CLOUD COMPUTING AS A SECURITY LAYER

• US 20100257605A1
• Filed: 04/01/2009
• Published: 10/07/2010
• Est. Priority Date: 04/01/2009
• Status: Active Grant

• Current Assignee: Honeywell International Inc.
• Original Assignee: Honeywell International Inc.
• Inventors: McLaughlin, Paul F., Staggs, Kevin P.
• Granted Patent: US 8,555,381 B2
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A system includes a computing cloud comprising at least one data storage unit and at least one processing unit. The computing cloud is configured to connect to at least one client and monitor the traffic of the at least one client. The computing cloud is further configured to determine an operational mode of the client, compare the monitored traffic with an anticipated traffic pattern associated with the operational mode, and determine if a security threat is indicated based on the comparison.

Claims

1. A system comprising:

a computing cloud comprising at least one data storage unit and at least one processing unit;

wherein the computing cloud is configured to connect to at least one client and monitor traffic associated with the at least one client; and

wherein the computing cloud is further configured to determine an operational mode of the client, compare the monitored traffic with an anticipated traffic pattern associated with the operational mode, and determine if a security threat is indicated based on the comparison.

2. The system of claim 1, wherein the security threat comprises an attack on the client through a denial of service (DOS) attack.

3. The system of claim 1, wherein the security threat comprises a man-in-the-middle attack.

4. The system of claim 1, wherein the operational mode is selected from a list of known operational modes, and wherein each operational mode comprises one or more characteristics regarding the anticipated traffic pattern associated with that operational mode.

5. The system of claim 1, wherein the computing cloud is configured to report the security threat to the client.

6. The system of claim 1, wherein the computing cloud is configured to filter data that reaches the client.

7. The system of claim 6, wherein the filtering of data by the computing cloud comprises preventing spam and malware from reaching the client.

8. The system of claim 6, wherein the filtering of data by the computing cloud comprises preventing unauthorized access to the client.

9. A method comprising:

defining a plurality of operational modes, wherein each operational mode is associated with at least one anticipated traffic pattern of a client;

storing the plurality of operational modes;

monitoring traffic of the client;

determining the operational mode of the client; and

comparing the monitored traffic of the client with the anticipated traffic pattern associated with the operational mode of the client.

10. The method of claim 9, further comprising:

preventing a computer intrusion by filtering data traffic based on the comparison.

11. The method of claim 9, further comprising:

identifying a computer intrusion based upon detecting that the anticipated traffic pattern is not the same as the monitored traffic.

12. The method of claim 9, wherein the method is performed by a computing cloud.

13. The method of claim 9, wherein the client controls at least one industrial automation tool.

14. The method of claim 9, wherein monitoring the traffic of the client comprises monitoring at least two traffic types.

15. The method of claim 14, wherein the traffic types comprise a file transfer protocol traffic type and an email traffic type.

16. A system comprising:

a computing cloud comprising at least one processing unit and at least one data storage unit; and

a client connected to a network through the computing cloud;

wherein the computing cloud is configured to monitor network traffic of the client to maintain security of the client.

17. The system of claim 16, wherein the computing cloud is configured to maintain the security of the client by determining an operational mode of the client and comparing an anticipated traffic pattern associated with the operational mode of the client with the monitored traffic of the client.

18. The system of claim 17, wherein the computing cloud is further configured to control high level operations of the client.

19. The system of claim 16, wherein the computing cloud is configured to filter the network traffic of the client.

20. The system of claim 16, wherein, upon the computing cloud determining that a network intrusion has occurred, the computing cloud is configured to filter network traffic from an intruder.