Abstract: Some embodiments improve the security of a network of IoT devices via a recurrent re-attestation of network nodes. The frequency of re-attestation may depend on a network role of the respective device (e.g., router vs. end node) and/or on a measure of connectivity of the respective node (e.g., node degree), with highly connected nodes re-attested more often than end nodes. Some embodiments employ a pebble-ripple attestation procedure wherein an administration device transmits an attestation probe to a device via one-to-one messaging (e.g., unicast), and the respective device replies via one-to-many messaging (e.g., multicast). The administration device then attests the identity and/or functionality of the respective device according to the timing of multiple replies from the attested device, each reply traversing the network via a distinct route.

Abstract: Some embodiments construct a device fingerprint of a target device (e.g., personal computer, smartphone) by intercepting an access request issued by the target device. A part of the device fingerprint may be determined according to the access request, e.g., according to various features of a TLS handshake, TCP header, and/or HTTP header of the respective access request. Another part of the device fingerprint is determined by transmitting a fingerprinting probe to the target device in response to the access request, and using executable code included in the fingerprinting probe to extract a set of features characterizing a browser executing on the target device. Some embodiments then compare the device fingerprint with reference fingerprints determined for other devices on the same network, to determine whether the target device is a familiar device or not. Exemplary applications include access control and personalized content distribution, among others.

Abstract: Some embodiments improve the security of a network of IoT devices via a recurrent re-attestation of network nodes. The frequency of re-attestation may depend on a network role of the respective device (e.g., router vs. end node) and/or on a measure of connectivity of the respective node (e.g., node degree), with highly connected nodes re-attested more often than end nodes. Some embodiments employ a pebble-ripple attestation procedure wherein an administration device transmits an attestation probe to a device via one-to-one messaging (e.g., unicast), and the respective device replies via one-to-many messaging (e.g., multicast). The administration device then attests the identity and/or functionality of the respective device according to the timing of multiple replies from the attested device, each reply traversing the network via a distinct route.

Abstract: Some embodiments improve the security of a network of IoT devices via a recurrent re-attestation of network nodes. The frequency of re-attestation may depend on a network role of the respective device (e.g., router vs. end node) and/or on a measure of connectivity of the respective node (e.g., node degree), with highly connected nodes re-attested more often than end nodes. Some embodiments employ a pebble-ripple attestation procedure wherein an administration device transmits an attestation probe to a device via one-to-one messaging (e.g., unicast), and the respective device replies via one-to-many messaging (e.g., multicast). The administration device then attests the identity and/or functionality of the respective device according to the timing of multiple replies from the attested device, each reply traversing the network via a distinct route.

Abstract: Some embodiments construct a device fingerprint of a target device (e.g., personal computer, smartphone) by intercepting an access request issued by the target device. A part of the device fingerprint may be determined according to the access request, e.g., according to various features of a TLS handshake, TCP header, and/or HTTP header of the respective access request. Another part of the device fingerprint is determined by transmitting a fingerprinting probe to the target device in response to the access request, and using executable code included in the fingerprinting probe to extract a set of features characterizing a browser executing on the target device. Some embodiments then compare the device fingerprint with reference fingerprints determined for other devices on the same network, to determine whether the target device is a familiar device or not. Exemplary applications include access control and personalized content distribution, among others.