“Defense-in-Depth Method Based on Known Device Behavior”, a new patent from inventors Kevin Kornegay and Khir Henderson, addresses a visibility gap in Internet of Things (IoT) networks. Standards like Manufacturer Usage Description (MUD) allow “compliant” devices to announce their identity and intended behavior, so networks can automatically enforce individualized access policies. However, many devices in homes (and small businesses) are legacy or “non-compliant”, and wouldn’t ever announce an identity at all. These devices often have open ports and unpatched bugs. Because the network can’t tell what they are, it can’t apply device-specific security, which leaves them as an “open door” for potential attackers.
The inventors close this gap with a deterministic method for identifying unknown devices at the network edge. When a device connects, a network controller looks up its vendor from its MAC address and combines that with TCP and UDP port scan results. Together, these form a device “fingerprint” which is matched against an identity database. Once identified, the device can be paired with a behavior profile and protected by layered security policies.
Kornegay, K., & Henderson, K. (2026). Defense-in-depth method based on known device behavior (U.S. Patent No. 12,603,861 B2). U.S. Patent and Trademark Office. https://patents.google.com/patent/US12603861B2/en
To be notified about more SPLICE news, subscribe to this blog!
Leave a Reply