# US 10,320,839 B2 · Automatic anti-spoof for multicast routing > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,320,839 B2 - Document ID: US10320839B2 - Status: Granted - Kind: B2 - Application number: 15/708,504 - Filed: 2017-09-19 - Published: 2019-03-21 - Granted: 2019-06-11 - Earliest claimed: 2017-09-19 - Assignees: Forcepoint LLC - Applicants: Forcepoint, LLC - Inventors: Ville Mattila; Tomi Salminen; Tuomo Syvänne - Web page: https://patentgrep.com/patent/US10320839B2 ## CPC - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 47/20: Traffic policing - H04L 61/5007: Internet protocol [IP] addresses - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method, system and computer-usable medium are disclosed for performing an automated anti-spoofing configuration operation, comprising: determining whether a source address of an internet protocol (IP) packet is allowed by a receiving interface of a firewall; determining whether the IP packet comprises a multicast packet when the IP packet is allowed by the receiving interface of the firewall; replacing the source address with a rendezvous point address; using the rendezvous point address to determine whether routing path information associated with the multicast packet matches information stored within a multicast routing information base for the receiving interface of the firewall; and, identifying the multicast packet as spoofed when the routing path information associated with multicast packet does not have corresponding information stored within the multicast routing information base. ## Claims ### Claim 1 A computer-implementable method for performing an automated anti-spoofing configuration operation, comprising: determining whether a source address of an internet protocol (IP) packet is allowed by a receiving interface of a firewall; determining whether the IP packet comprises a multicast packet when the IP packet is allowed by the receiving interface of the firewall; replacing the source address with a rendezvous point address; using the rendezvous point address to determine whether routing path information associated with the multicast packet matches information stored within a multicast routing information base for the receiving interface of the firewall; and, identifying the multicast packet as spoofed when the routing path information associated with the multicast packet does not have corresponding information stored within the multicast routing information base; comparing the rendezvous point address of the multicast packet with a rendezvous point address for any active multicast joins to determine whether the rendezvous point address of the multicast packet has an associated active multi cast join; and, identifying the multicast packet as spoofed when the rendezvous point address does not have an associated active multicast join. ### Claim 2 (depends on 1) The method of claim 1, wherein: the receiving interface of the firewall comprises a network interface. ### Claim 3 (depends on 1) The method of claim 1, wherein: the active multicast join comprises a recipient network address associated with a rendezvous address designated as a destination of a group of multicast packets associated with a particular multicast session. ### Claim 4 (depends on 1) The method of claim 1, further comprising: determining whether logging of the multicast packet is required; and, logging information relating to the multicast packet when logging of the multicast packet is required. ### Claim 5 (depends on 1) The method of claim 1, further comprising: determining whether the multicast packet is received by a Protocol independent Multicast (PIM) enabled interface of a firewall when the IP packet comprises the multicast packet. ### Claim 6 A system comprising: a processor; a data bus coupled to the processor; and a non-transitory, computer-readable storage medium embodying computer program code, the non-transitory, computer-readable storage medium being coupled to the data bus, the computer program code interacting with a plurality of computer operations and comprising instructions executable by the processor and configured for: determining whether a source address of an internet protocol (IP) packet is allowed by a receiving interface of a firewall; determining whether the IP packet comprises a multicast packet when the IP packet is allowed by the receiving interface of the firewall; replacing the source address with a rendezvous point address; using the rendezvous point address to determine whether routing path information associated with the multicast packet matches information stored within a multicast routing information base for the receiving interface of the firewall; and, identifying the multicast packet as spoofed when the routing path information associated with the multicast packet does not have corresponding information stored within the multicast routing information base; comparing the rendezvous point address of the multicast packet with a rendezvous point address for any active multicast joins to determine whether the rendezvous point address of the multicast packet has an associated active multicast join; and, identifying the multicast packet as spoofed when the rendezvous point address does not have an associated active multicast join. ### Claim 7 (depends on 6) The system of claim 6, wherein: the receiving interface of the firewall comprises a network interface. ### Claim 8 (depends on 6) The system of claim 6, wherein: the active multicast join comprises a recipient network address associated with a rendezvous address designated as a destination of a group of multicast packets associated with a particular multicast session. ### Claim 9 (depends on 6) The system of claim 6, wherein the instructions executable by the processor are further configured for: determining whether logging of the multicast packet is required; and, logging information relating to the multicast packet when logging of the multicast packet is required. ### Claim 10 (depends on 6) The system of claim 6, wherein the instructions executable by the processor are further configured for: determining whether the multicast packet is received by a Protocol independent Multicast (PIM) enabled interface of a firewall when the IP packet comprises the multicast packet. ### Claim 11 A non-transitory, computer-readable storage medium embodying computer program code, the computer program code comprising computer executable instructions configured for: determining whether a source address of an internet protocol (IP) packet is allowed by a receiving interface of a firewall; determining whether the IP packet comprises a multicast packet when the IP packet is allowed by the receiving interface of the firewall; replacing the source address with a rendezvous point address; using the rendezvous point address to determine whether routing path information associated with the multicast packet matches information stored within a multicast routing information base for the receiving interface of the firewall; and, identifying the multicast packet as spoofed when the routing path information associated with the multicast packet does not have corresponding information stored within the multicast routing information base; comparing the rendezvous point address of the multicast packet with a rendezvous point address for any active multicast joins to determine whether the rendezvous point address of the multicast packet has an associated active multicast join; and, identifying the multicast packet as spoofed when the rendezvous point address does not have an associated active multicast join. ### Claim 12 (depends on 11) The non-transitory, computer-readable storage medium of claim 11, wherein: the receiving interface of the firewall comprises a network interface. ### Claim 13 (depends on 11) The non-transitory, computer-readable storage medium of claim 11, wherein: the active multicast join comprises a recipient network address associated with a rendezvous address designated as a destination of a group of multicast packets associated with a particular multicast session. ### Claim 14 (depends on 11) The non-transitory, computer-readable storage medium of claim 11, wherein the computer executable instructions are further configured for: determining whether logging of the multicast packet is required; and, logging information relating to the multicast packet when logging of the multicast packet is required. ### Claim 15 (depends on 11) The non-transitory, computer-readable storage medium of claim 11, wherein the computer executable instructions are further configured for: determining whether the multicast packet is received by a Protocol Independent Multicast (PIM) enabled interface of a firewall when the IP packet comprises the multicast packet. ### Claim 16 (depends on 11) The non-transitory, computer-readable storage medium of claim 11, wherein: the computer executable instructions are deployable to a client system from a server system at a remote location. ### Claim 17 (depends on 11) The non-transitory, computer-readable storage medium of claim 11, wherein: the computer executable instructions are provided by a service provider to a user on an on-demand basis.