TWI899725B - Method of secure compartmentalization for iot application and iot gateway using the same - Google Patents

Abstract

A method of secure compartmentalization for IoT application and a IoT gateway using the same are provided. The method is adapted to the IoT gateway and includes the following steps. A plurality of zones corresponding to a plurality of subnets are created by partitioning the subnets. An application installed in the IoT gateway is deployed to one of the zones. A conduit policy associated with at least one of the zones is configured. Packet transmission of the zones is managed based on the conduit policy.

Description

Internet of Things application security partitioning method and Internet of Things gateway using the method

The present invention relates to a network security technology, and in particular to a method for secure zoning of Internet of Things applications and an Internet of Things gateway using the method.

IoT gateways are solutions that facilitate IoT communications, primarily serving as a bridge between IoT devices and cloud servers. IoT gateways can transmit a wide range of IoT data to cloud servers for real-time monitoring and analysis. Furthermore, IoT gateways play a critical role in various operational scenarios within IoT systems, helping enterprises manage data transmission. IoT gateways can forward collected sensor data to cloud servers over untrusted networks, or forward control commands from untrusted networks to IoT devices or control equipment. Therefore, in an IoT environment, since IoT devices and control devices can directly connect to untrusted networks through IoT gateways, it is necessary to establish a firewall to protect these IoT devices, control devices, and IoT gateways in the IoT system from network attacks.

However, as IoT gateway functionality continues to evolve, they will be responsible for managing increasingly complex and diverse applications, such as data collection and edge computing. Furthermore, IoT gateways will involve data transmission and automated control of devices with varying security levels. Therefore, given the demands and security considerations of various operational scenarios, the firewall protection provided by traditional IoT gateways or other network devices no longer meets current needs.

In view of this, embodiments of the present invention provide a method for secure zoning of IoT applications and an IoT gateway using the method, which can solve the above technical problems.

The IoT application security zoning method of an embodiment of the present invention is applicable to an IoT gateway and includes (but is not limited to) the following steps: Multiple zones corresponding to the multiple subnets are established by dividing the IoT gateway into multiple subnets. An application installed in the IoT gateway is deployed to one of the multiple zones. A conduit policy is configured for at least one of the multiple zones. Packet transmission across the multiple zones is managed based on the conduit policy.

An IoT gateway according to an embodiment of the present invention includes a transceiver, a storage device, and a processor. The processor is connected to the transceiver and the storage device and is configured to perform the following operations: Multiple zones corresponding to the multiple subnets are established by dividing the network into multiple subnets; an application installed in the IoT gateway is deployed to one of the multiple zones; a transmission channel policy is configured for at least one of the multiple zones; and packet transmission in the multiple zones is managed according to the transmission channel policy.

Based on the above, in this embodiment of the present invention, after establishing multiple zones corresponding to multiple subnets, transmission channel policies for managing packet transmission can be configured for each zone. Furthermore, multiple applications installed on the IoT gateway can be divided into different zones. Consequently, packet transmission for each application can be controlled based on the transmission channel policy of the zone in which it is located. This significantly enhances the network security defense capabilities of the IoT gateway and improves the flexibility and efficiency of its security management.

In order to make the above features and advantages of the present invention more clearly understood, embodiments are given below and described in detail with reference to the accompanying drawings.

Some embodiments of the present invention are described in detail below with reference to the accompanying drawings. Reference symbols in the following description will identify identical or similar elements when the same symbols appear in different drawings. These embodiments are only a portion of the present invention and do not disclose all possible implementations of the present invention. Rather, these embodiments are merely examples of the methods and apparatus within the scope of the present invention.

This disclosure relates to a method for securely zoning IoT applications and an IoT gateway using the method. To enhance IoT security, this disclosure provides a zoning model that divides IoT applications into multiple zones. This zoning model can be used to manage core services and application services installed on an IoT gateway, thereby enhancing the security of existing IoT application frameworks. An IoT gateway can establish multiple zones to isolate various IoT applications within these zones. Communication between zones can be conducted via conduits. In this disclosure, packet transmission for IoT applications can be managed by establishing conduit policies for these zones.

From another perspective, the present disclosure provides an IoT gateway capable of isolating data, applications, and services within the IoT gateway based on a partitioning model. By separating multiple applications into multiple zones, access to critical system configuration files deployed in the IoT gateway can be prohibited. In some embodiments, the partitioning model provided by the present disclosure can be seamlessly built onto the existing information technology (IT) framework for IoT applications without requiring modification, thereby making security management of the operational technology (OT) domain in industrial environments more robust and efficient.

Figure 1 is a schematic diagram of an Internet of Things (IoT) system according to one embodiment of the present invention. Referring to Figure 1 , IoT system 10 includes an IoT gateway 110, a local network 120, and an external network 130. IoT system 10 may be an Industrial Internet of Things (IIoT) system. The IIoT is the expansion and application of the IoT in the industrial sector.

Local network 120 may include multiple IoT devices, one or more control devices, and one or more network devices. IoT devices may include sensors, cameras, industrial equipment, measurement equipment, etc. Control devices may include computers, programmable logic controllers (PLCs), etc. Devices in local network 120 may be directly or indirectly connected to IoT gateway 110. For example, control devices may communicate with IoT gateway 110 via a suitable communication protocol (e.g., Ethernet, IP, or other packet-based protocols). IoT devices may connect to control devices, network devices, or IoT gateway 110 via wired or wireless communication links, such as those supporting Wi-Fi, Bluetooth, WirelessHART, HART-IP, and other communication protocols.

The IoT gateway 110 is connected between the local network 120 and the external network 130. In some embodiments, multiple applications can be deployed and installed on the IoT gateway 110. Based on the multiple applications deployed on the IoT gateway 110, the IoT gateway 110 can provide various IoT functions, such as data collection, edge computing, and security authentication. These applications can be system services, Docker containers, etc. From another perspective, these applications can be provided by cloud computing platforms, such as the Azure platform and the Amazon Web Services (AWS) platform. These applications allow users to run cloud intelligence on the IoT gateway 110.

The external network 130 may include a private server or a public server provided by a cloud computing platform. It is worth noting that the IoT gateway 110 can connect to devices on the external network 130 via an untrusted network. In other words, the external network 130 may include an untrusted network.

FIG2 is a block diagram of an IoT gateway according to an embodiment of the present invention. Referring to FIG2 , the IoT gateway 110 includes a transceiver 113 , a memory 112 , and a processor 111 .

The memory 112 can be used to store data such as instructions, program codes, software modules, etc. It can be, for example, any type of fixed or removable random access memory (RAM), read-only memory (ROM), flash memory, or other similar devices, integrated circuits, and combinations thereof.

The processor 111 may be a central processing unit (CPU), a general-purpose processor, or other programmable general-purpose or special-purpose microprocessor, a digital signal processor (DSP), a programmable controller, a field programmable gate array (FPGA), an application-specific integrated circuit (ASIC), or other similar components or a combination of the above components.

In different embodiments, the memory 112 may be a separate device from the processor 111 or may be integrated into the processor 111.

Processor 111 can access and execute software modules stored in memory 112 to implement the IoT application security partitioning method according to an embodiment of the present invention. The term "software module" can be broadly interpreted as meaning instructions, instruction sets, code, program code, program, application, software suite, thread, procedure, function, etc., regardless of whether it is referred to as software, firmware, middleware, microcode, hardware description language, or otherwise.

Transceiver 113 includes a transmitter (e.g., transmit circuitry) and a receiver (e.g., receive circuitry). In some embodiments, transceiver 113 may be used to transmit and receive time-frequency segmented information. Transceiver 113 may perform low-noise amplification (LNA), impedance matching, analog-to-digital conversion (ADC), digital-to-analog conversion (DAC), frequency mixing, up/down frequency conversion, filtering, amplification, and/or similar operations. For example, transceiver 113 may be a WiFi or Bluetooth transceiver compliant with the 802.xx standard. For example, transceiver 113 may be included in a USB port or an interface for establishing a wired connection.

Figure 3 is a flowchart of a method for securely partitioning an IoT application according to an embodiment of the present invention. Referring to Figure 3 , the method of this embodiment can be executed by IoT gateway 110 in Figure 1 . The following details each step of Figure 3 using the components shown in Figures 1 and 2 .

In step S302, processor 111 divides the network into multiple subnets to create multiple zones corresponding to the subnets. The present disclosure does not limit the number of zones; zones can be configured based on actual needs. In some embodiments, processor 111 divides the subnets by establishing a virtual network interface, where each subnet is mapped to an IP address range. In other words, these zones can be created by generating virtual bridges or virtual networks, and each zone can be associated with an IP address range corresponding to the subnet.

In step S304, processor 111 deploys an application installed in IoT gateway 110 to one of multiple zones. Specifically, each zone can be considered a logical grouping of applications with similar security requirements. Applications installed in IoT gateway 110 may be containers, services, or daemons. Furthermore, in some embodiments, each application deployed in IoT gateway 110 may be assigned to a corresponding zone based on its assigned zone tag. An application's zone tag can be set based on predefined rules or user actions.

For example, some applications related to information technology (IT) services can be deployed in the first region, some applications related to operational technology (OT) services can be deployed in the second region, and some applications related to core services can be deployed in the third region.

In some embodiments, processor 111 may assign a specific IP address within the IP address range of a subnet (i.e., one of multiple subnets) to an application to deploy the application to one of multiple zones corresponding to one of the multiple subnets. More specifically, when processor 111 determines to deploy an application to a first zone, processor 111 may assign the application an IP address within the IP address range of the subnet corresponding to the first zone. When the application is assigned this specific IP address, the application can be considered to be assigned to the corresponding zone.

In step S306, processor 111 configures a conduit policy associated with at least one of the multiple zones. In step S308, processor 111 manages packet transmission in the multiple zones based on the conduit policy. The conduit policy may include access rules for at least one of the multiple zones. In the present disclosure, a conduit may represent a controlled communication path or channel between different zones. Accordingly, the conduit policy may be used to manage packet transmission between zones. For example, the conduit policy may prevent packet transmission from a first zone to a second zone. Furthermore, the conduit policy may be used to manage packet transmission between zones, including some applications in IoT gateway 110, and untrusted networks (i.e., external networks).

In some embodiments, the multiple zones established by processor 111 may include an IT service zone and an OT service zone. The IT service zone includes at least one IT service application, and the OT service zone includes at least one OT service application. Furthermore, the multiple zones established by processor 111 may also include a management zone, and the management zone includes at least one secure service application.

Figure 4 is a schematic diagram of a partitioning model according to one embodiment of the present invention. Referring to Figure 4 , IoT gateway 410 can deploy applications into three zones: Z1 through Z3. In this embodiment, zone Z1 is the OT service zone, zone Z2 is the IT service zone, and zone Z3 is the management zone.

OT service applications related to OT services, such as data acquisition applications, can be deployed in zone Z1. IT service applications related to IT services, such as edge computing applications and data transmission applications, can be deployed in zone Z2. Applications related to core services, such as security service applications, device management service applications, and certificate service applications, can be deployed in zone Z3.

Applications in Zone Z1 and Zone Z3 can communicate with devices in Zone 42, an Industrial Automation and Control System (IACS), via a local area network (LAN) to perform functions related to the devices in Zone 42, such as collecting data from IoT devices or controlling industrial equipment. Applications in Zone Z2 and Zone Z3 can communicate with Untrusted Network 41 via a Wide Area Network (WAN) to perform functions related to the devices in Untrusted Network 41, such as transmitting data to a cloud server or receiving control commands from an external server to control devices in Zone 42. It is important to note that communication between Zone Z1 and Zone Z2 is prohibited. By dividing multiple applications of IoT Gateway 410 into zones Z1 to Z3, packet transmission of services within IoT Gateway 410 can be effectively managed, thereby improving IoT security.

Figure 5 is a diagram illustrating deploying applications to zones according to an embodiment of the present invention. Referring to Figure 5 , after zones Z1-Z3 are created, the transmission channels between these zones can be designed to manage access, prevent unauthorized activity, block the spread of threats or malware, and maintain the integrity and confidentiality of network transmissions.

In some embodiments, the IoT gateway 510 can configure a transmission channel policy associated with at least one of zones Z1-Z3. Specifically, the IoT gateway 510 can configure a transmission channel policy for one or more transmission channels, thereby managing application packet transmission based on the transmission channel policy. The IoT gateway 510 can configure a transmission channel policy CP1_1 for the transmission channel between zone Z1 and the IACS zone 52, and another transmission channel policy CP1_2 for the transmission channel between zone Z3 and the IACS zone 52. These policies manage and monitor packet transmission between applications in zone Z1 and the IACS zone 52, as well as between applications in zone Z3 and the IACS zone 52. The transmission channel policies CP1_1 and CP1_2 may be the same or different, and this disclosure does not limit this.

IoT gateway 510 can configure a transmission channel policy CP2 for the transmission channel between zones Z1 and Z2, thereby managing and monitoring packet transmission between applications in zone Z1 and Z2. In some embodiments, based on transmission channel policy CP2, applications in zone Z1 and Z2 cannot communicate with each other. In some embodiments, IoT gateway 510 may omit configuring a transmission channel policy for the transmission channel between zones Z2 and Z1. However, if packet transmission is required in certain situations, a transmission channel policy CP2 between zones Z2 and Z1 can be configured accordingly.

Furthermore, the IoT gateway 510 can configure a transmission channel policy CP3 for the transmission channel between zone Z1 and zone Z3, and for the transmission channel between zone Z2 and zone Z3. This allows for management and monitoring of packet transmission between applications in zone Z2 and zone Z3, as well as management and monitoring of packet transmission between applications in zone Z1 and zone Z3.

IoT gateway 510 can configure transmission channel policy CP4 for the transmission channel between zone Z2 and untrusted network 51, thereby managing and monitoring packet transmission between applications in zone Z2 and untrusted network 51. IoT gateway 510 can also configure transmission channel policy CP5 for the transmission channel between zone Z3 and untrusted network 51, thereby managing and monitoring packet transmission between applications in zone Z3 and untrusted network 51. It is worth noting that applications in different zones Z1 through Z3 may belong to a single service module provided by the cloud platform. For example, applications of the "IoTedge" service module may be assigned to different zones Z1 through Z3. As shown in Figure 5, applications 501 through 503 of the "IoTedge" service module may be assigned to zone Z3. Application 504 of the "IoTedge" service module might be assigned to zone Z1, while application 505 of the "IoTedge" service module might be assigned to zone Z2. In other words, the disclosed method can be implemented on existing IoT application frameworks.

In some embodiments, the IoT gateway 510 may obtain a service module provided by a cloud service platform, wherein the service module includes one or more applications. When the application of the service module belongs to a high data security level, the IoT gateway 510 deploys the application to the management area. When the application of the service module belongs to a low data security level, the IoT gateway 510 deploys the application to the IT service area or the OT service area. More specifically, the service module provided by the cloud service platform may include multiple applications, and these applications can be divided into different areas according to the data security level they handle. The multiple applications of a single service module provided by the cloud platform may include applications corresponding to a high data security level and applications corresponding to a low data security level. In the embodiment of FIG. 5 , when a service module provided by a cloud service platform is installed on IoT gateway 510 , applications corresponding to a high data security level (e.g., applications 501 to 503) can be deployed to zone Z3, while other applications belonging to the same service module and corresponding to a low data security level (e.g., applications 504 or 505) can be deployed to zones Z1 or Z2 depending on scenario requirements.

In some embodiments, a partition tag may be assigned to an application deployed in the IoT gateway 510. Therefore, the application can be deployed to the corresponding zone based on the partition tag. The partition tag of the application can be assigned based on user operations or predefined rules. For example, one or more applications in zone Z1 can be assigned the same partition tag so as to be grouped into the same zone Z1. For example, for a Docker container, the partition tag can be assigned by setting the parameter "--network". For the Azure IoT Edge module, the partition tag can be assigned by setting the parameter "NetworkMode". For Linux system services, the partition tag can be assigned by setting the parameter "RestrictNetworkInterfaces".

FIG6 is a schematic diagram illustrating establishing zones according to an embodiment of the present invention. Referring to FIG6 , the IoT gateway 610 can use a subnet partitioning tool 61 to create multiple zones (e.g., zone Z6). The subnet partitioning tool 61 can create a virtual network interface (VNI) to generate subnets corresponding to an IP address range. The IoT gateway 610 can create multiple zones by partitioning IP address ranges or using network namespaces. For example, the IoT gateway 610 can create multiple zones corresponding to different IP address ranges by establishing a Docker bridge or virtual networks (Vnets). The IoT gateway 610 can assign an IP address within a subnet to a specific application deployed in the IoT gateway 610, thereby assigning the specific application to the zone corresponding to the subnet. For example, the IP addresses of all applications in zone Z6 are within the IP address range of the subnet corresponding to zone Z6 (e.g., 192.168.*).

Furthermore, by using a packet management tool 62, such as iptables, nftables, or a firewall, it is possible to manage communications in the transmission channel between the internet zone 63 and zone Z6, as well as the transmission channel between the private zone 64 and zone Z6. In other words, a transmission channel policy can be configured for each transmission channel using iptables, nftables, or a firewall. Therefore, based on the transmission channel policy configured using iptables, nftables, or a firewall, network traffic can be controlled and managed according to predefined rules and policies, thereby enhancing the network security of the IoT system.

In some embodiments, the zones may include a first zone and a second zone. The transmission channel policy for the first zone includes a plurality of rules, including allowing packets from the first zone to pass to an untrusted network, denying packets from the first zone to pass to a workplace via a local area network, denying packets from an untrusted network to pass to the first zone, or conditionally allowing packets from an untrusted network to pass to the first zone.

For example, Figure 7A illustrates a zone-specific transmission channel policy according to an embodiment of the present invention. Referring to Figure 7A , IoT gateway 710 may configure a transmission channel policy CP71 between zone Z2 and an untrusted network zone. Zone Z2 may be an IT service zone. Zone Z2's transmission channel policy CP71 may include at least one of rule a, rule b, rule c, and rule d.

Rule a: Allow packets from zone Z2 to untrusted network 71. Rule b: Deny packets from zone Z2 to workplace 72 via the local area network (LAN). Rule c: Deny packets from untrusted network 71 to zone Z2. Rule d: Conditionally allow packets from untrusted network 71 to reach zone Z2. This allows monitoring and management of the transmission channel between the IT service zone and untrusted network zone 71 to prevent network attacks (such as distributed denial of service (DDoS)) originating from untrusted network 71.

In some embodiments, the zones include a first zone, a second zone, and a third zone. The transmission channel policy associated with the third zone includes a plurality of rules. The plurality of rules include denying packet transmission between a first application in the first zone or the second zone and a second application in the third zone, or allowing packet transmission between the first application in the first zone or the second zone and a third application in the third zone. The plurality of rules further include denying packets from an untrusted network to the third zone.

For example, Figure 7B illustrates a zone-specific transmission channel policy according to an embodiment of the present invention. Referring to Figure 7B , IoT gateway 710 may configure transmission channel policy CP72 for the transmission channel between zones Z2 and Z3, and for the transmission channel between zones Z1 and Z3. Zone Z1 may be an OT service zone. Zone Z2 may be an IT service zone. Zone Z3 may be a management zone. Transmission channel policy CP72 associated with zone Z3 may include at least one of rule e and rule f.

Rule e: Deny packet transmission between a first application in zone Z1 or zone Z2 and a second application in zone Z3. Rule f: Allow packet transmission between a first application in zone Z1 or zone Z2 and a third application in zone Z3. The second and third applications are different applications in zone Z3. In other words, the first application in zone Z1 or zone Z2 can access zone Z3 through permission control. That is, the transmission channel policy CP72 can only allow authorized packet flows between zone Z1 and zone Z3, and authorized packet flows between zone Z2 and zone Z3. For example, by utilizing container security profiles, applications in zone Z1 and zone Z2 can access the management zone Z3. Furthermore, transmission channel policy CP72 can allow applications from a specific service module provided by the cloud platform to access applications from the same service module in management zone Z3. For example, transmission channel policy CP72 can allow applications in zones Z1 and Z2 to access applications with specific ports in management zone Z3. Furthermore, it should be noted that transmission channel policy CP72 can deny access to some applications in management zone Z3 from applications in zones Z1 and Z2. This allows some applications in zone Z3 to be isolated, thereby improving the security of management and security services.

For example, Figure 7C illustrates a zone-specific transmission channel policy according to an embodiment of the present invention. Referring to Figure 7C , IoT gateway 710 may configure a transmission channel policy CP73 for the transmission channel between untrusted network 71 and zone Z3. Zone Z1 may be an OT service zone. Zone Z2 may be an IT service zone. Zone Z3 may be a management zone. The transmission channel policy CP73 associated with zone Z3 may include at least one of rule g and rule h.

Rule g: Allows packets from zone Z3 to communicate with trusted services on untrusted network 71. Rule h: Denies packets from untrusted network 71 from reaching zone Z3. This allows monitoring of the transmission channel between zone Z3 and untrusted network 71 to prevent network attacks (such as distributed denial of service (DDoS)) from untrusted network 71.

In some embodiments, the zones include a first zone, a second zone, and a third zone. The transmission channel policy of the second zone includes a plurality of rules. The plurality of rules include denying packets from the second zone to be transmitted to an untrusted network, or allowing packets from the second zone to be transmitted to a local area network.

For example, Figure 7D is a schematic diagram of a transmission channel policy for a zone according to an embodiment of the present invention. Referring to Figure 7D , IoT gateway 710 may configure a transmission channel policy CP74 for the transmission channel between zone Z1 and workplace 72. Zone Z1 may be an OT service zone. Zone Z2 may be an IT service zone. Zone Z3 may be a management zone. The transmission channel policy CP74 associated with zone Z1 may include at least one of rule i and rule j. Rule i: Deny packets from zone Z1 to be transmitted to untrusted network 71. Rule j: Allow packets from zone Z1 to be transmitted to workplace 72 via the local area network.

In some embodiments of an IoT gateway using the Linux kernel, zones Z1-Z3 and transmission channel policies are implemented at the application layer. Netfilter in the Linux kernel can then filter packets based on the transmission channel policies.

In some embodiments, the IoT gateway can obtain a partition tag for an application, where the partition tag corresponds to one of multiple regions. When installing an application on the IoT gateway, the IoT gateway can deploy the application to one of the multiple regions based on the partition tag.

Figure 8 illustrates how applications are deployed to regions based on partition tags, according to one embodiment of the present invention. Referring to Figure 8 , in step S81, administrator U1 determines the partition tags L1 corresponding to different applications. In step S82, the partition tags L1 configured by administrator U1 are stored in the IoT Hub H1. In step S83, when installing applications on IoT gateway 801, the partition tags L1 corresponding to the different applications are transmitted from IoT Hub H1 to the partition module M1 within IoT gateway 801, enabling remote application deployment across multiple regions of IoT gateway 801. In step S84, partition module M1 provides partition label L1 to installation module M2 in IoT gateway 801. In step S85, installation module M2 downloads applications A1 and A2 from service provision server SS1 (e.g., a cloud service platform). During the installation process, in steps S86 and S87, installation module M2 assigns IP addresses of different subnets to applications A1 and A2 based on partition label L1, thereby deploying applications A1 and A2 to zones Z1 and Z2, respectively. Furthermore, by configuring the transmission channel policy for the transmission channel as described in the previous embodiment, packet transmission between enterprise server SS2 and application A2 is permitted. However, packet transmission between attacker B1 and any area within IoT gateway 801 is denied.

It should be noted that any content of each embodiment of this application, as well as any content of the same embodiment, can be freely combined. Any combination of the above content is within the scope of this application.

In summary, the present disclosure is applicable to IoT gateways in IoT systems and enhances the security of Internet of Things (IoT) devices by establishing zones and transmission channels. Specifically, applications deployed in the IoT gateway can be partitioned into multiple zones. Each zone can be associated with different transmission channel policies and permission controls, ensuring that only authorized entities can access and execute specific functions. In other words, by establishing transmission channel policies for zones, communication between applications can be restricted and controlled. These transmission channel policies can manage the flow, filtering, and blocking of specific types of traffic, ensuring that only authorized communication occurs between different zones. Therefore, the disclosed method can protect IoT systems from unauthorized access and potential threats, thereby improving the overall security and trustworthiness of the IoT environment. Furthermore, since transmission channel policies can be configured on a region-by-region basis, the efficiency and flexibility of packet management policy configuration can be significantly improved, further enhancing the feasibility of remote application services.

Although the present invention has been disclosed above by way of embodiments, they are not intended to limit the present invention. Any person having ordinary skill in the art may make slight modifications and improvements without departing from the spirit and scope of the present invention. Therefore, the scope of protection of the present invention shall be determined by the scope of the attached patent application.

10: IoT System 120: Local Network 130: External Network 110, 410, 510, 610, 710, 810: IoT Gateway 113: Transceiver 112: Memory 111: Processor Z1, Z2, Z3, Z6: Zones 41, 51, 71, 81: Untrusted Networks 42, 52, 72: IACS Zones CP1_1, CP1_2, CP2, CP3, CP4, CP5, CP71, CP72, CP73, CP74: Transmission Channel Policy 501, 502, 503, 504, 505, A1, A2: Applications 61: Subnet Segmentation Tool 62: Packet Management Tool 63: Internet Zones 64: Private Zone U1: Administrator L1: Partition Label H1: IoT Center M1: Partition Module M2: Installation Module B1: Attacker SS1: Service Provider Server SS2: Enterprise Server S302-S308, S81-S87: Steps

Figure 1 is a schematic diagram of an Internet of Things system according to an embodiment of the present invention. Figure 2 is a block diagram of an Internet of Things gateway according to an embodiment of the present invention. Figure 3 is a flow chart of a method for secure zoning of Internet of Things applications according to an embodiment of the present invention. Figure 4 is a schematic diagram of a zoning model according to an embodiment of the present invention. Figure 5 is a schematic diagram of deploying applications to zones according to an embodiment of the present invention. Figure 6 is a schematic diagram of establishing zones according to an embodiment of the present invention. Figures 7A to 7D are schematic diagrams of transmission channel policies for zones according to an embodiment of the present invention. Figure 8 is a schematic diagram of deploying applications to zones based on zone labels according to an embodiment of the present invention.

S302~S308: Steps

Claims (22)

A method for secure zoning of Internet of Things (IoT) applications, applicable to an IoT gateway, includes: establishing multiple zones corresponding to multiple subnets by dividing the IoT gateway; deploying an application installed in the IoT gateway to one of the multiple zones; configuring a conduit policy associated with at least one of the multiple zones; and managing packet transmission in the multiple zones based on the conduit policy. The step of establishing the multiple zones corresponding to the multiple subnets by dividing the multiple subnets includes: dividing the multiple subnets by establishing virtual network interfaces, wherein each of the multiple subnets corresponds to an IP address range. In the method for secure zoning of IoT applications as described in claim 1, the step of deploying the application installed in the IoT gateway to one of the multiple zones includes: assigning a specific IP address within the IP address range of one of the multiple subnets to the application to deploy the application to one of the multiple zones corresponding to one of the multiple subnets. A method for secure zoning of Internet of Things applications as described in claim 1, wherein the multiple zones include an information technology (IT) service zone and an operational technology (OT) service zone, the IT service zone includes at least one IT service application, and the OT service zone includes at least one OT service application. The method for secure zoning of Internet of Things applications as described in claim 3, wherein the multiple zones further include a management zone, and the management zone includes at least one security service application. As described in claim 4, the method for secure zoning of Internet of Things applications, wherein the step of deploying the application installed in the Internet of Things gateway to one of the multiple areas includes: obtaining a service module provided by a cloud service platform, wherein the service module includes the application; when the application belongs to a high data security level, deploying the application to the management area; and when the application belongs to a low data security level, deploying the application to the IT service area or the OT service area. The method for secure zoning of Internet of Things applications as described in claim 1 further comprises: obtaining a partition tag of the application, wherein the partition tag corresponds to one of the multiple zones. As described in claim 6, the IoT application security zoning method, wherein the step of deploying the application installed in the IoT gateway to one of the multiple zones includes: when installing the application to the IoT gateway, deploying the application to one of the multiple zones according to the partition label of the application. A method for secure zoning of Internet of Things applications as described in claim 1, wherein the multiple zones include a first zone and a second zone, and the transmission channel policy associated with the first zone includes multiple rules, wherein the multiple rules include allowing packets to be transmitted from the first zone to an untrusted network, denying packets to be transmitted from the first zone to a workplace via a local area network, denying packets to be transmitted from the untrusted network to the first zone, or conditionally allowing packets to be transmitted from the untrusted network to the first zone. A method for secure zoning of Internet of Things applications as described in claim 1, wherein the multiple zones include a first zone, a second zone, and a third zone, and the transmission channel policy associated with the third zone includes multiple rules, and the multiple rules include denying packet transmission between a first application in the first zone or the second zone and a second application in the third zone, or allowing packet transmission between the first application in the first zone or the second zone and a third application in the third zone. The method for applying secure zoning to the Internet of Things as described in claim 9, wherein the plurality of rules further include denying packets from an untrusted network from being transmitted to the third zone. A method for secure zoning of Internet of Things applications as described in claim 1, wherein the multiple zones include a first zone, a second zone, and a third zone, and the transmission channel policy associated with the second zone includes multiple rules, wherein the multiple rules include denying packets from the second zone to be transmitted to an untrusted network, or allowing packets from the second zone to be transmitted to a local area network. An Internet of Things (IoT) gateway includes a transceiver, a storage device, and a processor connected to the transceiver and the storage device, and configured to: establish multiple zones corresponding to multiple subnets by dividing the network; deploy an application installed in the IoT gateway to one of the multiple zones; configure a transmission channel policy associated with at least one of the multiple zones; and manage packet transmission in the multiple zones based on the transmission channel policy. The processor is further configured to: divide the multiple subnets by establishing virtual network interfaces, wherein each of the multiple subnets corresponds to an IP address range. The IoT gateway of claim 12, wherein the processor is further configured to: assign a specific IP address within the IP address range of one of the multiple subnets to the application to deploy the application to one of the multiple zones corresponding to the one of the multiple subnets. An IoT gateway as described in claim 12, wherein the multiple areas include an information technology service area and an operational technology service area, the IT service area includes at least one IT service application, and the OT service area includes at least one OT service application. The Internet of Things gateway as described in claim 14, wherein the multiple zones further include a management zone, and the management zone includes at least one security service application. An IoT gateway as described in claim 15, wherein the processor is further configured to: obtain a service module provided by a cloud service platform, wherein the service module includes the application; when the application belongs to a high data security level, deploy the application to the management area; and when the application belongs to a low data security level, deploy the application to the IT service area or the OT service area. The Internet of Things gateway of claim 12, wherein the processor is further configured to: obtain a partition tag of the application, wherein the partition tag corresponds to one of the multiple zones. The IoT gateway of claim 17, wherein the processor is further configured to: when installing the application on the IoT gateway, deploy the application to one of the multiple zones according to the partition tag of the application. An Internet of Things gateway as described in claim 12, wherein the multiple zones include a first zone and a second zone, and the transmission channel policy associated with the first zone includes multiple rules, and the multiple rules include allowing packets to be transmitted from the first zone to an untrusted network, denying packets to be transmitted from the first zone to a workplace via a local area network, denying packets to be transmitted from the untrusted network to the first zone, or conditionally allowing packets to be transmitted from the untrusted network to the first zone. An IoT gateway as described in claim 12, wherein the multiple zones include a first zone, a second zone, and a third zone, and the transmission channel policy associated with the third zone includes multiple rules, and the multiple rules include denying packet transmission between a first application in the first zone or the second zone and a second application in the third zone, or allowing packet transmission between the first application in the first zone or the second zone and a third application in the third zone. The Internet of Things gateway of claim 20, wherein the plurality of rules further include denying packets from an untrusted network from being delivered to the third zone. An Internet of Things gateway as described in claim 12, wherein the multiple zones include a first zone, a second zone, and a third zone, and the transmission channel policy associated with the second zone includes multiple rules, and the multiple rules include denying packets from the second zone to be transmitted to an untrusted network, or allowing packets from the second zone to be transmitted to a local area network.