# US 10,122,686 B2 · Method of building a firewall for networked devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,122,686 B2 - Document ID: US10122686B2 - Status: Granted - Kind: B2 - Application number: 15/499,406 - Filed: 2017-04-27 - Published: 2018-04-05 - Granted: 2018-11-06 - Earliest claimed: 2016-10-03 - Assignees: Mediatek Inc. - Applicants: MediaTek Inc. - Inventors: Hungwen Li - Web page: https://patentgrep.com/patent/US10122686B2 ## CPC - H04L 63/0245: {Filtering by information in the payload} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/104: {Grouping of entities} - H04W 12/06: Authentication - H04W 12/08: Access security - H04W 12/12: Detection or prevention of fraud - H04L 67/146: Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding - H04W 12/76: Group identity - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A device is provided to perform secure operations in a network that includes multiple devices. The device comprises multiple processor cores; multiple physical ports to receive packets; a system interconnect and a network security engine. The network security engine is operative to: extract a key from a packet received from a physical port among the physical ports; in response to a first determination that the key does not match a stored key in the device, block the packet from entering the system interconnect through the physical port; and in response to the first determination that the key matches the stored key and in response to a second determination that one or more identifiers extracted from the packet do not match stored information in the device, block the packet from entering an identified processor core among the processor cores that is to be accessed by the packet. ## Claims ### Claim 1 A method for secure operations of a device in a network including a plurality of devices, comprising: extracting a key from a packet received from a physical port of the device, wherein the device includes a plurality of processor cores which are connected to the physical port via a system interconnect; in response to a first determination that the key does not match a stored key in the device, blocking the packet from entering the system interconnect through the physical port; and in response to the first determination that the key matches the stored key and in response to a second determination that one or more identifiers extracted from the packet do not match stored information in the device, blocking the packet from entering an identified processor core among the processor cores, wherein the one or more identifiers identify a memory location in the device, and the stored information includes a memory address range allocated to a process executed by the identified processor core for processing the packet. ### Claim 2 (depends on 1) The method of claim 1, wherein the one or more identifiers include a process ID identifying the process for processing the packet. ### Claim 3 (depends on 1) The method of claim 1, wherein the one or more identifiers include an address identifier identifying the memory location in the device, and wherein the second determination includes determining whether the memory location is in the memory address range. ### Claim 4 (depends on 1) The method of claim 1, wherein the one or more identifiers include a target object identifier identifying an object allocated with the memory location. ### Claim 5 (depends on 1) The method of claim 1, wherein the packet includes a session ID identifying a network session established between the device and a source entity that sent the packet, the method further comprising: blocking the packet by terminating the network session identified by the session ID. ### Claim 6 (depends on 1) The method of claim 1, wherein blocking the packet further comprises: opening a first physical switch between the physical port and the system interconnect; or opening a second physical switch between the identified processor core and the system interconnect. ### Claim 7 (depends on 1) The method of claim 1, wherein the key includes a group key, the method further comprising: broadcasting a heartbeat message at a programmable time interval to other devices in the network that share a same group key. ### Claim 8 (depends on 7) The method of claim 7, further comprising: in response to receipt of the heartbeat message from another device in the network sharing the same group key, re-activating disabled connections to the system interconnect from all physical ports and all of the processor cores in the device. ### Claim 9 (depends on 1) The method of claim 1, further comprising: changing the key to an alternative key between the device and a source entity that sent the packet; and blocking the packet in response to the source entity not having a valid response to the alternative key. ### Claim 10 A device operative to perform secure operations in a network including a plurality of devices, comprising: a plurality of processor cores; a plurality of physical ports to receive packets; a system interconnect coupled to the processor cores and the physical ports; and a network security engine coupled to the processor cores and the physical ports, the network security engine operative to: extract a key from a packet received from a physical port among the physical ports; in response to a first determination that the key does not match a stored key in the device, block the packet from entering the system interconnect through the physical port; and in response to the first determination that the key matches the stored key and in response to a second determination that one or more identifiers extracted from the packet do not match stored information in the device, block the packet from entering an identified processor core among the processor cores, wherein the one or more identifiers identify a memory location in the device, and the stored information includes a memory address range allocated to a process executed by the identified processor core for processing the packet. ### Claim 11 (depends on 10) The device of claim 10, wherein the one or more identifiers include a process ID identifying the process for processing the packet. ### Claim 12 (depends on 10) The device of claim 10, wherein the one or more identifiers include an address identifier identifying the memory location in the device, and wherein the second determination includes determining whether the memory location is in the memory address range. ### Claim 13 (depends on 10) The device of claim 10, wherein the one or more identifiers include a target object identifier identifying an object allocated with the memory location. ### Claim 14 (depends on 10) The device of claim 10, wherein the packet includes a session ID identifying a network session established between the device and a source entity that sent the packet, the network security engine is further operative to: block the packet by terminating the network session identified by the session ID. ### Claim 15 (depends on 10) The device of claim 10, wherein the network security engine is further operative to: block the packet by opening a physical switch between the physical port and the system interconnect or between the identified processor core and the system interconnect. ### Claim 16 (depends on 10) The device of claim 10, wherein the key includes a group key, the network security engine further operative to: broadcast a heartbeat message at a programmable time interval to other devices in the network that share a same group key. ### Claim 17 (depends on 16) The device of claim 16, wherein the network security engine is further operative to: in response to receipt of the heartbeat message from another device in the network sharing the same group key, re-activate disabled connections to the system interconnect from all physical ports and all of the processor cores in the device. ### Claim 18 (depends on 10) The device of claim 10, the network security engine is further operative to: change the key to an alternative key between the device and a source entity that sent the packet; and block the packet in response to the source entity not having a valid response to the alternative key. ### Claim 19 A system operative to perform secure operations in a network, comprising: a plurality of devices; and a gateway coupled to the devices via the network to manage the devices; at least one of the devices further comprising: a plurality of processor cores; a plurality of physical ports to receive packets; a system interconnect coupled to the processor cores and the physical ports; and a network security engine coupled to the processor cores and the physical ports, the network security engine operative to: extract a key from a packet received from a physical port among the physical ports, wherein the key includes a group name identifying a group of the devices; in response to a first determination that the key does not match a stored key in the device, block the packet from entering the system interconnect through the physical port; and in response to the first determination that the key matches the stored key and in response to a second determination that one or more identifiers extracted from the packet do not match stored information in the device, block the packet from entering an identified processor core among the processor cores, wherein the one or more identifiers identify a memory location in the at least one device, and the stored information includes a memory address range allocated to a process executed by the identified processor core for processing the packet. ### Claim 20 (depends on 19) The system of claim 19, wherein the one or more identifiers include a process ID identifying the process for processing the packet. ### Claim 21 (depends on 19) The device of claim 19, wherein the one or more identifiers include an address identifier identifying the memory location, or a target object identifier identifying an object allocated with the memory location, and wherein the second determination includes determining whether the memory location is in the memory address range. ### Claim 22 (depends on 19) The system of claim 19, wherein each trusted node is a Wi-Fi portable access point.