# US 12,010,098 B2 · Enforcing a segmentation policy in co-existence with a system firewall

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,010,098 B2
- Document ID: US12010098B2
- Status: Granted
- Kind: B2
- Application number: 18/218,899
- Filed: 2023-07-06
- Published: 2023-11-02
- Granted: 2024-06-11
- Earliest claimed: 2018-12-18
- Assignees: Illumio, Inc.
- Applicants: Illumio, Inc.
- Inventors: Daniel Richard Cook; Anish Vinodkumar Desai; Thomas Michael McCormick
- Web page: https://patentgrep.com/patent/US12010098B2

## CPC

- H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)}
- G06F 9/3826: {Bypassing or forwarding of data results, e.g. locally between pipeline stages or within a pipeline stage}
- G06F 9/4486: {Formation of subprogram jump address}
- H04L 41/0803: Configuration setting
- H04L 41/0894: Policy-based network configuration management
- H04L 43/04: Processing captured monitoring data, e.g. for logfile generation
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/0254: {Stateful filtering}
- H04L 63/0263: {Rule management}
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04L 41/069: using logs of notifications; Post-processing of notifications
- H04L 41/0895: Configuration of virtualised networks or elements, e.g. virtualised network function or OpenFlow elements
- H04L 41/40: using virtualisation of network functions or resources, e.g. SDN or NFV entities
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A segmentation firewall executing on a host enforces a segmentation policy. In a co-existence mode, the segmentation firewall operates in co-existence with a system firewall that enforces a security policy. The segmentation firewall is configured to either drop packets that do not match any permissive rule or pass packets that match a permissive rule to the system firewall to enable the system firewall to determine whether to drop or accept the passed packets. To enable efficient operation of the segmentation firewall when operating in co-existence with the system firewall, the segmentation firewall may include a plurality of rule chains and may be configured to exit a chain and bypass remaining rule chains upon an input packet matching a permissive rule of the segmentation policy.

## Claims

### Claim 1

A method for processing an input packet at a host device in accordance with firewall rules of a segmentation firewall that enforces a segmentation policy on the host device and that co-exists with a system firewall of the host device, the method comprising:
configuring the segmentation firewall in a co-existence mode;
receiving a first input packet at the host device;
responsive to the segmentation firewall determining that the first input packet should be accepted, passing control of the first input packet to the system firewall of the host device to enable the system firewall to determine whether to drop or accept the first input packet;
switching operation of the segmentation firewall to an exclusive mode;
receiving a second input packet with the segmentation firewall operating in the exclusive mode;
applying the segmentation firewall rules of the segmentation firewall to determine whether to drop or accept the second input packet, wherein accepting the second input packet provides the second input packet to its destination by bypassing the system firewall; and
dropping or accepting the second input packet dependent on application of the segmentation firewall rules.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
determining, by the system firewall, whether to drop or accept the first input packet based on security firewall rules associated with the system firewall;
dropping the first input packet responsive to the system firewall determining to drop the first input packet; and
passing the first input packet to a workload or to a network responsive to the system firewall determining to accept the first input packet.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
applying permissive segmentation firewall rules of a rule chain of the segmentation firewall executing on the host device to determine if the first input packet meets respective criteria of each of the segmentation firewall rules; and
responsive to the first input packet meeting criteria specified in one of the segmentation firewall rules, executing a command to exit the rule chain without dropping or accepting the first input packet,
wherein passing control of the first input packet to the system firewall is further responsive to executing the command to exit the rule chain.

### Claim 4 (depends on 3)

The method of claim 3, wherein applying the permissive segmentation firewall rules comprises:
executing a first jump command of an input module to jump to a chain selection module of the segmentation firewall;
selecting, by the chain selection module, a first rule chain of the segmentation firewall;
executing, in the chain selection module, a goto command to go to the first rule chain of the segmentation firewall;
executing first firewall rules in the first rule chain; and
responsive to completing execution of the first firewall rules without dropping the first input packet, executing a first return command to return to a first memory location of an instruction of the input module following the first jump command.

### Claim 5 (depends on 4)

The method of claim 4, further comprising:
executing a second jump command to a second rule chain of the segmentation firewall;
executing second firewall rules in the second rule chain; and
responsive to completing execution of the second firewall rules without dropping the first input packet, executing a second return command to return to a second memory location of an instruction of the input module following the second jump command.

### Claim 6 (depends on 5)

The method of claim 5, further comprising passing, by the input module, the first input packet to the system firewall following the second return command.

### Claim 7 (depends on 4)

The method of claim 4, wherein selecting the first rule chain of the segmentation firewall comprises:
determining a packet type of the first input packet; and
selecting the first rule chain from a set of selectable rule chains based on the packet type.

### Claim 8 (depends on 1)

The method of claim 1, further comprising:
switching operation of the segmentation firewall to a monitoring mode;
receiving a third input packet with the segmentation firewall operating in the monitoring mode;
applying the segmentation firewall rules of the segmentation firewall and logging results of the application of the segmentation firewall rules without dropping or accepting the third input packet; and
storing a log of the results.

### Claim 9

A non-transitory computer-readable storage medium storing instructions for generating firewall rules of a segmentation firewall that enforces a segmentation policy and that co-exists with a system firewall, the instructions when executed by a computing system causing the computing system to perform operations comprising:
configuring the segmentation firewall in a co-existence mode;
receiving a first input packet at a host device;
responsive to the segmentation firewall determining that the first input packet should be accepted, passing control of the first input packet to the system firewall of the host device to enable the system firewall to determine whether to drop or accept the first input packet;
switching operation of the segmentation firewall to an exclusive mode;
receiving a second input packet with the segmentation firewall operating in the exclusive mode;
applying the segmentation firewall rules of the segmentation firewall to determine whether to drop or accept the second input packet, wherein accepting the second input packet provides the second input packet to its destination by bypassing the system firewall; and
dropping or accepting the second input packet dependent on application of the segmentation firewall rules.

### Claim 10 (depends on 9)

The non-transitory computer-readable storage medium of claim 9, wherein the operations further comprise:
determining, by the system firewall, whether to drop or accept the first input packet based on security firewall rules associated with the system firewall;
dropping the first input packet responsive to the system firewall determining to drop the first input packet; and
passing the first input packet to a workload or to a network responsive to the system firewall determining to accept the first input packet.

### Claim 11 (depends on 9)

The non-transitory computer-readable storage medium of claim 9, wherein the operations further comprise:
applying permissive segmentation firewall rules of a rule chain of the segmentation firewall executing on the host device to determine if the first input packet meets respective criteria of each of the segmentation firewall rules; and
responsive to the first input packet meeting criteria specified in one of the segmentation firewall rules, executing a command to exit the rule chain without dropping or accepting the first input packet,
wherein passing control of the first input packet to the system firewall is further responsive to executing the command to exit the rule chain.

### Claim 12 (depends on 11)

The non-transitory computer-readable storage medium of claim 11, wherein applying the permissive segmentation firewall rules comprises:
executing a first jump command of an input module to jump to a chain selection module of the segmentation firewall;
selecting, by the chain selection module, a first rule chain of the segmentation firewall;
executing, in the chain selection module, a goto command to go to the first rule chain of the segmentation firewall;
executing first firewall rules in the first rule chain;
responsive to completing execution of the first firewall rules without dropping the first input packet, executing a first return command to return to a first memory location of an instruction of the input module following the first jump command.

### Claim 13 (depends on 12)

The non-transitory computer-readable storage medium of claim 12, wherein the operations further comprise:
executing a second jump command to a second rule chain of the segmentation firewall;
executing second firewall rules in the second rule chain; and
responsive to completing execution of the second firewall rules without dropping the first input packet, executing a second return command to return to a second memory location of an instruction of the input module following the second jump command.

### Claim 14 (depends on 13)

The non-transitory computer-readable storage medium of claim 13, wherein the operations further comprise passing, by the input module, the first input packet to the system firewall following the second return command.

### Claim 15 (depends on 12)

The non-transitory computer-readable storage medium of claim 12, wherein selecting the first rule chain of the segmentation firewall comprises:
determining a packet type of the first input packet; and
selecting the first rule chain from a set of selectable rule chains based on the packet type.

### Claim 16 (depends on 9)

The non-transitory computer-readable storage medium of claim 9, wherein the operations further comprise:
switching operation of the segmentation firewall to a monitoring mode;
receiving a third input packet with the segmentation firewall operating in the monitoring mode;
applying the segmentation firewall rules of the segmentation firewall and logging results of the application of the segmentation firewall rules without dropping or accepting the third input packet; and
storing a log of the results.

### Claim 17

A system for generating firewall rules of a segmentation firewall that enforces a segmentation policy and that co-exists with a system firewall, the system comprising:
one or more processors; and
a memory storing instructions that, when executed by the one or more processors, cause the one or more processors to perform operations including:
configuring the segmentation firewall in a co-existence mode;
receiving a first input packet at a host device;
responsive to the segmentation firewall determining that the first input packet should be accepted, passing control of the first input packet to the system firewall of the host device to enable the system firewall to determine whether to drop or accept the first input packet;
switching operation of the segmentation firewall to an exclusive mode;
receiving a second input packet with the segmentation firewall operating in the exclusive mode;
applying the segmentation firewall rules of the segmentation firewall to determine whether to drop or accept the second input packet, wherein accepting the second input packet provides the second input packet to its destination by bypassing the system firewall; and
dropping or accepting the second input packet dependent on application of the segmentation firewall rules.

### Claim 18 (depends on 17)

The system of claim 17, wherein the operations further include:
applying permissive segmentation firewall rules of a rule chain of the segmentation firewall executing on the host device to determine if the first input packet meets respective criteria of each of the segmentation firewall rules; and
responsive to the first input packet meeting criteria specified in one of the segmentation firewall rules, executing a command to exit the rule chain without dropping or accepting the first input packet,
wherein passing control of the first input packet to the system firewall is further responsive to executing the command to exit the rule chain.

### Claim 19 (depends on 18)

The system of claim 18, wherein applying the permissive segmentation firewall rules comprises:
executing a first jump command of an input module to jump to a chain selection module of the segmentation firewall;
selecting, by the chain selection module, a first rule chain of the segmentation firewall;
executing, in the chain selection module, a goto command to go to the first rule chain of the segmentation firewall;
executing first firewall rules in the first rule chain;
responsive to completing execution of the first firewall rules without dropping the first input packet, executing a first return command to return to a first memory location of an instruction of the input module following the first jump command.

### Claim 20 (depends on 19)

The system of claim 19, wherein selecting the first rule chain of the segmentation firewall comprises:
determining a packet type of the first input packet; and
selecting the first rule chain from a set of selectable rule chains based on the packet type.