Cloud based platform to efficiently manage firewall rules and data traffic

Patent metadata

Field	Value
Publication number	US-12192176-B2
Application number	US-202217938697-A
Country	US
Kind code	B2
Filing date	Oct 7, 2022
Priority date	Oct 18, 2021
Publication date	Jan 7, 2025
Grant date	Jan 7, 2025

Abstract

Various embodiments described herein relate to a virtual network with a cloud-based server, cloud-based firewall and a cloud-based service. The cloud-based server is in communication with a client installed on a gateway to receive an encapsulated IP data packet from one or more applications installed on the gateway. The cloud-based configured to decapsulate the encapsulated IP data packet verify a security certificate based on a first information and configure a cloud-based firewall based on a second information. The cloud-based server is configured to route the one or more IP data packets to the cloud-based firewall for processing each IP data packet based on the second information. In response to the one or more IP data packets being compliant with the first information provided to authenticate the gateway and the second information provided to configure the cloud-based firewall, routing the one or more IP data packets to the cloud-based service.

First claim

What is claimed is:

1. A method comprising:
receiving, by a cloud server with one or more processors, an encapsulated IP data packet from one or more applications installed on a gateway device, wherein the one or more applications request access to a cloud-based service;
decapsulating, by the cloud server with the one or more processors, the encapsulated IP data packet from the gateway device to retrieve one or more IP data packets wrapped within the encapsulated IP data packet;
verifying, by the cloud server with the one or more processors, a security certificate of the gateway device based on a first information from at least one of the one or more IP data packets;
configuring, by the cloud server with the one or more processors, a cloud-based firewall based on a second information from the one or more applications;
routing, by the cloud server with the one or more processors, the one or more IP data packets to the cloud-based firewall for processing each IP data packet based on the second information; and
wherein in response to the one or more IP data packets being compliant with the first information provided to authenticate the gateway device and the second information provided to configure the cloud-based firewall,
routing, by the cloud server with the one or more processors, the one or more IP data packets via a cloud communication network protocol to the cloud-based service.

2. The method of claim 1 , wherein the first information is a request for a valid, new or updated identity certificates for the gateway device which is wrapped as a part of the encapsulated IP data packet.

3. The method of claim 1 , wherein the second information is indicative of the firewall rules/policies for each application or the gateway device.

4. The method of claim 1 , further comprises:
routing, by the cloud server with the one or more processors, the first information to a virtual admin portal to retrieve the security certificate of the gateway device.

5. The method of claim 1 , further comprises:
automatically revoking, by the cloud server with the one or more processors, a previously issued security certificate when a new security certificate is issued by a virtual admin portal.

6. The method of claim 1 , further comprises:
retrieving, by the cloud-based server with the one or more processors from a virtual admin portal, a client configuration in response to the first information, wherein the first information is indicative of a new gateway device connected to the cloud server.

7. A virtual cloud-based networking platform comprising:
a cloud-based admin portal to manage a set of security services for gateway devices;
a virtual database;
one or more cloud-based servers with one or more processors communicably connected to the cloud-based admin portal and the virtual database, wherein the one or more processors configured to:
receive an encapsulated data packet from a gateway device installed in an organization network, wherein the organization network comprises one or more hardware devices and applications transmitting one or more data packets to the gateway device, wherein the one or more data packets comprise a request to access one or more cloud-based services;
decapsulate the encapsulated data packet from the gateway device to retrieve the one or more data packets wrapped within the encapsulated data packet;
verify a security certificate of the gateway device by accessing the cloud-based admin portal, wherein the security certificate is issued by the cloud-based admin portal to validate an identity of a client on the gateway device;
configure a cloud-based firewall based on a second information hosted by the virtual database; and
process the one or more data packets based on the second information, wherein in response to the one or more data packets being compliant with the second information,
route the one or more data packets via a cloud communication network protocol to the one or more cloud-based service.

8. The virtual cloud-based networking platform of claim 7 , wherein the security certificate is one of a Bootstrap certificate or a OpenVPN certificate issued for a one of a new OpenVPN client or an existing OpenVPN client installed on the gateway device.

9. The virtual cloud-based networking platform of claim 7 , wherein the second information is indicative of the network rules/policies for each application or the gateway device.

10. The virtual cloud-based networking platform of claim 7 , wherein the second information is one of embedded as an additional file in the one or more applications or stored in the form of lookup tables in the virtual database.

11. The virtual cloud-based networking platform of claim 7 , wherein the cloud-based admin portal comprises a firewall Configuration Service hosted as an application programming interface (API) through which the firewall rules or policies are administered by the cloud-based admin portal.

12. A system comprising:
a virtual client with one or more processors communicably connected to a virtual server, wherein the one or more processors configured to:
receive one or more data packets from one or more applications installed on a gateway device installed in an organization network, wherein the organization network comprises one or more hardware devices and applications transmitting one or more data packets, wherein the one or more data packets comprise a request to access one or more cloud-based services;
encapsulate the one or more data packets into an encapsulated data packet; and
route the encapsulated data packet through a virtual tunnel interface to the virtual server;

the virtual server with one or more processors communicably connected to a cloud-based admin portal and a virtual database, wherein the one or more processors configured to:
receive the encapsulated data packet from the virtual client through the virtual tunnel interface in a data format compatible with a cloud-based firewall;
decapsulate the encapsulated data packet to retrieve the one or more data packets wrapped within the encapsulated data packet;
verify a security certificate of the gateway device by accessing the cloud-based admin portal, wherein the security certificate is issued by the cloud-based admin portal to validate an identity of the virtual client on the gateway device;
configure the cloud-based firewall based on a second information hosted by the virtual database; and
process the one or more data packets based on the second information, wherein in response to the one or more data packets being compliant with the second information,
route the one or more data packets via a cloud communication network protocol to the one or more cloud-based service.

13. The system of claim 12 , further comprises:
a Domain Name System (DNS) server configured to maintain a track of IP address of the gateway device with a hostname and a destination IP address of the cloud-based service requested by each application on the gateway device.

14. The system of claim 12 , further comprises:
an organization's firewall configured with a single firewall exception in the form of a URL to redirect the encapsulated data packet to the virtual server.

15. The system of claim 12 , wherein the virtual tunnel interface communicates the encapsulated data packet to the virtual server through one of a TLS-over-TCP connection or HTTP connection.

16. A gateway device installed in a networking environment comprising:
a first client to route a first data traffic from one or more applications installed at the gateway device to a data packet wrapper, wherein the first

Assignees

• Honeywell Int Inc

Inventors

• Verma Ajay
• Kamat Amod
• Smith William
• Giorgis Daniel P
• Eaves Hugh
• Smith Michael
• Sager Patrick
• Paravastu Upender

Classifications

• H04L63/0823 Primary

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/0272

  Virtual private networks · CPC title

• H04L63/0263 Primary

  Rule management · CPC title

• H04L63/0227

  Filtering policies (mail message filtering H04L51/212) · CPC title