Honeyport active network security

• US 9,436,652 B2
• Filed: 06/01/2013
• Issued: 09/06/2016
• Est. Priority Date: 06/01/2013
• Status: Active Grant

• Current Assignee: GE Infrastructure Technology, LLC (General Electric Company)
• Original Assignee: General Electric Company
• Inventors: Schwartz, Matthew Richard
• Primary Examiner(s): BROWN, ANTHONY D
• Application Number:
  US13/907,867
• Publication Number:
  US 20140359708A1
• Time in Patent Office: 1,193 Days
• Field of Search: 726 2- 4
• US Class Current: 1/1
• CPC Class Codes: G06F 15/173 using an interconnection network, e.g. matrix, shuffle, pyramid, star, snowflake
• CPC Class Codes: G06F 21/567 using dedicated hardware
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment

Abstract

A device comprises a processor. The processor is configured to generate a first signal using a first communication protocol. The first signal corresponds to data received by the processor. The processor is configured to generate a second signal using a second communication protocol. The second signal comprises fabricated data generated by the processor. Additionally, the processor is configured to transmit the first signal. The processor is also configured to transmit the second signal.

Claims

1. A device, comprising:

a processor configured to;

generate a first signal using a first communication protocol, wherein the first signal corresponds to data transmitted to the processor using the first communication protocol, wherein the first communication protocol is a common protocol utilized to communicate between the processor and at least one node coupled to the processor in a network;

generate a second signal using a second communication protocol, wherein the second signal comprises decoy data generated by the processor as part of a network security protocol, wherein the second signal is generated independently from the data transmitted to the processor; and

transmit the first signal as an actual signal for reception by the node and transmit the second signal as a decoy signal in parallel with one another.

2. The device of claim 1, wherein the processor is configured to simultaneously transmit the first and second signals.

3. The device of claim 1, wherein the processor is configured to sequentially transmit the first and second signals.

4. The device of claim 1, wherein the processor is configured to detect a transmission using the second communication protocol.

5. The device of claim 4, wherein the processor is configured to capture data present in the transmission.

6. The device of claim 5, wherein the processor is configured to analyze the captured data to determine if a portion of the captured data matches a portion of a set of authorized data.

7. The device of claim 6, wherein the processor is configured to generate and transmit a third signal as the decoy data using the second communication protocol when the portion of the captured data does not match the portion of the set of authorized data, wherein the third signal comprises, a banner, a random data reply, or a random length reply, wherein the third signal mimics correct operation of a human machine interface.

8. The device of claim 6, wherein the processor is configured to generate and transmit an indication of an unauthorized network access when the portion of the captured data does not match the portion of the set of authorized data.

9. The device of claim 5, wherein the processor is configured to transmit the captured data to storage for logging of the captured data.

10. The device of claim 5, wherein the processor is configured to capture at least 32 bytes of data as the captured data.

11. A non-transitory computer-readable medium having computer executable code stored thereon, the code comprising instructions to:

receive data;

generate a first signal using a first communication protocol, wherein the first signal corresponds to the data transmitted to a processor using the first communication protocol, wherein the first communication protocol is a common protocol utilized to communicate between the processor and at least one node coupled to the processor in a network;

generate a second signal using a second communication protocol, wherein the second signal comprises decoy data as part of a network security protocol, wherein the second signal is generated independently from the data transmitted to the processor; and

transmit the first signal as an actual signal for reception by the node and transmit the second signal as a decoy signal in parallel with one another.

12. The non-transitory computer-readable medium of claim 11, wherein the code comprises instructions to detect a transmission using the second communication protocol.

13. The non-transitory computer-readable medium of claim 12, wherein the code comprises instructions to capture data present in the transmission.

14. The non-transitory computer-readable medium of claim 13, wherein the code comprises instructions to analyze the captured data to determine if a portion of the captured data matches a portion of a set of authorized data.

15. The non-transitory computer-readable medium of claim 14, wherein the code comprises instructions to generate and transmit a third signal as the decoy data using the second communication protocol when the portion of the captured data does not match the portion of the set of authorized data, wherein the third signal comprises, a banner, a random data reply, or a random length reply, wherein the third signal mimics correct operation of a human machine interface.

16. The non-transitory computer-readable medium of claim 14, wherein the code comprises instructions to generate and transmit an indication of an unauthorized network access when the portion of the captured data does not match the portion of the set of authorized data.

17. The non-transitory computer-readable medium of claim 13, wherein the code comprises instructions to transmit the captured data to storage for logging of the captured data.

18. A device, comprising:

a memory configured to store instructions; and

a processor configured to execute the stored instructions to;

receive data corresponding to operational characteristics of machinery;

generate a first signal using a first communication protocol related to the machinery, wherein the first signal corresponds to the data-transmitted to the processor using the first communication protocol, wherein the first communication protocol is a common protocol utilized to communicate between the processor and at least one node coupled to the processor in a network;

generate a second signal using a second communication protocol related to the machinery, wherein the second signal comprises decoy data generated by the processor as part of a network security protocol, wherein the second signal is generated independently from the data transmitted to the processor; and

transmit the first signal as an actual signal for reception by the node and transmit the second signal as a decoy signal in parallel with one another.

19. The device of claim 18, wherein the processor is configured to detect a transmission using the second communication protocol from a remote user.

20. The device of claim 19, wherein the processor is configured to forward interaction with the remote user to a server.