HONEYPORT ACTIVE NETWORK SECURITY

• US 20140359708A1
• Filed: 06/01/2013
• Published: 12/04/2014
• Est. Priority Date: 06/01/2013
• Status: Active Grant

• Current Assignee: GE Infrastructure Technology, LLC (General Electric Company)
• Original Assignee: General Electric Company
• Inventors: Schwartz, Matthew Richard
• Granted Patent: US 9,436,652 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 15/173 using an interconnection network, e.g. matrix, shuffle, pyramid, star, snowflake
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

A device comprises a processor. The processor is configured to generate a first signal using a first communication protocol. The first signal corresponds to data received by the processor. The processor is configured to generate a second signal using a second communication protocol. The second signal comprises fabricated data generated by the processor. Additionally, the processor is configured to transmit the first signal. The processor is also configured to transmit the second signal.

Claims

1. A device, comprising:

a processor configured to;

generate a first signal using a first communication protocol, wherein the first signal corresponds to data received by the processor;

generate a second signal using a second communication protocol, wherein the second signal comprises fabricated data generated by the processor; and

transmit the first and second signals.

2. The device of claim 1, wherein the processor is configured to simultaneously transmit the first and second signals.

3. The device of claim 1, wherein the processor is configured to sequentially transmit the first and second signals.

4. The device of claim 1, wherein the processor is configured to detect a transmission using the second communication protocol.

5. The device of claim 4, wherein the processor is configured to capture data present in the transmission.

6. The device of claim 5, wherein the processor is configured to analyze the captured data to determine if a portion of the captured data matches a portion of a set of authorized data.

7. The device of claim 6, wherein the processor is configured to generate and transmit a third signal using the second communication protocol when the portion of the captured data does not match the portion of the set of authorized data.

8. The device of claim 6, wherein the processor is configured to generate and transmit an indication of an unauthorized network access when the portion of the captured data does not match the portion of the set of authorized data.

9. The device of claim 5, wherein the processor is configured to transmit the captured data to storage for logging of the captured data.

10. The device of claim 5, wherein the processor is configured to capture at least 32 bytes of data as the captured data.

11. A non-transitory computer-readable medium having computer executable code stored thereon, the code comprising instructions to:

receive data;

generate a first signal using a first communication protocol, wherein the first signal corresponds to the received data;

generate a second signal using a second communication protocol, wherein the second signal comprises fabricated data; and

transmit the first and second signals.

12. The non-transitory computer-readable medium of claim 11, wherein the code comprises instructions to detect a transmission using the second communication protocol.

13. The non-transitory computer-readable medium of claim 12, wherein the code comprises instructions to capture data present in the transmission.

14. The non-transitory computer-readable medium of claim 13, wherein the code comprises instructions to analyze the captured data to determine if a portion of the captured data matches a portion of a set of authorized data.

15. The non-transitory computer-readable medium of claim 14, wherein the code comprises instructions to generate and transmit a third signal using the second communication protocol when the portion of the captured data does not match the portion of the set of authorized data.

16. The non-transitory computer-readable medium of claim 14, wherein the code comprises instructions to generate and transmit an indication of an unauthorized network access when the portion of the captured data does not match the portion of the set of authorized data.

17. The non-transitory computer-readable medium of claim 13, wherein the code comprises instructions to transmit the captured data to storage for logging of the captured data.

18. A device, comprising:

a memory configured to store instructions; and

a processor configured to execute the stored instructions to;

receive data corresponding to operational characteristics of machinery;

generate a first signal using a first communication protocol related to the machinery, wherein the first signal corresponds to the data received by the processor;

generate a second signal using a second communication protocol related to the machinery, wherein the second signal comprises fabricated data generated by the processor; and

transmit the first and second signals.

19. The device of claim 18, wherein the processor is configured to detect a transmission using the second communication protocol from a remote user.

20. The device of claim 19, wherein the processor is configured to forward interaction with the remote user to a server.