# US 12,010,095 B2 · Managing L4 ports > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,010,095 B2 - Document ID: US12010095B2 - Status: Granted - Kind: B2 - Application number: 17/377,379 - Filed: 2021-07-16 - Published: 2023-01-19 - Granted: 2024-06-11 - Earliest claimed: 2021-07-16 - Assignees: VMware, Inc. - Applicants: VMware LLC - Inventors: Carlos Phoenix; James Ryan Johnson - Web page: https://patentgrep.com/patent/US12010095B2 ## CPC - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - G06F 9/45558: {Hypervisor-specific management and integration aspects} - H04L 63/168: {above the transport layer} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 2009/45591: {Monitoring or debugging support} - G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Some embodiments of the invention provide a novel method for managing layer four (L4) ports associated with a machine executing on a host computer. The method collects a set of contextual attributes relating to applications executing on the machine. It then analyzes the collected contextual attributes to identify at least one L4 port that has to have its status modified. Next, it modifies the status of the identified L4 port. In some embodiments, the status of an L4 port can be either open or closed, and the modification can open a closed port or close an open port. In some embodiments, the method is performed when the machine starts up on the host computer, performed each time a new application is installed on the machine, performed periodically to close unused L4 ports, and/or performed periodically to close L4 ports that should not be open based on a set of L4-port control policies. ## Claims ### Claim 1 A method of managing layer four (L4) ports for a machine executing on a host computer, the method comprising: instantiating the machine to operate on the host computer; based on a default reject L4-port policy, specifying a status of each L4 port associated with the machine as being closed; detecting an event associated with the machine that requires the opening of a particular L4 port; and changing the status of the particular L4 port to open; wherein detecting the event comprises: examining a set of attributes associated with the machine; and comparing the set of attributes with one or more port control policies to identify the particular L4 port to open. ### Claim 2 (depends on 1) The method of claim 1, wherein the examined set of attributes comprises a set of contextual attributes associated with the machine, wherein a contextual attribute is an attribute other than layers 2-4 header values of data message flows sent by or received for the machine. ### Claim 3 (depends on 2) The method of claim 2, wherein the set of contextual attributes comprises contextual attributes relating to a set of applications executing on the machine or to a set of users configured to login to the machine. ### Claim 4 (depends on 2) The method of claim 2, wherein the set of contextual attributes comprises a subset of contextual attributes relating to a set of one or more security groups to which the machine belongs. ### Claim 5 (depends on 1) The method of claim 1 further comprising iteratively collecting additional attributes or updated attributes relating to the machine, and examining the collected attributes to determine whether an open L4 port should be closed or a closed L4 port should be opened. ### Claim 6 (depends on 5) The method of claim 5, wherein at least a subset of iterations are based on detected events. ### Claim 7 (depends on 6) The method of claim 6, wherein at least one event is associated with a frequency or number of data messages received for the machine at the particular L4 port. ### Claim 8 (depends on 6) The method of claim 6, wherein at least one event is associated with detected operational metrics of the machine that fail to meet required operational metric thresholds. ### Claim 9 (depends on 5) The method of claim 5, wherein iteratively collecting attributes comprises periodically collecting attributes. ### Claim 10 (depends on 1) The method of claim 1 further comprising: installing a new application on the machine; and based on at least one contextual attribute identifying the application, examining the status of a set of L4 ports to ensure that all L4 ports in the set are open. ### Claim 11 (depends on 1) The method of claim 1 further comprising creating and storing a set of records that identifies each open L4 port and each closed L4 port. ### Claim 12 (depends on 11) The method of claim 11, wherein the set of records is stored in a data store of the machine, the data store defined in a memory space that is specified for the machine on the host computer. ### Claim 13 (depends on 11) The method of claim 11, wherein the set of records is stored in a data store defined on the host computer outside of the machine, the data store defined in a memory space on the host computer that is separate from a memory space in which the machine operates on the host computer. ### Claim 14 (depends on 13) The method of claim 13, wherein the set of records is stored in a data store of a hypervisor executing on the host computer. ### Claim 15 (depends on 13) The method of claim 13, wherein the set of records is stored in a data store of an operating system executing on the host computer. ### Claim 16 (depends on 11) The method of claim 11 further comprising: receiving a data message flow for the machine; and using the stored set of records to determine whether the data message flow should be rejected because the flow is addressed to an L4 port that is closed. ### Claim 17 (depends on 16) The method of claim 16, wherein the determination is performed on the machine after a data message of the flow is provided to the machine. ### Claim 18 (depends on 16) The method of claim 16, wherein the determination is performed outside of the machine before any data message of the flow is provided to the machine. ### Claim 19 A system for managing layer four (L4) ports for a machine, the system comprising: a first data store configured to store a set of attributes associated with the machine; a second data store configured to store one or more port control policies; and a port manager coupled to the first data store and the second data store, the port manager being configured to: examine the set of attributes associated with the machine; and compare the set of attributes with one or more port control policies to identify an L4 port to open.