# US 10,320,688 B2 · Aggregating flows by endpoint category > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,320,688 B2 - Document ID: US10320688B2 - Status: Granted - Kind: B2 - Application number: 15/640,125 - Filed: 2017-06-30 - Published: 2019-01-03 - Granted: 2019-06-11 - Earliest claimed: 2017-06-30 - Assignees: Futurewei Technologies, Inc. - Applicants: Futurewei Technologies, Inc. - Inventors: Alexander Clemm; Padmadevi Pillay-Esnault - Web page: https://patentgrep.com/patent/US10320688B2 ## CPC - H04L 47/2441: relying on flow classification, e.g. using integrated services [IntServ] - H04L 41/0681: Configuration of triggering conditions - H04L 43/026: using flow identification - H04L 43/0894: Packet rate - H04L 45/72: {Routing based on the source address} - H04L 45/745: Address table lookup; Address filtering - H04L 43/10: Active monitoring, e.g. heartbeat, ping or trace-route - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - Y02D 30/50: in wire-line communication networks, e.g. low power modes or reduced link rate - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - Y02D: CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE ## Abstract A computer-implemented method of preventing communications based on endpoint category is provided that comprises: accessing, by one or more processors of a router, a data packet that indicates a source identifier that identifies a source endpoint and a destination identifier that identifies a destination endpoint; determining, by the one or more processors of the router, a source category based on the source identifier; determining, by the one or more processors of the router, a destination category based on the destination identifier; and based on the source category and the destination category, refraining from sending the data packet to the destination endpoint. ## Claims ### Claim 1 A computer-implemented method of preventing communications based on endpoint category, comprising: accessing, by one or more processors of a router, a first data packet that indicates a first source identifier that identifies a first source endpoint and a first destination identifier that identifies a first destination endpoint; determining, by the one or more processors of the router, a first source category based on the first source identifier; determining, by the one or more processors of the router, a first destination category based on the first destination identifier; accessing a second data packet that indicates a second source identifier that identifies a second source endpoint and a second destination identifier that identifies a second destination endpoint, the second source identifier being different from the first source identifier; determining a second source category based on the second source identifier, the second source category being the same as the first source category; determining a second destination category based on the second destination identifier, the second destination category being the same as the first destination category; determining that the first data packet and the second data packet are part of a single category flow based on the determination that the second source category is the same as the first source category and the determination that the second destination category is the same as the first destination category; generating, based on the single category flow, an Internet protocol flow information export (IPFIX) message; and transmitting the generated IPFIX message over a network. ### Claim 2 (depends on 1) The computer-implemented method of claim 1, wherein: the determining of the first source category based on the first source identifier comprises: sending the first source identifier to a category server; and receiving the first source category from the category server. ### Claim 3 (depends on 1) The computer-implemented method of claim 1, further comprising: based on the first source category and the first destination category, determining that the first source endpoint is not permitted to communicate with the first destination endpoint. ### Claim 4 (depends on 1) The computer-implemented method of claim 1, further comprising: determining, based on the first source category and the first destination category, a maximum transmission rate for the first source endpoint to the first destination endpoint; determining an attempted transmission rate by the first source endpoint to the first destination endpoint; and determining that the attempted transmission rate exceeds the maximum transmission rate. ### Claim 5 (depends on 1) The computer-implemented method of claim 1, wherein the second destination identifier is different from the first destination identifier. ### Claim 6 (depends on 1) The computer-implemented method of claim 1, further comprising: based on the first source category and the first destination category, generating an alert to an administrator. ### Claim 7 (depends on 1) The computer-implemented method of claim 1, further comprising: based on the first source category and the first destination category, refraining from sending the first data packet to the first destination endpoint. ### Claim 8 A router comprising: a memory storage comprising instructions; and one or more processors in communication with the memory storage, wherein the one or more processors execute the instructions to perform: accessing a first data packet that indicates a first source identifier that identifies a first source endpoint and a first destination identifier that identifies a first destination endpoint; determining a first source category based on the first source identifier; determining a first destination category based on the first destination identifier; accessing a second data packet that indicates a second source identifier that identifies a second source endpoint and a second destination identifier that identifies a second destination endpoint, the second source identifier being different from the first source identifier; determining a second source category based on the second source identifier, the second source category being the same as the first source category; determining a second destination category based on the second destination identifier, the second destination category being the same as the first destination category; determining that the first data packet and the second data packet are part of a single category flow based on the determination that the second source category is the same as the first source category and the determination that the second destination category is the same as the first destination category; generating, based on the single category flow, an Internet protocol flow information export (IPFIX) message; and transmitting the generated IPFIX message over a network. ### Claim 9 (depends on 8) The router of claim 8, wherein: the determining of the first source category based on the first source identifier comprises using a predetermined portion of the first source identifier as an index to retrieve the first source category from a database. ### Claim 10 (depends on 8) The router of claim 8, wherein the one or more processors further perform: based on the first source category and the first destination category, determining that the first source endpoint is not permitted to communicate with the first destination endpoint. ### Claim 11 (depends on 8) The router of claim 8, wherein the one or more processors further perform: determining, based on the first source category and the first destination category, a maximum transmission rate for the first source endpoint to the first destination endpoint; determining an attempted transmission rate by the first source endpoint to the first destination endpoint; and determining that the attempted transmission rate exceeds the maximum transmission rate. ### Claim 12 (depends on 8) The router of claim 8, wherein the second destination identifier is different from the first destination identifier. ### Claim 13 (depends on 8) The router of claim 8, wherein the one or more processors further perform: based on the first source category and the first destination category, generating an alert to an administrator. ### Claim 14 (depends on 8) The router of claim 8, wherein the one or more processors further perform: based on the first source category and the first destination category, refraining from sending the first data packet to the first destination endpoint. ### Claim 15 A non-transitory computer-readable medium storing computer instructions for preventing communications based on endpoint category, that when executed by one or more processors of a router, cause the one or more processors to perform steps of: accessing a first data packet that indicates a first source identifier that identifies a first source endpoint and a first destination identifier that identifies a first destination endpoint; determining a first source category based on the first source identifier; determining a first destination category based on the first destination identifier; accessing a second data packet that indicates a second source identifier that identifies a second source endpoint and a second destination identifier that identifies a second destination endpoint, the second source identifier being different from the first source identifier; determining a second source category based on the second source identifier, the second source category being the same as the first source category; determining a second destination category based on the second destination identifier, the second destination category being the same as the first destination category; and determining that the first data packet and the second data packet are part of a single category flow based on the determination that the second source category is the same as the first source category and the determination that the second destination category is the same as the first destination category; generating, based on the single category flow, an Internet protocol flow information export (IPFIX) message; and transmitting the generated IPFIX message over a network. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein: the determining of the first source category based on the first source identifier comprises using a predetermined portion of the first source identifier as an index to retrieve the first source category from a database. ### Claim 17 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the one or more processors further perform: based on the first source category and the first destination category, determining that the first source endpoint is not permitted to communicate with the first destination endpoint. ### Claim 18 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the one or more processors further perform: determining, based on the first source category and the first destination category, a maximum transmission rate for the first source endpoint to the first destination endpoint; determining an attempted transmission rate by the first source endpoint to the first destination endpoint; and determining that the attempted transmission rate exceeds the maximum transmission rate. ### Claim 19 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the second destination identifier is different from the first destination identifier. ### Claim 20 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein the one or more processors further perform: based on the first source category and the first destination category, generating an alert to an administrator.