IoT Device Fingerprinting for Legacy Network Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IoT security standards like MUD are inadequate for managing access control in consumer and home networks due to the presence of legacy or non-compliant devices that do not emit their identity, leading to a lack of effective network security and increased vulnerability to attacks.
Innovation Solution
A deterministic identification system that combines active and passive fingerprint techniques with packet analysis to identify IoT devices, creating a unique fingerprint and behavior profile, and applies defense-in-depth security measures through a software-defined networking framework.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If existing IoT security standards like MUD are implemented, then access control automation is improved, but the system becomes ineffective for non-compliant or legacy devices that do not emit their identity
Solution Approach 1:
The patent introduces a network controller as an intermediary that performs device fingerprinting and behavior profiling to identify non-compliant devices. This mediator creates a bridge between the standardized MUD protocol and legacy devices, enabling the system to handle both compliant and non-compliant devices uniformly through observed behavior analysis rather than relying solely on device-provided identifiers.
Solution Approach 2:
The patent replaces the mechanical approach of relying on devices to self-identify through standardized protocols with a observational approach using packet capture and behavior analysis. Instead of devices actively presenting their identity, the system passively observes network traffic patterns to infer device characteristics, thereby accommodating devices that do not implement standard identification mechanisms.
2Reliability
If device fingerprinting and behavior profiling are performed to identify unknown devices, then network security coverage is improved, but system complexity increases
Solution Approach 1:
The patent segments the security system into distinct functional modules: a fingerprinting module for device identification, a behavior profiling module for characterizing device operations, and a policy enforcement module for applying security measures. This segmentation allows each component to specialize in specific tasks, making the overall complex security system more manageable and maintainable while expanding coverage to include previously unidentifiable devices.
Data Source
AI summary
Methods and systems identify a device on an IoT network. A network controller detects connection of the device on the IoT network and determines an organizational unique identifier (OUI) from a media access control (MAC) address of the device. The network controller retrieves a vendor ID from an OUI database. The network controller sends requests to the device via transmission control protocol (TCP) ports and receives a TCP port output. The network controller sends user datagram protocol (UDP) datagrams to the device via UDP ports and receives a UDP port output. The network controller determines a device fingerprint from the vendor ID, the TCP port output, and the UDP port output and matches the device fingerprint to parameters in an identity database to determine a first identity of the device. The network controller sends a DHCP deauthorization request to the device. After detecting reconnection of the device on the IoT network, the network controller collects DHCP option 55 parameters from the device and refines the first identity to determine a second identity based on the parameters.