PoE Device Profiling for Security Breach Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security measures are unreliable in detecting unauthorized activity through Power over Ethernet (PoE) systems, as attackers can breach the network by replacing a powered device (PD) with a malicious device that spoofs device attributes carried in Ethernet data.
Innovation Solution
The implementation of techniques to build profiles, or 'fingerprints,' of PDs based on monitored device attributes and power consumption trends. A profiling agent on the Power Sourcing Equipment (PSE) determines device attributes and power consumption, which are then communicated to a security monitoring service to create and maintain profiles for each connected PD, enabling real-time monitoring for deviations from expected behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If device attributes carried in Ethernet data are used for identification, then device recognition is simplified, but security reliability deteriorates because attackers can spoof these attributes
Solution Approach 1:
The patent introduces power consumption data as an intermediary verification layer between the device and the security system. Instead of directly trusting device attributes carried in Ethernet data, the system uses power consumption measurements as a mediator to indirectly verify device identity, thereby maintaining ease of recognition while improving security reliability
Solution Approach 2:
The patent replaces the mechanical/software-based device attribute verification system with a physics-based power consumption analysis system. By substituting the reliance on spoofable digital attributes with measurements of physical power consumption characteristics, the system achieves more reliable security detection while maintaining operational simplicity
2Reliability
If power consumption monitoring is added to detect device anomalies, then security detection capability is improved, but system complexity increases
Solution Approach 1:
The patent makes the Power Sourcing Equipment (PSE) perform multiple functions: it simultaneously provides power over Ethernet and monitors power consumption for security purposes. By making the PSE universal, the system improves security detection without adding separate monitoring hardware, thereby limiting the increase in system complexity
Solution Approach 2:
The patent merges the power delivery function and the security monitoring function into a single integrated system. The same PSE that sources power to devices also measures and analyzes their power consumption patterns, combining two functions that were previously separate and reducing overall system complexity
Data Source
AI summary
Profiles of powered devices (PDs) are created based on monitoring device attributes and power consumption trends for connected PDs. An agent executing on power sourcing equipment (PSE) determines device attributes of connected PDs per port based on data received on each port of the PSE on which a PD is connected. The agent communicates device attributes determined for each port to a service that builds and maintains profiles for connected PDs. As the agent periodically reports monitored power consumption of connected PDs, the service tracks power consumption trends for each PD in association with the PD's profile. If the service detects deviations from the profile of a PD based on additional data received on the corresponding port that are reported by the agent, including substantial deviations from the power consumption trends and/or deviations from device attributes, the service generates alerts for the PD and port combination.