Patent Description:
The Internet-of-Things (IoT) is comprised of physical objects (things) coupled with, embedded with, comprising or constituting network-connected sensors and/or actuators. Conventional objects can be supplemented by such sensors/actuators or specific loT components can be provided as such. For example, domestic appliances, smart home technology, industrial apparatus or conceivably any object may include network connected sensors and/or actuators.

Due to the network-connected nature of loT devices, they are susceptible to malicious action such as intrusion, modification, misappropriation, denial of service, misuse or other conceivable malicious activities. Furthermore, loT devices include low-performance, low-resource devices lacking capabilities to detect and respond to such malicious actions. Document <NPL>) discloses a method, wherein if the authentication frequency of a UE is higher than a certain threshold, then the network will consider the UE's behaviour as abnormal and block the UE's authentication process for a back-off time.

Accordingly there is a need to address security of loT devices.

According to a first aspect of the present invention, there is provided a computer implemented security method for a set of internet-of-things (IoT) devices, the set of devices comprising network-connected sensors and actuators, wherein a data repository stores data about the devices, actions performable by each of the devices and one or more network attacks to which at least a subset of the devices are susceptible, the method comprising: defining, for each network attack, one or more responsive actions for the attack, each responsive action identifying one or more performable actions for performance by one or more devices to mitigate the attack; detecting a device in a compromised state, the compromised state being determined based on a threshold number of occurrences of an attack perpetrated against the device; selecting responsive actions for the perpetrated attack; and triggering the responsive actions to mitigate the perpetrated attack.

Preferably, multiple devices are detected in a compromised state and the method further comprising: prioritising the multiple compromised devices based on the threshold number of occurrences for each device.

Preferably, triggering the responsive actions includes communicating with the one or more devices for the responsive actions to trigger the performable actions identified by the responsive actions, wherein the communication is encrypted.

Preferably, the data repository further includes the defined responsive actions.

Preferably, selecting responsive actions includes identifying devices within a predetermined proximity of the compromised device so as to provide the mitigation of the perpetrated attack in proximity to an effect of the attack.

Preferably, the compromised state is detected based on data received from one or more sensor devices.

Preferably, the compromised state is detected based on network traffic communicated with the compromised device.

According to a second aspect of the present invention, there is a provided a computer system including a processor and memory storing computer program code for performing the steps of the method set out above.

According to a third aspect of the present invention, there is a provided a computer system including a processor and memory storing computer program code for performing the steps of the method set out above.

<FIG> is a block diagram of a computer system suitable for the operation of embodiments of the present invention. A central processor unit (CPU) <NUM> is communicatively connected to a storage <NUM> and an input/output (I/O) interface <NUM> via a data bus <NUM>. The storage <NUM> can be any read/write storage device such as a random-access memory (RAM) or a non-volatile storage device. An example of a non-volatile storage device includes a disk or tape storage device. The I/O interface <NUM> is an interface to devices for the input or output of data, or for both input and output of data. Examples of I/O devices connectable to I/O interface <NUM> include a keyboard, a mouse, a display (such as a monitor) and a network connection.

Embodiments of the present invention trigger responsive actions to mitigate an attack perpetrated against an loT device. In particular, the responsive actions are determined based on a data repository storing data about a set of loT devices, actions performable by the devices and attacks to which at least some of the devices are susceptible. Responsive actions are defined for each attack identifying actions to be performed by devices to mitigate an attack. For example, a sensor loT device detecting a sound, temperature or other measurable or detectable occurrence may be determinative of an occurrence of an attack. Embodiments of the present invention detect such attack constituting a compromised state of the sensor or a device proximate to or in communication with the sensor. Responsive actions are determined base don the data repository and defined responsive actions to trigger the actions to mitigate the attack. The triggered actions are performed by one or more devices identified by the responsive actions that can include devices other than the device in the compromised device.

<FIG> is component diagram of an exemplary arrangement of a security mechanism for loT devices according to embodiments of the present invention. A set of loT devices <NUM> includes network connected sensors and actuators. Such loT devices <NUM> can include, inter alia, by way of example only: temperature sensors; sound sensors; moisture/humidity sensors; pressure sensors; signal sensors; light sensors; time sensors; olfactory sensors; detectors such as gas detectors; cameras; movement actuators; sound emitting actuators; heaters; coolers; dispensers such as gas, liquid, article or other dispensers; network communicators; doorbells; thermostats; sprinklers; fire alarms; lights; baby monitors; message senders such as short-messaging-service transmitters; security cameras; alarms; emergency callers; webcams; network connected domestic appliances; entertainment devices; or any combinations thereof, or other devices as will be apparent to those skilled in the art. Notably, the loT devices <NUM> can each be independent and not directly interoperable such as loT devices that are not associated with each other, except that all loT devices are network connected such as by wired or wireless connection to the internet, an intranet, or other suitable communications network.

A data repository <NUM> is provided in communication with the loT devices <NUM> and includes one or more data stores such as databases, files or the like storing data about the loT devices <NUM>. Such data can include, for example, an identification of each device, a name of each device and a type of each device, such type being indicative of a nature of the device (e.g. a sensor, actuator or both) and/or it's capabilities. Thus, the data repository <NUM> also includes data identifying any actions performable by each of the devices in which sensing and actuation are examples of actions. The data repository <NUM> further stores information about one or more network attacks to which at least a subset of the devices are susceptible, such as attacks by which control of a device is obtained by a malicious agent or attacks by which device data is accessible to a malicious agent. Network attack information stored in the data repository <NUM> is defined such that network attacks can be detected or otherwise recognised by, for example, definition of the characteristics, symptoms or effects of each attack in the data repository <NUM>. The network attacks are so-called because they are perpetrated via a network via which a target loT device communicates. Notably, such network can include communications by unconventional means including, for example, data transfer by light or sound.

According to embodiments of the present invention, one or more responsive actions for each identified network attack are defined. Such responsive actions can be stored by the data repository <NUM> or elsewhere (such as the controller <NUM> described below). Each responsive action identifies one or more performable actions for performance by one or more devices to mitigate an identified network attack. Notably, the performable actions can be performed by one or more devices other than an attacked device. For example, where a light-emitting loT device is attacked, a responsive action can involve a sound-emitting loT device performing an action.

An loT security controller <NUM> is provided as a hardware, software, firmware or combination component in communication with the data repository <NUM> (such as by direct connection, link or network connection). The controller <NUM> is operable to identify attacks of devices <NUM> based on the data repository <NUM>, so detecting devices <NUM> in a compromised state. The detection, by the controller <NUM>, of a device in a compromised state is made with reference to the attack information stored in the data repository <NUM>. Such attack information can be used to detect attacks to determine one or more devices <NUM> in a compromised state based on either or both of: data received from loT devices <NUM> such as sensors; and network traffic communicated by, to or with loT devices <NUM>, such as anomalous or modified network traffic.

The controller <NUM> is further operable to select one or more responsive actions for the attacks based on the defined responsive actions and trigger the responsive actions to mitigate the perpetrated attack. In this way, the controller <NUM> is operable to detect and respond to network attacks perpetrated against loT devices <NUM>.

A detailed exemplary arrangement of the security mechanism will now be described with reference to <FIG> is component diagram of a further exemplary arrangement of a security mechanism for loT devices according to embodiments of the present invention. Many of the features of <FIG> are identical to those described above with respect to <FIG> and these will not be repeated here. <FIG> further includes an loT gateway component <NUM> for managing data communication between loT devices (that can communicate in disparate ways or using disparate protocols). Such an loT gateway provides access to information about or from, and communication with, the loT devices by the data repository <NUM> and the controller <NUM>. In some embodiments the gateway is configured to perform processing of data received from or sent to loT devices <NUM>, such as for conversion to a common format, parsing to interpret data, cryptographic processing of data, normalising of data or the like. Such loT gateway <NUM> thus provides interoperability and potentially scalability between different networks, network protocols, loT device standards and the loT devices <NUM> themselves.

The data repository <NUM> of <FIG> further includes a cloud platform <NUM> such as one or more hosted data facilities provided by a platform as a service or software as a service mechanism and/or by a network-connected data storage and retrieval mechanism. The data repository <NUM> includes data stores such as databases which can be unified, separated, combined, distributed, localised or otherwise arranged as will be apparent to those skilled in the art. A "device data" data store is provided including device data such as one or more of a device identifier, name, functions, location, capabilities, version, vendor or other device information about at least a subset of the loT devices <NUM>. A "device actions" data store is provided including an indication, for at least a subset of the devices <NUM>, of sensing and/or actuation actions performable by the devices. An "attack data" data store is provided including, for each of at least subset of the devices <NUM>, an identification of a device and an identification of an attack that may be perpetrated against the device. Each attack preferably has associated attack characteristics, criteria or other information suitable for detecting the attack. The data store <NUM> further includes an "attack threshold" data store identifying, for each device and each attack to which the device is susceptible, a threshold degree or extent of the attack which, when met, indicates that an attack is malicious and/or otherwise indicates that the attack is to be mitigated. For example, the threshold degree can be a number of occurrences of an attack against a device before the attack is determined to require mitigation and/or the device is determined to require protection or remedial action. The data repository <NUM> further includes a "response action" data store defining performable actions that are to be triggered in one or more devices <NUM> in response to an identified attack. Such "response action" data includes the responsive actions described earlier.

The controller <NUM> of <FIG> includes a device status determiner <NUM> component as a hardware, software, firmware or combination component for determining a status of an loT device <NUM> and, specifically, to determine if a device <NUM> is in a compromised state. The device status determiner <NUM> uses the "attack data" data store of the data repository <NUM> to make such a determination. Notably, such determination is made with reference to the "attack threshold" data store such that a compromised state is determined based on a threshold number of occurrences of an attack perpetrated against the device.

The controller <NUM> of <FIG> further includes an action determiner <NUM> component as a hardware, software, firmware or combination component for determining one or more responsive actions to an attack detected by way of a detection of a compromised state by the device status determiner <NUM>. The responsive actions are selected based on the "response actions" data store and, in some embodiments, the "device actions" data store and include an identification of one or more selected devices <NUM> and the actions such devices are to perform in response to the detected attack. Subsequently, an action deployment <NUM> component as a hardware, software, firmware or combination component is operable to trigger activation, execution or performance of the selected responsive actions by loT devices <NUM> to mitigate the perpetrated attack.

In one embodiment, at least the triggering by the action deployment component <NUM> is performed by network communication to or with the loT devices <NUM> where the communication is encrypted. In this way information relating to the responsive actions and their triggering is not susceptible to interception or modification by an attacker.

In one embodiment, the selectin of responsive actions by the action determiner <NUM> component includes identifying loT devices <NUM> within a predetermined proximity of a compromised device. In this way responsive actions can be mitigated by devices <NUM> proximate to devices in a compromised state.

<FIG> is a flowchart of a security method for loT devices according to embodiments of the present invention. Initially, at step <NUM>, the method defines responsive actions for each network attack, each responsive action identifying performable actions for performance by devices to mitigate the attack. At step <NUM> the device status determiner <NUM> detects a device in a compromised state based on a threshold number of occurrences of an attack perpetrated against the device. At step <NUM> the action determiner <NUM> selects responsive actions for the perpetrated attack and at step <NUM> the action deployment component <NUM> triggers the selected responsive actions to mitigate the perpetrated attach.

Suitably, the computer program is stored on a carrier medium in machine or device readable form, for example in solid-state memory, magnetic memory such as disk or tape, optically or magneto-optically readable memory such as compact disk or digital versatile disk etc., and the processing device utilises the program or a part thereof to configure it for operation. The computer program may be supplied from a remote source embodied in a communications medium such as an electronic signal, radio frequency carrier wave or optical carrier wave. Such carrier media are also envisaged as aspects of the present invention.

It will be understood by those skilled in the art that, although the present invention has been described in relation to the above described example embodiments, the invention is not limited thereto and that there are many possible variations and modifications which fall within the scope of the invention.

Claim 1:
A computer implemented security method, performed by a controller, for a set of internet-of-things (IoT) devices, the set of devices comprising network-connected sensors and actuators, wherein a data repository stores data about the set of devices, actions performable by each of the devices and one or more network attacks to which at least a subset of the set of devices are susceptible, the method comprising:
defining, for each of the one or more network attacks, one or more responsive actions, each responsive action identifying one or more performable actions for performance by one or more devices of the set of devices to mitigate a corresponding network attack of the one or more network attacks;
detecting a device of the set of devices in a compromised state, the compromised state being determined based on a threshold number of occurrences of a network attack, of the one or more network attacks, perpetrated against the device;
selecting responsive actions, of said one or more responsive actions, for the perpetrated attack; and
triggering the selected responsive actions to mitigate the perpetrated network attack, wherein triggering the selected responsive actions includes communicating with the one or more devices to trigger the performable actions identified by the selected responsive actions.