WO2020178406A1 - Procédé et arrangement pour surveiller la communication d'un dispositif avec un réseau de communication global et/ou à l'intérieur d'un réseau de communication local - Google Patents

Procédé et arrangement pour surveiller la communication d'un dispositif avec un réseau de communication global et/ou à l'intérieur d'un réseau de communication local Download PDF

Info

Publication number
WO2020178406A1
WO2020178406A1 PCT/EP2020/055942 EP2020055942W WO2020178406A1 WO 2020178406 A1 WO2020178406 A1 WO 2020178406A1 EP 2020055942 W EP2020055942 W EP 2020055942W WO 2020178406 A1 WO2020178406 A1 WO 2020178406A1
Authority
WO
WIPO (PCT)
Prior art keywords
communication
communication network
user
display
global
Prior art date
Application number
PCT/EP2020/055942
Other languages
German (de)
English (en)
Inventor
Michael Steigerwald
Wim BONIS
Bastian HEILOS
Original Assignee
vtrust GmbH
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from DE102019105698.5A external-priority patent/DE102019105698A1/de
Priority claimed from DE102019105697.7A external-priority patent/DE102019105697A1/de
Priority claimed from DE102019105699.3A external-priority patent/DE102019105699A1/de
Priority claimed from DE102019105700.0A external-priority patent/DE102019105700A1/de
Application filed by vtrust GmbH filed Critical vtrust GmbH
Publication of WO2020178406A1 publication Critical patent/WO2020178406A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/30—Network architectures or network communication protocols for network security for supporting lawful interception, monitoring or retaining of communications or communication related information
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H04L63/0263—Rule management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls

Definitions

  • the present invention relates to a method for monitoring the communication of a device with a global communication network and / or within a local communication network according to the preamble of claim 1 and a device for monitoring the communication of a device with a global communications network and / or within a local communications network according to the preamble of claim 13.
  • Such devices can include, for example, voice assistants, smart TVs, computer devices, telephones and telephone systems, intercom systems, monitoring devices such as surveillance cameras, smart motion detectors, smart door and door systems
  • Window contacts washing machines, refrigerators, freezers, lighting such as smart lights, coffee machines, smart fire grinders, smart vacuum cleaner robots, smart sockets and similar devices and systems.
  • Such devices are mainly home automation devices and entertainment electronics devices.
  • voice assistants such as Siri ® from Apple ® , Alexa ® from Amazon ® , Google Assistant ® from Google ® , Cortana ® from Microsoft ® and Bixby ® from Samsung ® , which process user communication and based on it commands is known To run.
  • voice assistants can usually be accessed directly via the Internet.
  • cash for example as a program on mobile computer devices, or they can be operated via dedicated voice assistance devices such as the Echo ® series from Amazon ® .
  • these voice assistants are always connected to a global communication network, so that the user does not know what is happening to his personal data.
  • the language assistance providers promise to do everything to ensure the security of communication and to treat the users' data confidentially, but this is not always convincing, as the business model of the language assistance providers is mostly the sale of personal data or its utilization, as well as such languages assistants can also be taken over from the global communication network by third parties without authorization.
  • this problem also applies to all other facilities that communicate or can communicate with a global communication network. This problem also arises when devices communicate within a local communication network.
  • a local communication network is understood to mean a local area network (LAN), while a global communication network is understood to mean larger communication networks, in particular Metropolitan Area Network (MAN), Wide Area Network (WAN) and Global Area Network (GAN) . These terms are used with their current meanings, as explained for example on Wikipedia.
  • LAN local area network
  • WAN Wide Area Network
  • GAN Global Area Network
  • the inventive method for monitoring the communication of a device with a global communication network and / or within a local communication network is characterized in that the actual communication of the device is recorded and the actual communication of the device is displayed outside the device.
  • “Actual communication of the device” means within the scope of the present invention the data actually exchanged with the device. Messages from other devices about this communication of the device, for example error messages regarding this communication, are not actual communication of the device.
  • display means not just a visual representation, but also any output that affects one or more senses of a user.
  • the display can thus also take place acoustically or the like, for example.
  • the display preferably takes place simultaneously or synchronously with the actual communication currently taking place, because the actual communication can be very easily observed by a user.
  • the actual communication is preferably displayed by the lighting of a lighting means whenever such an actual communication of the device occurs takes place. This can be continuous lighting or flashing during actual communication. Whenever there is actual communication, the illuminant would light up or flash and if there is no actual communication between the facility, the illuminant would not illuminate.
  • different display means and / or different display forms, in particular display colors or display sounds, are preferably assigned, because the actual communication between the individual devices can easily be distinguished thereby.
  • the device is selected from the group comprising voice assistants, smart TVs, computer devices, monitoring devices such as surveillance cameras, smart motion detectors, smart door and window contacts, telephones and telephone systems, intercom systems, washing machines, refrigerators, Freezers, lighting such as smart lamps, coffee machines, smart fire alarms, smart vacuum cleaner robots, smart sockets and similar devices and systems.
  • voice assistants smart TVs
  • computer devices monitoring devices such as surveillance cameras, smart motion detectors, smart door and window contacts, telephones and telephone systems, intercom systems, washing machines, refrigerators, Freezers, lighting such as smart lamps, coffee machines, smart fire alarms, smart vacuum cleaner robots, smart sockets and similar devices and systems.
  • monitoring devices such as surveillance cameras, smart motion detectors, smart door and window contacts, telephones and telephone systems, intercom systems, washing machines, refrigerators, Freezers, lighting such as smart lamps, coffee machines, smart fire alarms, smart vacuum cleaner robots, smart sockets and similar devices and systems.
  • lighting such as smart lamps, coffee machines, smart fire alarms, smart vacuum cleaner
  • the device displays the communication and the display of the device and the display of the actual communication of the device take place in the same room, preferably close to one another. Then the user can easily compare whether the facility is truthfully communicating its own communication to the user.
  • the device displays the communication and the display of the device and the display of the actual communication take place in the same way.
  • a voice assistant usually uses light signals to indicate communication. If the actual communication is also indicated by light signals, then the user can very easily determine whether an actual communication of the device is not indicated because it is appropriate Light signals are not displayed during setup, while they are displayed for actual communication.
  • the display of the device and the display of the actual communication of the device are analyzed and a non-correspondence between the two displays is shown, the non-correspondence preferably being logged. This allows the user to find out very easily whether communication is taking place that has not been made known by the facility.
  • a device communicating with the global communication network and / or in the local communication network exists or is capable of communication is analyzed whether a device communicating with the global communication network and / or in the local communication network exists or is capable of communication, and its existence is preferably displayed.
  • the user can be informed of the possibility of integrating the monitoring system as part of an installation of the method according to the invention.
  • the user can also be informed whether a device is already communicating with the global communication network or with another local communication network past a monitoring device executing the method according to the invention. If this device is connected, for example, to an access point that is being monitored, it can then be determined whether the device is communicating past the access point, e.g. due to misconfiguration or a hacker attack. Then the "communication past" can be interrupted, for example by means of "deauthentication" or similar methods.
  • the digital certificates used in the communication for example in the form of public key certificates, are checked and a display is made when invalid certificates are recognized. This can effectively prevent the facility from being compromised.
  • the device is analyzed which data the device exchanges with the global communication network or the local communication network, the data preferably also being logged. This makes it very easy to identify any undesired communication.
  • an access point is switched into the communicative connection between the device and a router, provision preferably being made for the actual communication to be recorded in the access point. As a result, the device's communication with the global communication network or in the local communication network is particularly secure because it is not possible to circumvent the monitoring and protection according to the invention.
  • an access point is switched into the communicative connection between the device and a router, whereby it is preferably provided that communication between the device and the global communication network or a further local communication network bypasses the access point is determined and in particular prevented.
  • the communication between the device and the global communication network or the local communication network can be selectively switched off.
  • the communication between the device and the global and local communication network is particularly secure, since undesired communication can also be prevented if the device is taken over by a third party.
  • the shutdown is preferably carried out in the context of a complete or partial separation of the communication between the device and the global and / or local communication network and / or in relation to
  • Presence of a mobile computing device of the user is determined.
  • the user can select certain times during which the device does not communicate with the global or local communication network or only to a limited extent, whereby his privacy is preserved.
  • misuse is prevented, especially if the facility is taken over by a third party, because a large volume of data within a certain period of time indicates that the facility is not going about its normal activities, but private data is being extracted by a third party. Dynamic limits depending on historical usage behavior are also conceivable.
  • undesired communication is prevented by ensuring that it only takes place when the user can also control the communication.
  • the device is assigned a firewall rule set with at least one firewall rule. This will make the security when communicating between the facility and the global communication network or
  • the method according to the invention for monitoring the communication of a device with a global communication network and / or within a local communication network which is characterized in that the device is assigned a firewall rule set with at least one firewall rule, is independent of this Protection claims whether the actual communication of the facility is recorded and a display of the actual communication of the facility takes place outside the facility or not.
  • firewall is understood to mean a security system in connection with communication networks that protects against undesired network communication. More precisely, the “firewall” is used to restrict network communication based on firewall rules, for example sender, destination and communication services used.
  • the firewall can thus include with regard to a specific device, the communication from the device or to the device is limited, both within a local communication network and to a global communication network. The firewall monitors and controls communication.
  • the device is assigned to a device class and each device class has a dedicated firewall rule set.
  • the assignment of the firewall rule set can be automated and therefore carried out very quickly and securely. This automated assignment will be sufficient for most use cases.
  • the device is assigned to a device class automatically by analyzing the device, preferably the MAC address, service requests or the flost name of the device, or that the device is displayed to the user and two or more device classes be made available for selection so that the user can manually assign the device to a specific device class. This means that the assignment can be made very reliably.
  • the device is assigned a standard device class with the most secure firewall rule set if the device class of the device cannot be determined. As a result, this “unknown” facility is treated most restrictively with regard to its communication rights, so that a high level of security is provided. The user can then preferably adjust the communication rights with regard to this facility in an expert mode.
  • the user can also be shown a selection of available device classes and the user himself has to define a device class and the associated firewall rule set for the unknown facility. Again, such a standard device class could be offered with the most secure firewall rule set available.
  • At least one of the device classes lamps, voice assistants, printers, televisions, computers, hi-fi systems, data backups, cooling devices such as refrigerators or freezers, washing machines, tumble dryers, meat devices, bell devices, fire / smoke alarms and Blackout agent.
  • These are usually device classes that occur in the field of fall automation and in the field of entertainment electronics that perform different tasks.
  • the firewall is set up within an access point of the device to the global communication network or to the local communication network. This means that the firewall is central and is therefore very easy to maintain.
  • the firewall rule set has at least one firewall rule from the group comprising: permissible communication partners, permissible communication destinations, permissible data volume, permissible data throughput and permissible communication times. This allows the permitted communication to be controlled very specifically.
  • the user of the device is requested to release the firewall rule set before the device can communicate with the global communication network or the local communication network. This prevents institutions from communicating for which a firewall has not yet been set up.
  • the user does not have to be shown the firewall rule set itself; it is also sufficient that the determined device class is shown to the user and the user confirms this.
  • the user of the device is able to adapt the firewall rule set in relation to their firewall rules from the group comprising: permissible communication partners, permissible communication destinations, permissible data volume, permissible data throughput and permissible communication times. This allows the user to specifically adapt the firewall for a specific facility in an "expert mode”.
  • Independent protection is claimed for the device according to the invention for monitoring the communication of a device with a global communication network and / or within a local communication network, which is characterized in that there are means to record the actual communication of the device and a display outside the device that is designed to display the actual communication of the facility.
  • the device is designed to carry out the method according to the invention.
  • Independent protection is also claimed for this embodiment. More precisely, for the device according to the invention for monitoring the communication of a device with a global communication network and / or within a local communication network, which is characterized in that means exist to assign a firewall rule set with at least one firewall rule to the device, independently which claims protection as to whether there are means of detecting the actual communication of the device and a display outside the device which is adapted to display the actual communication of the device or not.
  • the device is designed as an access point.
  • the firewall can be present centrally and the corresponding firewall rules can be assigned to the facilities and maintained very easily.
  • the device has means for the optical and / or acoustic display of the actual communication of the device. This allows the actual communication of the facility to be displayed very easily.
  • the device has a floor space for the device.
  • the device can then be placed on the device so that the user can keep an eye on both the device and its actual communication. If it is a device with a relatively large footprint, it can be provided that the device is placed on or next to the device.
  • the invention may be embodied in the form of a computer program product accessible from a computer-usable or computer-readable medium and provided with program code for use by or for use in connection with a computer or any instruction execution system.
  • Independent protection is therefore also claimed for a computer program product which is stored on a computer-readable medium and comprises computer-readable program means which cause the computer to execute the method according to the invention when the program means are executed on the computer.
  • computer-usable or computer-readable media can be any devices or devices that the program allows for use by, or use in connection with, the instruction execution system, device, contain, store, communicate, disseminate or transport in the facility or facility.
  • Mobile communication devices such as cell phones, tablet computers and the like can also be used. can be used.
  • the medium can be an electronic, magnetic, optical, electromagnetic, infrared or semiconductor system (or device or device) or a propagation medium.
  • Examples of a computer readable medium include a semiconductor or solid-state memory, magnetic tape, a removable computer disk, a random access memory (RAM), a read-only memory (RO M), a fixed magnetic disk, and an optical disk.
  • Current examples of optical disks include compact disk read-only memory (CD-ROM), compact disk read / write (CD-R / W) and DVD.
  • a data processing system which is suitable for storing and / or executing the program code comprises at least one processor which is connected directly or indirectly to the inest one memory element by a system bus.
  • the storage element may include local memory which is active during the current execution of the program code, mass memory and buffer memory which provides temporary storage of at least some program code in order to reduce the number of fetches of the code from the mass memory during execution .
  • I / O devices which can include keyboards, displays, pointing devices, etc., but are not limited to them, can be coupled to the system either directly or through I / O controllers connected in between .
  • Network adapters can also be connected to the system to enable the data processing system to be coupled to other data processing systems or to remote printers or storage devices through intermediate private or public networks.
  • M odems, cable modems or Ethernet cards are just a few examples of the types of network adapters currently available in this context.
  • 1 shows a system for communication between a voice assistant and a global one
  • FIG. 3 shows the system according to the invention according to a first preferred exemplary embodiment for communication of a voice assistant with a global communication network
  • FIG. 4 shows the monitoring device according to the invention in a first preferred one
  • FIG. 5 shows the interaction between the monitoring device according to the invention according to FIG. 4 and a voice assistant
  • FIG. 6 shows the system according to the invention according to a second preferred embodiment for communication between a local communication network and a global communication network
  • FIG. 8 the monitoring device according to the invention according to FIG. 7 in a second perspective view
  • FIG. 9 shows the monitoring device according to the invention according to FIG. 7 in an operating state in a perspective view
  • FIG. 10 shows the monitoring device according to the invention according to FIG. 7 in another
  • FIG. 11 the cube body of the monitoring device according to the invention according to FIG. 7 in a first partial perspective view.
  • FIG. 1 shows a system 10 for communication between a voice assistant 12 and a global communication network 14 according to the prior art in a schematic block view.
  • the voice assistant 12 which can be present as an Amazon Echo Plus, for example, communicates with the global communication network 14 via WLAN 15 via a router 16.
  • the global com m unikationsnetz 14 are numerous services, applications and pages 18 available, including the Subscribes- tenzdienst Alexa ® 20th
  • the voice assistant 12 reacts to commands from a user (not shown) and transmits and receives data 22 to and from the router 16, which in turn transmits and receives data 24 to and from the global communications network 14.
  • the voice assistant 12 listens permanently in order to react to the activation word, to analyze and follow commands, and would thus be able to continuously transmit speech and sounds to Alexa® 20. For this purpose, the voice assistant 12 must always be ready to receive and the user does not know when which data 22 will be transmitted 26 at all.
  • FIG. 2 shows a system 50 for communicating the voice assistant 12 with a global communications network 14 according to the prior art in a schematic block view, the voice assistant being part of a local communications network 52 here.
  • Identical reference numerals are used for identical elements as in FIG. 1.
  • the router 16 'with its WLAN 15' is not only the access point for the voice assistant 12 here, but also the voice assistant 12 via LAN (not shown) or WLAN 15 'with other devices such as mass storage devices 54 (for example in the form of a NAS), lighting equipment 56, including compromised lighting equipment 57, televisions and computers 58, mobile computer equipment 60 (for example smartphones), printers 62 , Game consoles 64, surveillance cameras ras 66, Internet radios 68 and the like.
  • mass storage devices 54 for example in the form of a NAS
  • lighting equipment 56 including compromised lighting equipment 57, televisions and computers 58, mobile computer equipment 60 (for example smartphones), printers 62 , Game consoles 64, surveillance cameras ras 66, Internet radios 68 and the like.
  • All devices 12, 54, 56, 57, 58, 60, 62, 64, 66, 68 are networked 70 with one another, which fundamentally represents a problem if the local communication network 52 has a compromised device 57.
  • the compromised device 57 is a smart lightbulb 57 which collects 72 sensitive data in the local communication network 52 and sends it 74, 30 'to an attacker 28 in the global communication network 14, or to the attacker 28 as a gateway 74, 30 'in the local communication network 14 is used.
  • FIG 3 the system 100 used according to the invention is shown in a schematic block view according to a first preferred embodiment, identical reference numerals being used for identical elements as in Figure 1.
  • the voice assistant 12 is not communicating directly with the router 16, but that the monitoring device 102 according to the invention is switched on in the communication.
  • This monitoring device 102 thus acts like an access point which mediates the communication between the voice assistant 12 and the router 16.
  • the voice assistant 12 thus communicates 104 with the monitoring device 102, the monitoring device 102 communicates 106 with the router 16, and the router communicates 108 with the global communication network 14.
  • the monitoring device 102 provides a firewall 109 which is equipped with its own firewall rule set for the voice assistant 12. This firewall rule set is automatically assigned to the voice assistant 12 by the monitoring device 102. More precisely, the monitoring device 102 is the The device class of the voice assistant 12 is analyzed, for example, by determining the MAC address and the rule set stored for the device class in the monitoring device 102 is read out and assigned to the voice assistant 12. Before the use of the voice assistant 12, the device class is displayed to the user for approval and can then be adapted to personal needs by the user in an expert mode.
  • this facility is assigned a standard device class with the safest firewall rule set for security purposes, so that this facility is treated most restrictively with regard to its communication rights.
  • the monitoring device 102 can also display a selection of available device classes to the user, and the user himself must define a device class and the associated firewall rule set for the unknown facility. Such a standard device class could again be offered with the most secure firewall rule set available.
  • Fig. 4 shows the monitoring device 102 according to the invention in a first preferred embodiment in a perspective view.
  • the monitoring device 102 has a body 110 with a foot 112 and a footprint 114 for the voice assistant 12.
  • the monitoring device 102 also has a display 116 and a loudspeaker (not shown) for outputting optical and acoustic signals.
  • other output devices can also be used to output signals other than optical and acoustic signals.
  • operating elements can be used to set up the monitoring device 102 and to activate certain functions. This setup and activation can, however, also take place via a suitable program, for example the app of a mobile computer device (not shown).
  • a sensor system for detecting the light signal of the voice assistant 12 there can also be connections for a sensor system for detecting the light signal of the voice assistant 12, or this sensor system is integrated directly into the monitoring device 102.
  • the footprint 114 is dimensioned in such a way that the voice assistant 12 can be placed on it, a shapely unit 118 consisting of the monitoring device 102 and the voice assistant 12 being produced.
  • the voice assistant 12 can still be operated with its operating elements 120 and the actual communication 108 can nevertheless be shown by the display 116 (see FIG. 5).
  • the monitoring device 102 can have a switch for switching on and off (not shown). Otherwise, the monitoring device 102 can be completely operated and configured by remote control and configuration via a suitable program (not shown), for example the app of a mobile computer device.
  • the monitoring device 102 has two independent WLAN interfaces 126, 128 (cf. FIG. 3).
  • a first WLAN interface 126 is used for communication 104, 106 with the voice assistant 12 and router 16
  • the second WLAN interface 128 is used for constant monitoring of the receivable local communication networks 122, in which other devices such as Printers, televisions, audio systems, fuss automation devices, lighting equipment, data backup devices and the like. As well as other routers can be integrated.
  • the monitoring device 102 has a control and evaluation unit (not shown) for monitoring and analyzing the communication 104, 106, 108 and for controlling this communication 104, 106, 108.
  • the monitoring device 102 according to the invention is now used in the system 100 according to the invention as follows:
  • the monitoring device 102 is introduced into an existing system 10 according to FIG. 1 and activated. In doing so, the monitoring device 102 checks 130 with its second WLAN interface 128 all WLAN traffic 132 and analyzes the active MAC addresses (device addresses).
  • a one language assistant 12 such as a m it Alexa ® com m uniringden echo ® product Amazon ®, Alloc enbare device address is ittelt erm
  • the user receives a computer device on a mobile Com, such as his smart phone, instal application Notification that it is recommended to connect the monitoring device 102 to the router 16 and to connect the voice assistant 12 to the monitoring device 102 as an access point.
  • This notification can also take place optically or acoustically via the monitoring device 102 itself.
  • the voice assistant 12 should be placed on the monitoring device 102, as shown in FIG. 5.
  • the power pack (not shown) of the voice assistant 12 can also be used as a power supply with the aid of a special cable available as an accessory, so that no further cables have to be laid.
  • the voice assistant 12 can no longer communicate directly with the router 16, but only with the help of the monitoring device 102, whereby all incoming and outgoing communication 104, 106, 108 can be monitored and controlled .
  • the monitoring device 102 detects this and alerts the user or can be configured so that such connections are blocked directly .
  • the second WLAN interface 128 constantly "sweeps" through all possible WLAN channels and "listens” 130 to all of the WLAN packets that can be received (including the encrypted ones).
  • the main focus is on the ESSI D contained in the fleader of the WLAN packet as well as the source and destination MAC address.
  • the length and frequency of the z. B. encrypted data packets statistical knowledge about existing connections are collected and used.
  • the monitoring device 102 assigns the voice assistant 12 a firewall rule set adapted to the device class voice assistant 12, preconfigured with the permissible communication partner, permissible communication destinations, permissible data volume, permissible data throughput and permissible communication times usually meaningful rules are given, and this alone prevents or neutralizes a compromise of the voice assistant.
  • monitoring device 102 This enables the monitoring device 102 according to the invention to perform the following functions in particular:
  • a statement can be made about whether a certain device, such as a computer, can be made just by listening to 130 the data packets in the available WLANs.
  • B. a voice assistant 12 (z. B. Amazon Echo), exists in the household and the end user is advised to connect it securely to the global network 14 with the monitoring device 102 according to the invention.
  • statements about the data sent to the global network 14 can already be made at this point in time and displayed to the end user. I.e. Even without configuration, the monitoring device 102 according to the invention is ready for use with a limited scope of functions.
  • Analysis of the MAC addresses also enables the detection of an erroneous "passing by" 132 of the device 12 to be monitored at the monitoring device 102 according to the invention, which can be displayed to the end user immediately.
  • the security of the communication can be further increased by analyzing their device class and assigning preconfigured firewall rule sets. The communication of this device can only then be allowed when the firewall rule set has actually been assigned and thus the firewall 109 for the device 12 is active.
  • the monitoring device 102 shows the user by outputting optical signals with its display 116 and / or acoustic signals with its loudspeaker always on when a communication between the voice assistant 12 and the global communication network 14 takes place.
  • the voice assistant 12 itself also has a display for its own communication with the global communication network 14, then the user can easily determine whether the voice assistant 12 is communicating the actual communication in each case or whether it is "hiding" something from the user.
  • the application can also be used to specifically control the communication 104, 106, 108.
  • the voice assistant 12 can be actually muted. Although this usually also has a so-called "mute function", the user is dependent on the manufacturer's assurance that the microphones of the voice assistant 12 are actually muted. Not every user has this confidence.
  • the muting via the monitoring device 102 is a real muting device because, although the voice assistant 12 is still active, its communication 104 via the monitoring device 102 is blocked.
  • Such a muting can be performed, for example, depending on the time between 10 p.m. and 7 a.m., so that the privacy of the user is ensured.
  • the muting via the monitoring device 102 can always be activated by means of the application if the voice assistant 12 is currently not to be used. This can be the case, for example, during confidential conversations between the user.
  • the monitoring device 102 via its WLAN module also has the option of not only determining the MAC addresses of the communication partners involved in order to recognize the voice assistant 12, but also a stored MAC address, for example that of the smart phone User are recognized. As a result, the presence of the user in the area of the voice assistant 12 can be recognized and the muting can be controlled in such a way that the voice assistant 12 is always muted when the user is not present.
  • There are of course other options for recognizing the presence of the user such as a video camera, an operating element that has to be pressed, a special transponder, a smart door lock, etc ..
  • the user can use the application to create a blacklist, that is, pages 18 in the global communications network 14 that should not be accessible via the voice assistant 12. Then the monitoring device 102 will block all communication 108 to such unwanted pages 28.
  • a white list can also be defined on pages 20 that are only permitted for communication 108. In this way, too, communication 124 from dubious third parties 28 is specifically prevented, thereby preventing the voice assistant 12 from being taken over by third parties 28 and its harmful consequences.
  • An automatism is also available which also prevents unwanted communication 104, 106, 108 and in particular a takeover by third parties 28.
  • the communication 104, 106, 108 is analyzed and it is determined whether a data volume is in a certain time of x minutes is exceeded by y MB (variable) and in this case the communication 104, 106, 108 is switched off. Dynamic limits depending on historical usage behavior are conceivable.
  • the user can adapt the pre-configured firewall rule set proposed for the device 12 to personal needs at any time (expert mode).
  • the monitoring device 102 thus decouples the voice assistant 12 from the home network 122, visualizes its network traffic 104, 106, 108 (especially in the event of deviations from the desired behavior) via a configurable display 116 and enables transparent, actual shutdown (“Real -Mute ”) of the voice assistant 12.
  • the preferred modes of operation of the monitoring device 102 can be summarized as follows:
  • the device is assigned a standard device class for security purposes with the most secure firewall rule set, so that this device is treated most restrictively with regard to its communication rights.
  • the user is shown a selection of available device classes and the user himself has to define a device class and the associated firewall rule set for the unknown facility Analysis, evaluation and visualization of outgoing and incoming network traffic
  • the monitoring device 102 could also have optical analysis means (not shown) that constantly compare the display by the voice assistant 12 with its own display 116 and warn the user if they do not match, because the voice assistant 12 then "hides" actual communication.
  • the monitoring device 102 could also have acoustic display means in the form of one or more loudspeakers.
  • the user Via the optical and acoustic signaling or alarming of the monitoring device 102, the user knows at any time when audio data are being transmitted to the Internet 14. In the event of an unwanted transmission, this can be prevented by the monitoring device 102. An eavesdropping, no matter by whom, would be recognized in every case.
  • the user can use the voice assistant 12 without being tapped himself or without unconsciously sending private calls to contacts in his address book.
  • the user no longer has a bad feeling when using the voice assistant 12 because the monitoring device 102 controls the voice assistant 12 in such a way that the user always knows what is happening and, moreover, the voice assistant 12 only sends data when it does is wanted.
  • the user can use the muting of the voice assistant 12 and also rely on it, because the optical or acoustic signaling of the monitoring device 102 would obviously indicate an undesired transmission of audio data in the event of a mute.
  • the data transmission to the Internet 14 (for example in the transmission direction) can be completely prevented.
  • the user can rely on the fact that only the services 20 connected to the voice assistant 12 are involved in the communication, because a different behavior would be recognized and displayed by the monitoring device 102.
  • the user can actually mute the voice assistant 12 by means of the monitoring device 102 during meetings or sensitive private conversations.
  • the user has a real opportunity to switch off the voice assistant 12 in a targeted manner without having to operate its power supply, by being able to completely separate the voice assistant 12 from the global communication network 14 via the monitoring device 102.
  • the user can set a schedule for using the voice assistant 12.
  • the user need not be afraid of hackers (manipulation and misuse by hackers, e.g. purchases, bookings or controlling their household appliances), because the visual and acoustic display of the outgoing network traffic will compromise the voice assistant 12 can be recognized directly by the user and acted accordingly by him.
  • firewall 109 specially adapted to the respective device 12, which cannot be circumvented and which provides a device-specific firewall rule set so that the tapping of data and other attacks by third parties 28 are effectively prevented.
  • the monitoring device 102 thus ascertains attempts by the device 12 to pass on data to third parties 28 and informs 134 the user.
  • the user can act 136 accordingly, for example he can specifically block outgoing and / or incoming network traffic and also define automatisms for this.
  • FIG. 6 A second preferred exemplary embodiment for the system 200 according to the invention is shown in FIG. 6. It can be seen that the monitoring device 202 according to the invention is used here in the context of a local communication network 204.
  • the monitoring device 202 forms the access point of the devices 12, 54, 56, 57, 58, 60, 62, 64, 66, 68 both for communication with one another and for communication 206 with the global communication network 14.
  • the devices 12, 54, 56, 57, 58, 60, 62, 64, 66, 68 can only communicate 210 with the monitoring device 202, but not with one another 216 or with the router 16 '. Only the monitoring device 202 can communicate 212 with the router 16 '. The communication 212 between the monitoring device 202 and router 16' and also the communication 210 of the devices 12, 54, 56, 57, 58, 60, 62, 64, 66,
  • 68 with the monitoring device 202 can be wired (for example, LAN) and wirelessly (for example, via WLAN).
  • the monitoring device 202 again provides a firewall 214 with automatically adapted firewall rule sets for each individual device 12, 54, 56, 57, 58, 60, 62, 64, 66, 68.
  • the monitoring device 202 prevents the compromised smart lightbulb 57 from collecting data from the other devices 12, 54, 58, 60, 62, 64, 66, 68 since there is no direct networking 216 of the compromised smart lightbulb 57 with the rest Facilities 12, 54, 56, 58, 60, 62, 64, 66, 68 exists and the firewall rule set for the compromised smart lightbulb 57 prevents the compromised smart lightbulb 57 from being shared with the other facilities 12, 54, 56, 58 , 60, 62, 64, 66, 68 communicates.
  • the firewall 214 also prevents data from being passed on by the compromised device 57 to a third party 28, and attacks 218 by third parties 28 on the local communication network 204 are also prevented.
  • the monitoring device 202 determines attempts by the compromised smart lightbulb 57 to communicate with other devices 12, 54, 56, 58, 60, 62, 64, 66, 68 or to pass on data to third parties 28 and informs 220 the user.
  • the user can act 222 accordingly, for example replace the compromised smart lightbulb 57, adapt the firewall rule set of the monitoring device 202, inform the support of the manufacturer of the smart lightbulb 56, 57 or also inform IT security experts.
  • a mobile computer device such as the user's smartphone 60. The user can thus take targeted protective measures and thereby gain control over the local communication network 204.
  • FIGS. 7 to 11 the monitoring device 202 according to the invention is shown in more detail according to a second preferred embodiment.
  • the monitoring device 202 is cube-shaped with a cube base 250, which can be inserted into an adapted receptacle 251 of a cube body 252, with the cube body 252 serving as a container for the cube base 250.
  • the cube base 250 has various connection options for LAN 254 and a power supply 256 and communicates with the cube body 252 via WLAN (not shown) or similar wireless communication technologies, so that the cube base 250 and cube body 252 can be completely separated from one another and still communicate with one another.
  • WLAN not shown
  • the cube base 250 also contains a control unit (not shown) and further WLAN modules (not shown) for communication with the router 16 ′ and the devices 12, 54, 56, 57, 58, 60, 62, 64 , 66, 68.
  • the cube body 252 has optical display means in the form of LEDs 264 behind an outer shell 258 over the full area on its front side wall 260 and, in part, on the other side walls 262. Instead, larger LCD units or the like could also be installed. Instead of a full-surface display on the front 260, the optical display means 264 can also be provided there only partially or on the remaining side walls 262 over the full area. Optical display means 264 can also be provided on the top surface 266.
  • acoustic display means (not shown) are also provided.
  • the display in the form of the cube body 252 can be positioned as desired by the user while the cube base 250 is connected to the fixed connection ( ideally via LAN 254) with the router 16 '.
  • All information and warnings to the user are then transmitted by the cube body 252 and the user can respond to this in a suitable manner by entering commands via the application on his smartphone 60 or set up the monitoring device 202.
  • monitoring devices 102, 202 can be used, which are then subordinate to the monitoring device 202 according to FIG. 6 as part of a master-slave connection and are preferably only used for display for the user, for example in other rooms.
  • firewall rule sets that are modular are preconfigured on the basis of device classes, so that it is also possible for non-specialist users to configure a firewall that is adapted to their needs, 109, 214. Based on these modular firewall rule sets, new equipment options 12, 54, 56, 57, 58, 60, 62, 64, 66, 68 can be easily integrated into the security solution via plug & play. For knowledgeable users there is also an expert mode to specifically adapt the firewall for individual facilities 12, 54, 56, 57, 58, 60, 62, 64, 66, 68 to specific needs. This adaptation can be carried out intuitively using the individually adaptable firewall rules provided.
  • a non-specialist user can also make quantitative and qualitative statements about the network traffic of all his loT (Internet of Things) devices 12, 54, 56, 57 used in the household , 58, 60, 62, 64, 66, 68 (all devices that are directly or indirectly connected to a global communications network 14 or a local communications network 204). On the basis of these results, the user is able to take further steps towards IT security in his home.
  • all features of the present invention can be freely combined with one another.
  • the features described in the description of the figures can also be freely combined with the other features as features of the invention.
  • physical features of the device can also be used in the context of a method, converted to process features, and method features can be used in the context of a device, converted to features of the device.
  • compromised smart lightbulb 57 or compromised device sends sensitive data of the local communication network 52 to an attacker 28 in global communication network 14, gateway into the local communication network 14
  • monitoring device 102 informs the user
  • Monitoring device 202 informs the user

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • General Business, Economics & Management (AREA)
  • Business, Economics & Management (AREA)
  • Technology Law (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

La présente invention concerne un procédé et un arrangement (102) pour surveiller la communication d'un dispositif (12) avec un réseau de communication global (14), caractérisé en ce que la communication réelle (104, 106, 108) du dispositif (12) est détectée et une indication (116) de la communication réelle (104, 106, 108) du dispositif (12) a lieu à l'extérieur du dispositif (12). Un ensemble de règles de pare-feu comprenant au moins une règle de pare-feu peut en outre être attribué au dispositif (12, 54, 56, 57, 58, 60, 62, 64, 66, 68). Cela apporte à l'utilisateur un sentiment de sécurité dans le cadre de la communication (104, 106, 108) d'un dispositif (12) avec un réseau de communication global (14), cette communication (104, 106, 108) étant ici rendue plus sûre et plus confortable.
PCT/EP2020/055942 2019-03-06 2020-03-05 Procédé et arrangement pour surveiller la communication d'un dispositif avec un réseau de communication global et/ou à l'intérieur d'un réseau de communication local WO2020178406A1 (fr)

Applications Claiming Priority (8)

Application Number Priority Date Filing Date Title
DE102019105698.5A DE102019105698A1 (de) 2019-03-06 2019-03-06 Verfahren und Vorrichtung zur Überwachung der Kommunikation einer Einrichtung mit einem globalen Kommunikationsnetz und/oder innerhalb eines lokalen Kommunikationsnetzes
DE102019105698.5 2019-03-06
DE102019105697.7 2019-03-06
DE102019105697.7A DE102019105697A1 (de) 2019-03-06 2019-03-06 Verfahren und Vorrichtiung zur Überwachung der Kommunikation einer Einrichtung mit einem globalen Kommunikationsnetz und/oder innerhalb eines lokalen Kommunikationsnetzes
DE102019105699.3A DE102019105699A1 (de) 2019-03-06 2019-03-06 Verfahren und Vorrichtung zur Überwachung der Kommunikation einer Einrichtung mit einem globalen Kommunikationsnetz und/oder innerhalb eines lokalen Kommunikationsnetzes
DE102019105700.0A DE102019105700A1 (de) 2019-03-06 2019-03-06 Verfahren und Vorrichtung zur Überwachung der Kommunikation einer Einrichtung mit einem globalen Kommunikationsnetz und/oder innerhalb eines lokalen Kommunikationsnetzes
DE102019105699.3 2019-03-06
DE102019105700.0 2019-03-06

Publications (1)

Publication Number Publication Date
WO2020178406A1 true WO2020178406A1 (fr) 2020-09-10

Family

ID=69770911

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/EP2020/055942 WO2020178406A1 (fr) 2019-03-06 2020-03-05 Procédé et arrangement pour surveiller la communication d'un dispositif avec un réseau de communication global et/ou à l'intérieur d'un réseau de communication local

Country Status (1)

Country Link
WO (1) WO2020178406A1 (fr)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20060187890A1 (en) * 2005-01-30 2006-08-24 Frank Lin LCD display on wireless router
US20070261112A1 (en) * 2006-05-08 2007-11-08 Electro Guard Corp. Network Security Device
US20110197273A1 (en) * 2000-07-07 2011-08-11 Krumel Andrew K Real time firewall/data protection systems and methods
US20180286403A1 (en) * 2017-03-31 2018-10-04 Ecolink Intelligent Technology, Inc. Method and apparatus for interaction with an intelligent personal assistant
US20190058714A1 (en) * 2017-08-15 2019-02-21 Gigamon Inc. Dynamic Decryption of Suspicious Network Traffic Based on Certificate Validation

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110197273A1 (en) * 2000-07-07 2011-08-11 Krumel Andrew K Real time firewall/data protection systems and methods
US20060187890A1 (en) * 2005-01-30 2006-08-24 Frank Lin LCD display on wireless router
US20070261112A1 (en) * 2006-05-08 2007-11-08 Electro Guard Corp. Network Security Device
US20180286403A1 (en) * 2017-03-31 2018-10-04 Ecolink Intelligent Technology, Inc. Method and apparatus for interaction with an intelligent personal assistant
US20190058714A1 (en) * 2017-08-15 2019-02-21 Gigamon Inc. Dynamic Decryption of Suspicious Network Traffic Based on Certificate Validation

Similar Documents

Publication Publication Date Title
US7581249B2 (en) Distributed intrusion response system
DE60119028T2 (de) Zugangspunkt und Authentifizierungsverfahren dafür
US20100280636A1 (en) Building automation system controller including network management features
DE112007001937T5 (de) Sofortnachrichtendienst-Anwendungen in Sicherheitssystemen
CN108027808A (zh) 互联网安全和管理设备
WO2012116033A1 (fr) Organisation dynamique d'éléments actifs dans un réseau de télécommunications de situation d'urgence
EP2769533B1 (fr) Station de base pour la surveillance au moins un sensor
EP2757761B1 (fr) Station d'accueil et procédé de connexion d'un terminal de communication mobile à une infrastructure de communication au moins partiellement filaire
US20160226885A1 (en) System and method to aggregate control of multiple devices via multicast messages and automatic set up of connections
CN103326882A (zh) 一种视频监控网络管理方法及装置
KR20150018975A (ko) Ip cctv를 이용한 gps 위치정보 기반의 비상상황 발생 현장 촬영 및 모니터링 시스템 그리고 이를 이용한 비상상황 발생 현장의 촬영 및 모니터링 방법
WO2019211190A1 (fr) Procédé d'inscription d'un appareil cible dans un réseau
CN113010880B (zh) 电梯配件认证方法、系统、服务器和存储介质
US20220319302A1 (en) Secure communications for monitored facilities
KR101881061B1 (ko) 모드 변경이 가능한 양방향 통신 장치 및 방법
WO2020178406A1 (fr) Procédé et arrangement pour surveiller la communication d'un dispositif avec un réseau de communication global et/ou à l'intérieur d'un réseau de communication local
EP3769554B1 (fr) Procédé et système d'autorisation de la communication d'un noeud de réseau
DE102019105697A1 (de) Verfahren und Vorrichtiung zur Überwachung der Kommunikation einer Einrichtung mit einem globalen Kommunikationsnetz und/oder innerhalb eines lokalen Kommunikationsnetzes
DE102019105698A1 (de) Verfahren und Vorrichtung zur Überwachung der Kommunikation einer Einrichtung mit einem globalen Kommunikationsnetz und/oder innerhalb eines lokalen Kommunikationsnetzes
DE102019105699A1 (de) Verfahren und Vorrichtung zur Überwachung der Kommunikation einer Einrichtung mit einem globalen Kommunikationsnetz und/oder innerhalb eines lokalen Kommunikationsnetzes
DE102019105700A1 (de) Verfahren und Vorrichtung zur Überwachung der Kommunikation einer Einrichtung mit einem globalen Kommunikationsnetz und/oder innerhalb eines lokalen Kommunikationsnetzes
Hattori et al. Function-level access control system for home IoT devices
DE102014208965A1 (de) Verfahren zur Authentifizierung eines Netzwerkteilnehmers sowie Netzwerkteilnehmer, Netzwerk und Computerprogramm hierzu
CN107404591B (zh) 智能门铃监控方法和装置
CN104243629B (zh) 一种基于nat类型的设备互通方法和系统

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20709563

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20709563

Country of ref document: EP

Kind code of ref document: A1