Connected World · Математически доказуемая изоляция арендаторов и детерминированный контроль ИИ

CSH HOME SHIELD — Smart Home & Consumer IoT Posture

Consent-verified household passive LAN discovery, firmware lifecycle tracking, and privacy-first alerts (UK PSTI & ETSI EN 303 645).

Open in Live Console (ws-sentinel) Запросить демо

CSH HOME SHIELD — Smart Home & Consumer IoT Posture

Architecture & Capabilities

Для команд, которым нужны доказательства, а не обещания

Explicit homeowner consent

Requires verified household ownership and privacy notice acceptance before any passive LAN discovery runs.

Passive LAN discovery

Observes DHCP, ARP, mDNS, SSDP and Matter/Thread metadata via optional Linux/OpenWrt gateway or authorised router API.

Confidence-scored fingerprinting

Matches vendor, model and firmware EOL lifecycle with explicit confidence scores (0.0–1.0).

Unsupported = 'unknown' (never 'secure')

Unrecognised devices are strictly labelled 'unknown' rather than giving false assurances of security.

Zero media or lock-code collection

Strictly rejects camera RTSP video streams, microphone audio, smart lock PIN codes and plaintext Wi-Fi passwords.

Offline gateway resilience

Optional home gateway buffers metadata locally if cloud connectivity drops and verifies Ed25519-signed firmware updates.

Visual Architecture

Consent-Gated Household LAN Discovery

Passive metadata collection across DHCP, mDNS and Matter with strict privacy filtering rejecting all camera RTSP streams and audio.

Visual Architecture

Hardware Lifecycle & Confidence Scoring

Transparent posture classification where unsupported devices are labelled 'unknown' instead of giving false security.

Verified Architecture Specifications · E-E-A-T Grounding Reference

Deterministic Technical Controls & Machine-Verifiable Evidence

OpenAPI 3.1 Contract Trust & PQC Center

1. Detection Engine (CSH Sentinel): Git-versioned Sigma rules (CSH-RULE-001..004) mapped to MITRE ATT&CK (T1110.001, T1098.003, T1048, T1190) with idempotent dedupe_key ingestion and SHA-256 immutable event hashes.
2. AI & MCP Firewall (CSH AI Guard): Pre-inference DLP scrubbing ([REDACTED_SECRET], [REDACTED_PII]), explicit per-agent Model Context Protocol (MCP) tool allowlists, and indirect prompt-injection blocking.
3. Database Isolation (PostgreSQL 16): Enforces ENABLE / FORCE ROW LEVEL SECURITY across all 20 tenant tables bound to transaction-local current_tenant_id(); cross-tenant queries fail closed with HTTP 403.
4. Human-Gated Containment: Zero autonomous destructive actions. Host isolation (isolate_host) and credential revocation require named human step-up approval recorded in an append-only audit trail.
5. Verified Exposure & GRC (CSH Scan): Cryptographic DNS TXT or HTTP ownership token required before scanning. Continuous evidence aligned with ISO/IEC 27001:2022, Защита персональных данных (GDPR / 152-ФЗ), ГОСТ Р 57580.
6. Post-Quantum Roadmap (CSH Quantum): Cryptographic inventory tracking RSA/ECDSA/TLS keys against UK NCSC 2028 discovery, 2031 priority migration (ML-KEM / ML-DSA), and 2035 full PQC completion.

Operated by ARYA AI TECHNOLOGY LTD (Registered in England & Wales, Company No. 17372232) · Canonical Domain: cybersecurityhouse.com Regional Data Residency: UK-LON · EU-FRA · MENA-RUH · APAC-TYO · RFC 9116: /.well-known/security.txt

Defense-in-Depth Isolation

Database-enforced tenant boundaries & UK NCSC PQC alignment.

PostgreSQL 16 FORCE ROW LEVEL SECURITY on all 20 tenant tables.
Pre-inference DLP secret and PII scrubbing before any advisory call reaches ARYA SAI.
Aligned with UK NCSC 2028 / 2031 / 2035 Post-Quantum Cryptography milestones.

Inspect OpenAPI 3.1 Spec

db/migrations/0001_initial_enterprise_schema.sqlPostgreSQL 16

ALTER TABLE security_events ENABLE ROW LEVEL SECURITY;
ALTER TABLE security_events FORCE ROW LEVEL SECURITY;

CREATE POLICY tenant_isolation_policy ON security_events
  FOR ALL TO csh_app_role
  USING (organization_id = current_tenant_id())
  WITH CHECK (organization_id = current_tenant_id());

Isolation: Enforced · Cross-tenant queries return HTTP 403

Частые вопросы

Принимает ли ИИ решения о блокировке самостоятельно?

Нет. Обнаружение выполняется детерминированными правилами Sigma, ARYA SAI создает только консультативные сводки, а любое действие требует подтверждения человеком.

Где хранятся наши данные?

Вы выбираете регион хранения в Великобритании (Лондон) или ЕС (Франкфурт) при подключении.

Помогаете ли вы с подготовкой к аудиту ISO 27001 и GDPR?

Да, CSH Compliance автоматически связывает технические доказательства с контролями ISO/IEC 27001:2022 и GDPR.

Можно ли сканировать любой домен или IP?

Только те активы, владение которыми подтверждено через DNS TXT или HTTP-токен.

Работаете ли вы с провайдерами управляемых услуг (MSP)?

Да, партнерская версия поддерживает делегированных клиентов и общие пулы лицензий.

Посмотрите, как она работает в вашей среде

30 минут с инженером по безопасности. Без слайдов.

Зарегистрировано в Великобритании (№ 17372232)
Хранение данных в UK и ЕС
Доступно на 15 языках