Patent Application
20180359274
The present invention relates generally to security systems. More particularly, the present invention relates to systems and methods for providing a notification of a cyber attack in a security system.
Security systems with internet connectivity are popular in the consumer market because they provide the ease of self-monitoring and remote installation, for example, with configuration and firmware updates via the internet. However, such web based access poses a cyber security risk to security systems. Accordingly, security systems need protection against cyber attacks.
In view of the above, there is a continuing, ongoing need for systems and methods that protect security systems against cyber attacks.
While this invention is susceptible of an embodiment in many different forms, there are shown in the drawings and will be described herein in detail specific embodiments thereof with the understanding that the present disclosure is to be considered as an exemplification of the principles of the invention. It is not intended to limit the invention to the specific illustrated embodiments.
Embodiments disclosed herein can include systems and methods for preventing and detecting a cyber attack in a security system. However, embodiments disclosed herein can also include systems and methods for providing a notification of the cyber attack, such as an alert signal, so that users are aware of the cyber attack.
Systems and methods disclosed herein are described in connection with security systems. However, it is to be understood that systems and methods disclosed herein are not so limited and could be used in connection with a fire alarm system or any connected home system with internet of things (IoT) devices.
In accordance with disclosed embodiments, a security system can react to all changes of state that violate or degrade the area protected by the security system. For example, when a window or a door along the perimeter of an area protected by an armed security system is opened, the armed security system can generate an alarm condition report of the same and transmit a life safety signal providing a notification of the same. Similarly, when the armed security system detects unwarranted cyber access to the armed security system, the armed security system can convert such detection into a change of state, generate an alarm condition report of the same, and transmit a life safety signal providing a notification of the same.
In some embodiments, detecting a cyber attack in or unwarranted cyber access to the security system can include, but is not limited to detecting a change or a modification to a file stored in a memory device of the security system, detecting a denial of service attack, or detecting unwarranted access to the internet connectivity of the security system. However, embodiments disclosed herein are not so limited and can include any electronic or web event that should not occur during normal operation of the armed security system.
In accordance with disclosed embodiments, when systems and methods disclosed herein detect a cyber attack in or unwarranted cyber access to the security system, systems and methods can convert such detection into a change of state of the security system related to cyber security. In some embodiments, the change of state related to cyber security can be assigned a unique identifier indicative of the cyber attack in or the unwarranted cyber access to the security system, and systems and methods disclosed herein can identify and associate a zone of the security system to the unique identifier. For example, in some embodiments, the zone associated with the unique identifier can be a non-physical zone and simply identify the change of state as being related to cyber security. Additionally or alternatively, in some embodiments, the zone associated with the unique identifier can identify the zone of the area protected by the security system from which the cyber attack or the unwarranted cyber access originated or in which a security system device that detected the cyber attack or the unwarranted cyber access is located.
In some embodiments, systems and methods disclosed herein can execute a predetermined action based on the unique identifier and the zone. For example, when systems and methods disclosed herein identify a change of state of the security system with the unique identifier indicative of the cyber attack in or the unwarranted cyber access to the security system or that the zone associated with the unique identifier identifies the change of state as being related to cyber security, systems and methods disclosed herein can transmit an alert signal to provide a notification of the cyber security issue. In some embodiments, systems and methods disclosed herein can transmit the alert signal to a predetermined user. Additionally or alternatively, in some embodiments, when the zone associated with the unique identifier identifies the zone from which the cyber attack or the unwarranted cyber access originated or in which the security system device that detected the cyber attack or the unwarranted cyber access is located, systems and methods disclosed herein can transmit the alert signal to a user, a user device, or the security system device in the zone.
In some embodiments, systems and methods disclosed herein can detect cyber access to the security system and determine whether the cyber access is a malicious cyber attack that is occurring remotely, for example, outside of the area protected by the security system, or whether the cyber access is authorized access from a remote secured server device. When systems and methods disclosed herein determine that the cyber access is authorized access, systems and methods need not take further action with respect to reporting the cyber access. However, when systems and methods determine that the cyber access is a malicious cyber attack, systems and methods disclosed herein can transmit a notification of the cyber attack as disclosed herein.
The security system 200 can detect a cyber attack in or unwarranted cyber access to the security system 200 and, upon such detection, can execute a predetermined action associated with detecting the cyber attack in or the unwarranted cyber access to the security system 200. For example, in some embodiments, the security system 200 can convert the detection of the cyber attack in or the unwarranted cyber access to the security system 200 to a change of state of the security system 200 with a unique address related to cyber security and can associate a zone of the security system 200 with the unique address. In some embodiments, the predetermined action can be based on the unique identifier or the zone and can include the security system 200 transmitting an alert signal to the remote central monitoring station 300. In some embodiments, a user can configure the predetermined action.
In some embodiments, responsive to receiving the alert signal from the security system 200, the remote central monitoring station 200 can transmit a dispatch signal to law enforcement or a home owner of the area protected by the security system 200. Additionally or alternatively, in some embodiments, responsive to receiving the alert signal from the security system 200, the remote central monitoring station can transmit an instruction signal to execute security countermeasures to combat the cyber attack in or the unwarranted cyber access to the security system 200.
As seen in
In some embodiments, one or more of the user interface devices 210, 310 can receive user input to configure the predetermined action associated with detecting the cyber attack in or the unwarranted cyber access to the security system 200 or can emit or display the alert signal. In some embodiments, the security system 200 and the remote central monitoring station 300 can communicate with each other via the transceiver devices 220, 320. In some embodiments, the memory devices 230, 330 can store information and data that can be accessed during the executing of the methods and processes described herein. In some embodiments, some or all of the control circuitry 240, 340, the programmable processor(s) 240a, 340a, and the executable control software 240b, 340b can execute and control the methods and processes disclosed herein.
Although a few embodiments have been described in detail above, other modifications are possible. For example, the logic flows described above do not require the particular order described or sequential order to achieve desirable results. Other steps may be provided, steps may be eliminated from the described flows, and other components may be added to or removed from the described systems. Other embodiments may be within the scope of the invention.
From the foregoing, it will be observed that numerous variations and modifications may be effected without departing from the spirit and scope of the invention. It is to be understood that no limitation with respect to the specific system or method described herein is intended or should be inferred. It is, of course, intended to cover all such modifications as fall within the spirit and scope of the invention.
