multipurpose microprocessor-based computer systems accessing stored software that programs or configures the computing system from a general-purpose computing apparatus to a specialized computing apparatus implementing one or more aspects of the present subject matter. Any suitable programming, scripting, or other types of language or combinations of languages may be used to implement the teachings contained herein in software to be used in programming or configuring a computing device.

<FIG> shows an illustrative operating environment <NUM> for monitoring a secured network by joining network tap devices to the secured network to collect data. The operating environment <NUM> includes a secured network <NUM> that is monitored by network tap devices, also referred to as "monitored network <NUM>. " The monitored network <NUM> shown in <FIG> includes multiple nodes 160A-160N (which may be referred to herein individually as a node <NUM> or collectively as the nodes <NUM>). The monitored network <NUM> can be a radio frequency (RF) mesh network (such as an IEEE <NUM>. <NUM> network), a Wi-Fi network, a cellular network, an Ethernet, a power line carrier network, or any other wired or wireless network. Correspondingly, the network node <NUM> can be an RF radio, a computer, a mobile device, a power line network device, or another type of device that can directly communicate with other devices on the monitored network <NUM>.

In examples where the monitored network <NUM> is a mesh network, the nodes <NUM> in the mesh network may include measuring nodes for collecting data from the respective deployed location of the nodes, processing nodes for processing data available to the nodes, router nodes for forwarding data received from one node to another node in the monitored network <NUM>, or nodes that are configured to perform a combination of these functions. The nodes <NUM> are further configured to communicate with each other so that data packets containing messages or other data can be exchanged between the nodes <NUM>.

In one example, the monitored network <NUM> can be associated with a resource distribution network, such as a utility network, to deliver measurement data obtained in the resource distribution network. In this example, the nodes <NUM> can include meters such as electricity meters, gas meters, water meters, steam meters, etc., and be deployed to the various locations of the resource distribution network to deliver measurement data obtained in those locations. The node <NUM> can be implemented to measure various operating characteristics of the resource distribution network, such as the characteristics of resource consumption. In a power distribution network, example characteristics include, but are not limited to, average or total power consumption, the peak voltage of the electrical signal, power surges, and load changes. The nodes <NUM> transmit the collected data through the monitored network <NUM> to, for example, a corresponding root node 114A or root node 114B (which may be referred to herein individually as a root node <NUM> or collectively as the root nodes <NUM>).

A root node <NUM> of the monitored network <NUM> may be configured to communicate with the nodes <NUM> to perform operations such as managing the nodes <NUM>, collecting data from the nodes <NUM>, and forwarding data to a headend system <NUM>. A root node <NUM> can also be configured to function as a node to measure and process data itself. The root node <NUM> may be a personal area network (PAN) coordinator, a gateway, or any other device capable of communicating with the headend system <NUM>. The root node <NUM> ultimately transmits the generated and collected data to the headend system <NUM> via another network <NUM>, such as the Internet, an intranet, or any other data communication network. The headend system <NUM> can function as a central processing system that receives streams of data or messages from the root node <NUM>. The headend system <NUM>, or another system associated with the utility company, can process or analyze the collected data for various purposes, such as billing, performance analysis, or troubleshooting.

The headend system <NUM> is further configured to manage the monitored network <NUM>, such as authenticating nodes <NUM> in the monitored network <NUM>, authorizing network keys and credentials, admitting or removing nodes <NUM>, and so on. In some examples, the monitored network <NUM> may also include an access point configured to manage the monitored network <NUM> under the authorization of the headend system <NUM>. An access point may be a root node <NUM>, a router, or another device on the network <NUM> capable of managing the monitored network <NUM> as described herein. The access point may maintain the security credentials for the network devices on the monitored network <NUM> (e.g., the nodes <NUM>) and manage the network keys used in the monitored network <NUM>. The access point may also be configured to perform various security operations such as issuing security credentials and network keys to network devices and authenticating the network devices when they join the monitored network <NUM>, updating and revoking security credentials and network keys when needed, removing network devices from the network <NUM>, and so on. In some implementations, the access point may communicate with the headend system <NUM> when authenticating a newly joined network device. The access point may also remove network devices from the monitored network <NUM> at the request of the headend system <NUM>.

The access point may also be configured to manage the routing of the network traffic. For example, when a new network device joins the monitored network <NUM>, the access point can communicate with the new network device to establish routing information and assign a network address for the new network device so that the monitored network <NUM> is able to route network traffic to the new network device, such as an IP address, a LAN address and the like.

To monitor the communications on the monitored network <NUM>, one or more network tap devices 150A-150C (which may be referred to herein individually as a network tap device <NUM> or collectively as the network tap devices <NUM>) can be deployed near the nodes <NUM> to be monitored. The network tap device <NUM> may be a stand-alone network tap device or part of an existing network device. For instance, one of the radios of a multi-radio gateway or a multi-radio takeout point (which is sometimes referred to as a collector) can be dedicated as a network tap device <NUM>. In examples, if the communication behaviors of a group of nodes <NUM> show abnormality, a network tap device <NUM> can be deployed to the geographic location of the group of nodes <NUM> for debugging the group of node <NUM> or for detecting security problems associated with the group of nodes. In some cases, if a large geographical area needs to be covered, more than one network tap device <NUM> can be deployed to that area each covering a region in the geographical area. In cases where the network tap device <NUM> is a part of an existing network device, the deployment of the network tap device <NUM> may not be as flexible as a stand-alone network tap device <NUM>.

To capture comprehensive data on the monitored network <NUM>, the network tap device <NUM> is configured to join the monitored network <NUM> and become a network device on the monitored network <NUM>. The joining process can include, for example, the network tap device <NUM> initially joining the network so that it can communicate with its neighbors. The joining process may also include authenticating the network tap device <NUM> so that it has the proper keys and credentials to decrypt encrypted traffic on the monitored network <NUM>, and associating the network tap device <NUM> to the network <NUM> so that it can be addressed and manage from the headend system <NUM>. Additional details regarding the network tap device <NUM> joining the monitored network <NUM> are provided in the following with regard to <FIG> and <FIG>.

After the network tap device <NUM> joins the monitored network <NUM>, the network tap device <NUM> can listen or collect any network traffic that can be detected by the network tap device <NUM>, including encrypted or unencrypted network traffic directed to the network tap device <NUM> or other nodes <NUM>. Here, "network traffic," "network communications," "network data" are used interchangeably and refer to data transmitted from one network device (transmitting device) to another network device (receiving device) over the monitored network <NUM>. The transmitting device and the receiving device may or may not include the network tap device <NUM>. In other words, even if the network communications are not originated from or directed to the network tap device <NUM>, the network tap device <NUM> can still collect them as long as the network tap device <NUM> can detect these communications. As described in more detail below, the network tap device <NUM> operates as a leaf node and does not route any packets nor advertise itself as a network node. It is configured to minimally participate in the monitored network <NUM>, such as providing base-level configuration mechanisms, allowing for firmware download, or answering an internet control message protocol (ICMP) ping, and so on. As such, in some examples, the transmissions performed by the network tap device <NUM> are limited to transmissions needed to maintain the functionality of the network tap device <NUM> and to keep the network tap device <NUM> staying in the monitored network <NUM>, such as responses to networking requests directed at the network tap device <NUM>, basic network hygiene traffic to maintain the network presence of the network tap device <NUM>, and application traffic specific to the network tap device <NUM>.

If the detected network traffic is encrypted, the network tap device <NUM> can use its network keys to decrypt the network traffic thereby providing raw data of the pure network interactions in the collected data <NUM>. The network tap device <NUM> can also use the network keys to validate integrity checks on the received network traffic. The network tap device <NUM> can further collect physical information associated with the detected communication data, such as the signal strength of a message in the detected data, the symbol rate of the detected communication data, or both. The detected traffic data, unencrypted or decrypted, the physical information associated with the detected communication data can all be included in the collected data <NUM>. Additional details regarding the network tap device <NUM> collecting data on the monitored network <NUM> are provided in the following with regard to <FIG>.

It should be noted that in some examples, the network tap device <NUM> joins the monitored network <NUM> loosely and minimally participates in the monitored network <NUM>. The network tap device <NUM> can maintain time and configurations to ensure that it can stay joined sufficiently to listen to all traffic on the monitored network <NUM>. For instance, the network tap device <NUM> can synchronize itself with the nodes <NUM> on the monitored network <NUM>, and perform channel hopping according to the channel hopping sequences of the network <NUM> in order to listen to the traffic on different channels. The network tap device <NUM> can receive some base level networking traffic and reply as appropriate. This can include, for example, routing information so that data can be routed to the network tap device <NUM>, network configuration, and management traffic, such as a Ping command, key revocation, and key updating mechanisms. The network tap device <NUM> is configured to operate as a leaf node and does not provide routing for network traffic data. As such, the access point or a network manager of the monitored network <NUM> can keep the network tap device <NUM> unknown to the nodes <NUM> on the monitored network <NUM> except for the parent node of the network tap device <NUM> for routing purposes. Further, the network tap device <NUM> is configured to minimize its transmissions so that it can detect as much traffic data as possible. For example, the network tap is configured to generate as little traffic as possible to maintain connectivity to the network/access point.

As shown in <FIG>, the network tap device <NUM> can be configured to transmit the collected data <NUM> to a monitoring workstation <NUM>. Transmission of the collected data <NUM> can be performed over a data transmission network <NUM>. The network tap device <NUM> can have different radios for monitoring the monitored network <NUM> and for sending data to the workstation over the data transmission network <NUM>. The data transmission network <NUM> can be an Ethernet, a fiber network, a cellular network, a power line carrier, or any network other than the monitored network <NUM> that can be used to transmit the collected data <NUM> to the monitoring workstation <NUM>. In some implementations, the communication channel between the network tap device <NUM> and the monitoring workstation <NUM> is a secured channel so that the collected data <NUM> containing decrypted traffic data can be securely transmitted to the monitoring workstation <NUM>. The secured channel can be established through, for example, the virtual private network (VPN), the transport layer security (TLS), the IPsec, or any combination thereof. In other implementations, the link between the network tap device <NUM> and the monitoring workstation <NUM> may be a physically isolated or protected network link. Using the data transmission network <NUM> to transmit the collected data <NUM> to the monitoring workstation <NUM> can limit the disruption on the monitored network <NUM> as collected data <NUM> may contain a large data set which affects the throughput of the monitored network <NUM> if they were transmitted via the monitored network <NUM>.

In examples, the network tap device <NUM> streams the collected data <NUM> to the monitoring workstation <NUM>. For instance, a file transfer protocol or bulk export protocol can be utilized to transfer collected data <NUM> as they are received at the network tap device <NUM>. The network tap device <NUM> can be further configured to throttle or batch collected data <NUM> in the case where the network connection in the data transmission network <NUM> incurs data loss. Depending on the application and the purpose of deploying the network tap devices <NUM> to the monitored network <NUM>, the monitoring workstation <NUM> can perform various analyses on the collected data <NUM> to identify issues or discover characteristics of the monitored network <NUM>. For example, if the locations of the network tap devices <NUM> are known to the monitoring workstation <NUM>, the monitoring workstation <NUM> can detect whether a node <NUM> has moved based on the collected data <NUM> using the triangulation process. In another example, the monitoring workstation <NUM> can detect the hidden node problem in the monitored network <NUM> using the collected data <NUM>. For instance, the collected data <NUM> from multiple network tap devices <NUM> may show that two nodes <NUM> are communicating with a third node <NUM> at the same time causing communication collisions and therefore the third node <NUM> is unable to receive the communicated data from either of the two nodes <NUM>. The monitoring workstation <NUM> can employ any existing tool, such as a security incident and event management tool, to perform the analysis on the collected data <NUM>.

In some implementations, the monitoring workstation <NUM> and the headend system <NUM> are separate systems, and the analysis performed at the monitoring workstation <NUM> does not impact the operations of the headend system <NUM>. In other implementations, the monitoring workstation <NUM> is part of the headend system <NUM> or otherwise in communication with the headend system <NUM>. The analysis results can be provided to the headend system <NUM> to better manage the monitored network <NUM>. For example, the monitoring workstation <NUM> can provide analysis results to the headend system <NUM> to show that the network tap devices <NUM> are not properly deployed and communications between certain nodes <NUM> are not collected. In this case, the headend system <NUM> can instruct the network tap devices <NUM> to be repositioned in the monitored network <NUM> and manage the network tap device <NUM> by removing and rejoining the network tap device <NUM> to facilitate the repositioning. The analysis results can also help the headend system <NUM> to better understand the communications between the nodes <NUM> in the monitored network <NUM> and reconfigure these nodes <NUM> if needed.

<FIG> depicts a flowchart illustrating an example of a process <NUM> for monitoring a secured network <NUM> by joining a network tap device <NUM> to the secured network <NUM>, according to certain embodiments of the present disclosure. One or more devices (e.g., the network tap devices <NUM>) implement operations depicted in <FIG> by executing suitable program code. For illustrative purposes, process <NUM> is described with reference to certain examples depicted in the figures. Other implementations, however, are possible.

At block <NUM>, the process <NUM> involves the network tap device <NUM> joining the network <NUM> as a leaf node. The joining can follow the normal operations and communications defined by the network protocol implemented in the monitored network <NUM> including, for example, network advertisement, network node authentication, network key exchange, network node association, etc. <FIG> shows an example of a process for a network tap device <NUM> joining the monitored network <NUM>. Different from other nodes <NUM> in the monitored network <NUM>, the network tap device <NUM> joins the monitored network <NUM> as a network tap device identified through, for example, its identifier, its device name, or a certificate. As will be discussed in detail in the following with regard to block <NUM>, as a network tap device <NUM>, the network tap device <NUM> will minimally participate in the network <NUM> and focus more on network data listening. After the network tap device <NUM> joins the monitored network <NUM>, the network tap device <NUM> has the network keys and credentials and thus the network tap device <NUM> is able to decrypt the traffic data it receives from the monitored network <NUM>.

At block <NUM>, the process <NUM> involves the network tap device <NUM> establishing a secure channel with the monitoring workstation <NUM> over the data transmission network <NUM>. For example, the network tap device <NUM> can employ network security mechanisms such as the VPN, the TLS, the IPsec, or any combination thereof to build a secured channel with the monitoring workstation <NUM>. In other implementations, the link between the network tap device <NUM> and the monitoring workstation <NUM> may be a physically isolated or protected network link. In those scenarios, the link itself is secure and there is no need to build an additional secure channel over the link and this block can be skipped.

At block <NUM>, the process <NUM> involves the network tap device <NUM> collecting communication data on the monitored network <NUM>. The network tap device <NUM> can include any data that it can detect on the monitored network <NUM> into the collected data <NUM>. For example, the collected data <NUM> can include the raw data of each communication it captures on the monitored network <NUM>. The raw data can include, but are not limited to, the synchronization packet used to synchronize the receiver with the transmitter at the beginning of the transmission, acknowledgment packet or negative acknowledgment packet for each transmission, re-sent data packets if no acknowledgment packets are received by the transmitter, or another data that are being transmitted over the monitored network <NUM>.

Depending on the type of the monitored network <NUM>, the nodes <NUM> on the monitored network <NUM> may switch channels from time to time according to channel hopping sequences to perform communication. In this scenario, because the network tap device <NUM> is part of the monitored network <NUM>, the network tap device <NUM> is aware of the channel hopping sequence. The network tap device <NUM> can thus hop to different channels according to the channel hopping sequences to detect network traffics on the monitored network <NUM>. If different channel hopping sequences are used for different pairs of nodes <NUM>, the network tap device <NUM> can be configured to sample the pairwise communications. For instance, the network tap device <NUM> can switch to a first channel for a period of time according to the channel hopping sequence between nodes A and B to detect the traffic data between nodes A and B. The network tap device <NUM> can then switch to a second channel for another period of time according to the channel hopping sequence between nodes C and D to detect the traffic data between nodes these two nodes. In this way, the network tap device <NUM> can sample the communications between pairs of nodes <NUM> even though the nodes <NUM> communicate on different channels.

In some examples, the network tap device <NUM> is further configured to validate the integrity of the network traffic it receives from the monitored network <NUM> and decrypt the traffic data. If the validation or the decryption fails, the network tap device <NUM> can also include an indication of the validation or decryption error in the collected data <NUM> such that the monitoring workstation <NUM> can analyze the problem causing these errors. In some implementations, the network tap device <NUM> can further collect physical information that is associated with the detected communication data. For instance, the network tap device <NUM> can be configured to measure the signal strength of messages in the detected traffic data, such as the received-signal strength indicator (RSSI), and include the signal strength information of these messages into the collected data <NUM>. The network tap device <NUM> can also be configured to measure the symbol rate of the detected traffic data and include such information in the collected data <NUM>.

The network tap device <NUM> may receive some base level networking traffic and is configured to reply as appropriate. For instance, if the network tap device <NUM> receives a synchronization message, it will synchronize its clock with the network using the synchronization message so that it can continue to receive network traffic. Further, if the network protocol requires each node on the network <NUM> to send a certain type of message to the root node <NUM>, such as the destination advertisement object (DAO) message in the routing protocol for low power and lossy networks (RPL), the network tap device <NUM> is configured to comply with such requirements and send the necessary message at the required time interval. Further examples of the base level networking traffic received by the network tap device <NUM> can include routing information so that data can be routed to the network tap device <NUM>, network configuration and management traffic, such as a Ping command, key revocation and key updating mechanisms. The network tap device <NUM> is configured to operate as a leaf node which does not provide routing for network traffic data. The network tap device <NUM> also does not advertise the presence of a network and therefore does not have child nodes. The network tap device <NUM> also does not participate in broadcasts, and will not accept broadcast updates. As such, the access point or a network manager of the monitored network <NUM> can keep the network tap device <NUM> unknown to the nodes <NUM> on the monitored network <NUM> except for the parent node of the network tap device <NUM> for routing purposes. Further, the network tap device <NUM> is configured to minimize its transmission so that it can detect as much traffic data as possible.

At block <NUM>, the process <NUM> involves the network tap device <NUM> transmitting the collected data <NUM> to the monitoring workstation <NUM> over the data transmission network <NUM>. In examples, the network tap device <NUM> streams the collected data <NUM> to the monitoring workstation <NUM>. For instance, a file transfer protocol or bulk export protocol can be utilized to transfer collected data <NUM> as they are received at the network tap device <NUM>. The network tap device <NUM> can be further configured to throttle or batch collected data <NUM> in the case where the network connection in the data transmission network <NUM> incurs data loss. For example, if the data transmission network <NUM> incurs data loss, the network tap device <NUM> can be configured to store the collected data <NUM> in a queue and resume the transmission when the network condition improves. In order to save the memory space of the queue, the network tap device <NUM> can be configured to implement an algorithm to selectively store the collected data <NUM>, such as storing the last hour of data, or the most time-sensitive data. In further examples, the network tap device <NUM> may be configured to process the collected data <NUM> before transmitting it to the monitoring workstation <NUM>, such as detecting patterns (e.g., attack patterns) or abnormalities and flagging the detected patterns or abnormalities in the collected data <NUM>.

At block <NUM>, the process <NUM> involves the network tap device <NUM> determining whether to stop the monitoring and stop collecting the network traffic data. The network tap device <NUM> may determine to stop the monitoring when the headend system <NUM> instructs to suspend or remove the network tap device <NUM> from the monitored network <NUM>. For example, the headend system <NUM> may determine that the monitoring is no longer needed because the debugging is complete or the security issue in the network has been addressed. In other examples, the headend system <NUM> may determine that the network tap device <NUM> is to be suspended or removed because the collected data <NUM> cannot be used to identify the issues associated with the monitored network <NUM> and the network tap device <NUM> should be moved to a different location within the monitored network <NUM>. Other reasons may cause the headend system <NUM> to determine to suspend or remove the network tap device <NUM> from the monitored network <NUM>. If it is determined that the monitoring should be stopped, the process <NUM> ends; otherwise, the network tap device <NUM> continues to collect network traffic data at block <NUM> and transmit the collected data <NUM> to the monitoring workstation <NUM> at block <NUM>.

<FIG> shows a flowchart illustrating an example of a process <NUM> for joining a network tap device to a monitored network, according to certain embodiments of the present disclosure. One or more devices (e.g., the network tap devices <NUM>, the access point of the monitored network <NUM>, or the headend system <NUM>) implement operations depicted in <FIG> by executing suitable program code. For illustrative purposes, process <NUM> is described with reference to certain examples depicted in the figures. Other implementations, however, are possible.

At block <NUM>, the process <NUM> involves the network tap device <NUM> initially joining the monitored network <NUM>. Depending on the protocol implemented by the monitored network <NUM>, a network manager, such as an access point, of the monitored network <NUM> advertises the monitored network <NUM> to the network tap device <NUM> or the network tap device <NUM> advertises itself to the monitored network <NUM>. After the network tap device <NUM> discovers the monitored network <NUM> through the advertisement, the network tap device <NUM> can attempt to join the network. When an authentication server of the monitored network <NUM>, such as the headend system <NUM>, detects that the network tap device <NUM> is trying to join the monitored network <NUM>, the authentication server can authenticate the network tap device <NUM> to determine whether to allow the network tap device <NUM> to join the monitored network <NUM>.

The authentication can be based on information associated with the network tap device <NUM>. For example, the network tap device <NUM> can have an identifier indicating the type of the device, such as the network tap device. In this way, the authentication server can compare the identifier of the network tap device <NUM> with a list of network tap devices <NUM> that are permitted to join the monitored network <NUM>, thereby authenticating the network tap device <NUM>. Alternatively, or additionally, the authentication server can authenticate the network tap device <NUM> based on its name. The names of the network tap devices <NUM> can have a common prefix indicating that these devices are network tap devices. In some types of networks, a network device has an associated certificate and a field of the certificate can be utilized to indicate whether the associated device is a network tap device or not. The authentication server can examine the certificate of the network tap device <NUM> to determine that it is a network tap device <NUM> permitted to join the monitored network <NUM>.

Once the authentication server authenticates the network tap device <NUM>, the network tap device <NUM> is allowed to join the network and is associated with the monitored network <NUM>. At this point, the network tap device <NUM> can communicate with its neighboring devices on the network. However, the network tap device <NUM> does not have the security keys and credentials of the network <NUM> and thus it cannot communicate with the rest of the monitored network <NUM>.

At block <NUM>, the process <NUM> involves authenticating the network tap device <NUM> so that the network tap device <NUM> can obtain network keys and credentials. The monitored network <NUM>, or more specifically the network manager of the monitored network <NUM>, can implement any network protocols used to authenticate a normal network device, such as a node <NUM>, to authenticate the network tap device <NUM> and issue network keys and credentials to the network tap device <NUM>. The authentication can be performed using authentication protocols, such as the extensible authentication protocol (EAP), using certificates or shared secrets, or both. After the network tap device <NUM> is authenticated and obtains the network keys and credentials, the network tap device <NUM> is a trusted device on the monitored network <NUM>. The network tap device <NUM> can listen to both unencrypted and encrypted data on the monitored network <NUM> and use the network keys to validate the integrity of the data and decrypt the encrypted data. However, at this stage, the network tap device <NUM> is not a routable device and cannot be found through routing on the monitored network <NUM>.

At block <NUM>, the process involves associating the network tap device <NUM> with the monitored network <NUM>. At this block, the network tap device <NUM> sends and receives a series of solicitation and configuration messages to obtain the routing information and network address. Depending on the type of the monitored network <NUM>, the network tap device <NUM> may get an IP address. At this stage, the network tap device <NUM> completes the joining process and becomes a network device on the monitored network <NUM>. The network tap device <NUM> can be reached through its network address and managed by the headend system <NUM>.

<FIG> depicts a signal flow diagram illustrating an example of a process for joining a network tap device <NUM> to a monitored network <NUM>, according to certain aspects of the present disclosure. In this example, the monitored network <NUM> implements a Wi-SUN protocol governed by IEEE <NUM>. The process <NUM> includes four stages: the initial joining stage <NUM>, the authentication stage <NUM>, and the association stage <NUM>. At the initial joining stage <NUM>, the network tap device <NUM> joins the network <NUM> by following the normal operations and communications defined by the network protocol implemented in the network <NUM>. This stage includes exchanging advertising messages between the network tap device <NUM> and the access point <NUM> so that the network tap device <NUM> can identify the proper network to join. The network tap device <NUM> and an authentication server <NUM> of the monitored network <NUM> further exchange messages for authenticating the network tap device <NUM> based on, for example, the identifier, name, certificate, or other information associated with the network tap device <NUM>. The network tap device <NUM> further communicates with the access point <NUM> for associating the network tap device <NUM> with the network <NUM>.

After the network tap device <NUM> initially joins the network <NUM>, the process <NUM> proceeds to the authentication stage <NUM>. At this stage, the network tap device <NUM> communicates with the access point <NUM> to authenticate itself. If the authentication is successful, the access point <NUM>, under the authorization of the headend system <NUM>, can provide network keys and credentials to the network tap device <NUM>. In the example shown in <FIG>, the network tap device <NUM> and the access point <NUM> exchange messages by following EAP transport layer security (TLS) authentication protocol to authenticate the network tap device <NUM> and to issue and install pairwise master key (PMK) on the network tap device <NUM>. The PMK can be a shared secret key for one or more sessions of communication and can be used to derive other types of keys in those sessions.

The network tap device <NUM> and the access point <NUM> further communicate EAPOL (EAP over LANs) key frames to exchange keys between them. For example, the network tap device <NUM> and the access point <NUM> can engage in a four-way handshake process to establish a pairwise transient key (PTK) and a group temporal key (GTK). The PTK is used to encrypt traffic between two network devices, such as between the network tap device <NUM> and its parent node or between the network tap device <NUM> and its neighboring node. The GTK is used to decrypt multicast and broadcast traffic. These keys can include a common key shared by multiple devices on the monitored network <NUM> or a unique key for the network tap device <NUM>. Once the keys are established and installed on the network tap device <NUM>, the network tap device <NUM> can listen to and decrypt network traffic even if they are protected by encryption.

At the association stage <NUM>, routing information for the network tap device <NUM> is exchanged and a data link between the network tap device <NUM> and the monitored network <NUM> is established. At this stage, the network tap device <NUM> sends a message <NUM> to solicit information about the network configuration from the access point <NUM>. The access point <NUM> replies back with the network configuration information <NUM> so that the network tap device <NUM> is properly configured on the network. The access point <NUM> further sends an RPL (IPv6 Routing Protocol for Low-Power and Lossy Networks) DIO (Destination-Oriented Directed Acyclic Graph Information Object) message <NUM> to the network tap device <NUM> to remind the network tap device <NUM> to periodically advertise itself on the monitored network <NUM>.

In response, the network tap device <NUM> sends an RPL Destination Advertisement Object (DAO) message <NUM> to the access point <NUM> to propagate its destination information (e.g., the address of the network tap device <NUM>) to the monitored network <NUM> so that other nodes or devices on the monitored network <NUM>, mostly the parent nodes of the network tap device <NUM>, know the current address of the network tap device <NUM> and can determine the routing to the network tap device <NUM>. Sending the destination information to the access point <NUM> allows the access point <NUM> to maintain routing information. After the routing information is determined, the network tap device <NUM> can communicate on the monitored network <NUM>.

The network tap device <NUM> further solicits the IP address from the access point <NUM> through a Dynamic Host Configuration Protocol version <NUM> (DHCPV6) solicit message <NUM> and the access point <NUM> replies with the assigned IP address using a DHCPV6 reply message <NUM>. Once the network tap device <NUM> is assigned an IP address, the network tap device <NUM> is interconnected with and is reachable through IP addressing by other network devices on the monitored network <NUM>. The network tap device <NUM> can operate similarly as other network devices except that the network tap device <NUM> is configured to minimize its transmissions and focus on receiving traffic data from the monitored network <NUM>.

It should be appreciated that while process <NUM> is described with a focus on the Wi-SUN protocol for a mesh network, a similar process can be applied to other types of networks and network protocols. Depending on the type of network and the employed network protocol, the messages being communicated among the network tap device <NUM>, the access point <NUM>, and the authentication server <NUM> might be different. Further, while the above discussion focuses on the scenarios where the network tap device <NUM> operates within an IP network, similar processes can be applied to the scenarios where the network tap device <NUM> operates outside an IP network and is configured to communicate with MAC layer messages.

Referring to <FIG>, which shows a diagram depicting an example of a network tap device <NUM> that is suitable for implementing aspects of the techniques and technologies presented herein. The network tap device <NUM> can include a processor <NUM>. Non-limiting examples of the processor <NUM> include a microprocessor, an application-specific integrated circuit (ASIC), a state machine, a field programmable gate array (FPGA), or other suitable processing devices. The processor <NUM> can include any number of processing devices, including one. The processor <NUM> can be communicatively coupled to non-transitory computer-readable media, such as memory device <NUM>. The processor <NUM> can execute computer-executable program instructions and/or access information stored in the memory device <NUM>.

The memory device <NUM> can store instructions that, when executed by the processor <NUM>, causes the processor <NUM> to perform operations described herein. The memory device <NUM> may be a computer-readable medium such as (but not limited to) an electronic, optical, magnetic, or other storage device capable of providing a processor with computer-readable instructions. Non-limiting examples of such optical, magnetic, or other storage devices include read-only ("ROM") device(s), random-access memory ("RAM") device(s), magnetic disk(s), magnetic tape(s) or other magnetic storage, memory chip(s), an ASIC, configured processor(s), optical storage device(s), or any other medium from which a computer processor can read instructions. The instructions may comprise processor-specific instructions generated by a compiler and/or an interpreter from code written in any suitable computer-programming language. Non-limiting examples of suitable computer-programming languages include C, C++, C#, Visual Basic, Java, Python, Perl, JavaScript, ActionScript, and the like.

The network tap device <NUM> can also include a bus <NUM>. The bus <NUM> can communicatively couple one or more components of the network tap device <NUM>. Although the processor <NUM>, the memory device <NUM>, and the bus <NUM> are respectively depicted in <FIG> as separate components in communication with one another, other implementations are possible. For example, the processor <NUM>, the memory device <NUM>, and the bus <NUM> can be respective components of respective printed circuit boards or other suitable devices that can be disposed in network tap device <NUM> to store and execute programming code.

The network tap device <NUM> can also include a transceiver device <NUM> communicatively coupled to the processor <NUM> and the memory device <NUM> via the bus <NUM>. Non-limiting examples of a transceiver device <NUM> include an RF transceiver and other transceivers for wirelessly transmitting and receiving signals. The transceiver device <NUM> is capable of communicating with the monitored network <NUM> and the data transmission network <NUM> via antennas <NUM> and <NUM>, respectively.

Claim 1:
A system comprising:
a headend system (<NUM>) configured for managing network devices in a monitored network (<NUM>);
an access point (<NUM>, <NUM>) configured for managing communications between a subset of the network devices (<NUM>, <NUM>) in the monitored network (<NUM>), the subset of the network devices comprising network nodes (<NUM>) and a network tap device (<NUM>) unknown to other network devices (<NUM>, <NUM>) in the subset of the network devices except for a parent network device of the network tap device (<NUM>); and
the network tap device (<NUM>) in connection with the access point (<NUM>, <NUM>) through the monitored network (<NUM>) and managed by the access point (<NUM>, <NUM>) and the headend system (<NUM>), the network tap device (<NUM>) configured for:
joining the monitored network (<NUM>) as a network device of the monitored network (<NUM>), joining the monitored network (<NUM>) comprising:
communicating with the access point (<NUM>, <NUM>) to obtain security keys of the monitored network (<NUM>), and
communicating with the access point (<NUM>, <NUM>) to obtain a network address for the network tap device (<NUM>);
collecting network data for the monitored network (<NUM>), comprising:
detecting network traffic on the monitored network (<NUM>), the network traffic comprising encrypted data and unencrypted data,
decrypting the encrypted data in the network traffic using the security keys to generate decrypted data, and
adding the decrypted data and unencrypted data to the network data;
connecting to a monitoring workstation (<NUM>) via a data transmission network (<NUM>) different from the monitored network (<NUM>); and
transmitting the collected network data (<NUM>) to the monitoring workstation (<NUM>) via the data transmission network (<NUM>).