IoT Network Policy Automation Through Device Behavior Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
IT teams in large enterprises face challenges in maintaining an inventory of IoT devices due to their small form factor and lack of central coordination, leading to difficulties in installing software modules and managing network policies effectively.
Innovation Solution
An automated method that identifies IoT device features, classifies them, and defines network policies without administrator input, using machine learning to analyze packet flows and behavior for anomaly detection and remediation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If software agents are installed on IoT devices to manage them, then device management capability is improved, but installation difficulty increases due to small form factor and third-party software constraints
Solution Approach 1:
The patent introduces a network-based intermediary system that mediates between administrators and IoT devices. Instead of installing software on constrained devices, the system uses network protocols and intermediaries to manage devices remotely, bypassing the installation barrier while maintaining management capability.
Solution Approach 2:
The patent replaces the mechanical approach of physically installing software agents on devices with a network-based electronic system. Management functions are transferred from device-local software to network-based services, eliminating the need for physical installation while preserving operational control.
2Measurement precision
If manual inventory tracking of IoT devices is performed, then device tracking accuracy is improved, but time consumption increases due to lack of central coordination
Solution Approach 1:
The patent creates a universal network-based system that performs multiple functions simultaneously: device discovery, inventory tracking, classification, and policy management. This multi-functional approach consolidates what would otherwise require separate manual processes into a single automated system, improving accuracy while reducing time consumption.
Solution Approach 2:
The system enables self-service automation where the network infrastructure automatically discovers, tracks, and manages IoT devices without requiring manual intervention. Devices are automatically registered and tracked through their network communications, eliminating the time-consuming manual inventory process while maintaining accurate tracking.
3Manufacturing precision
If network policies are manually defined for each IoT device, then policy accuracy is improved, but administrative workload increases due to proliferation of devices
Solution Approach 1:
The patent performs preliminary classification of IoT devices based on their observed network behavior and characteristics. By pre-categorizing devices into types with common policy requirements, the system prepares policy templates in advance, allowing accurate policies to be automatically applied without manual definition for each device, thus reducing administrative workload while maintaining accuracy.
Solution Approach 2:
The patent changes the approach from device-by-device policy definition to parameter-based policy application. Instead of manually creating individual policies, the system uses classified device parameters and behavior patterns to automatically generate and apply appropriate policies, scaling efficiently with device proliferation while maintaining accuracy through systematic classification.
Data Source
AI summary
Some embodiments provide a novel method that performs an automated process that identifies features of an IoT device connected to a network, and based on the identified features specifies, without an administrator input, one or more network policies (e.g., security policies) to apply to packets sent or received by the IoT device. The method of some embodiments also performs automated processes that (1) analyze packet flows to and from the IoT devices to identify dynamic network behavior of these devices, and then (2) specify network policies based on the identified dynamic network behavior.