AUTHENTICATING A DEVICE BASED ON COMMUNICATION PATTERNS IN A GROUP OF DEVICES

• US 20180332017A1
• Filed: 05/11/2017
• Published: 11/15/2018
• Est. Priority Date: 05/11/2017
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Childress, Rhonda L., Gupta, Rahul, Madduri, Hari H., Mukherjee, Maharaj, NG, Joanna W.
• Granted Patent: US 10,623,389 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection

Abstract

Provided are techniques for authenticating a device. Accepted communication patterns representing accepted modes of communication between devices in an internet of things network are stored. In response to receiving a new communication from a requesting device of the devices, it is determined whether the new communication matches at least one of the accepted communication patterns. In response to determining that the new communication matches, there is a response to the new communication. In response to determining that the new communication does not match, flagging the new communication as an anomaly and determining how to process the new communication based on the flagging.

Claims

1. A method for authentication, comprising:

storing accepted communication patterns representing accepted modes of communication between devices in an internet of things network; and

in response to receiving a new communication from a requesting device of the devices,

determining whether the new communication matches at least one of the accepted communication patterns;

in response to determining that the new communication matches, responding to the new communication; and

in response to determining that the new communication does not match,

flagging the new communication as an anomaly; and

determining how to process the new communication based on the flagging.

2. The method of claim 1, further comprising:

generating an authentication score for the requesting device based on how closely the new communication matches with at least one of the accepted communication patterns.

3. The method of claim 1, further comprising:

determining that the requesting device and a receiving device are in an authenticated cluster and that the requesting device has an authentication score that exceeds a threshold; and

in response to receiving a new communication at the receiving device from the requesting device, providing a response.

4. The method of claim 1, further comprising:

creating a connected communication graph to represent communications between authenticated clusters with a time dimension.

5. The method of claim 1, further comprising:

storing anti-communication communication patterns that indicate which devices are blocked from communicating with each other.

6. The method of claim 1, further comprising:

determining that a selected device from the devices has been compromised based on at least one of the selected device has changed a kind, a volume, and a frequency of data that the selected device sends.

7. The method of claim 1, further comprising:

determining that a selected device from the devices has been compromised based on receiving a same security token from the selected device and from another device.

8. The method of claim 1, further comprising:

identifying a new communication pattern of a device from the devices trying to continuously reconnect over a period of time, wherein the new communication pattern indicates that the device has gone rogue.

9. The method of claim 1, further comprising:

identifying an infected device from the devices based on a signature of the infected device that comprises an abnormal communication pattern.

10. The method of claim 1, wherein a Software as a Service (SaaS) is configured to perform method operations.

11. A computer program product, the computer program product comprising a computer readable storage medium having program code embodied therewith, the program code executable by at least one processor to perform:

storing accepted communication patterns representing accepted modes of communication between devices in an internet of things network; and

in response to receiving a new communication from a requesting device of the devices,

determining whether the new communication matches at least one of the accepted communication patterns;

in response to determining that the new communication matches, responding to the new communication; and

in response to determining that the new communication does not match,

flagging the new communication as an anomaly; and

determining how to process the new communication based on the flagging.

12. The computer program product of claim 11, wherein the program code is executable by at least one processor to perform:

generating an authentication score for the requesting device based on how closely the new communication matches with at least one of the accepted communication patterns.

13. The computer program product of claim 11, wherein the program code is executable by at least one processor to perform:

determining that the requesting device and a receiving device are in an authenticated cluster and that the requesting device has an authentication score that exceeds a threshold; and

in response to receiving a new communication at the receiving device from the requesting device, providing a response.

14. The computer program product of claim 11, wherein the program code is executable by at least one processor to perform:

creating a connected communication graph to represent communications between authenticated clusters with a time dimension.

15. The computer program product of claim 11, wherein a Software as a Service (SaaS) is configured to perform computer program product operations.

16. A computer system, comprising:

one or more processors, one or more computer-readable memories and one or more computer-readable, tangible storage devices; and

program instructions, stored on at least one of the one or more computer-readable, tangible storage devices for execution by at least one of the one or more processors via at least one of the one or more memories, to perform operations comprising;

storing accepted communication patterns representing accepted modes of communication between devices in an internet of things network; and

in response to receiving a new communication from a requesting device of the devices,

determining whether the new communication matches at least one of the accepted communication patterns;

in response to determining that the new communication matches, responding to the new communication; and

in response to determining that the new communication does not match,

flagging the new communication as an anomaly; and

determining how to process the new communication based on the flagging.

17. The computer system of claim 16, wherein the operations further comprise:

generating an authentication score for the requesting device based on how closely the new communication matches with at least one of the accepted communication patterns.

18. The computer system of claim 16, wherein the operations further comprise:

determining that the requesting device and a receiving device are in an authenticated cluster and that the requesting device has an authentication score that exceeds a threshold; and

in response to receiving a new communication at the receiving device from the requesting device, providing a response.

19. The computer system of claim 16, wherein the operations further comprise:

creating a connected communication graph to represent communications between authenticated clusters with a time dimension.

20. The computer system of claim 16, wherein a Software as a Service (SaaS) is configured to perform computer system operations.