# US 12,010,099 B1 · Identity-based distributed cloud firewall for access and network segmentation

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,010,099 B1
- Document ID: US12010099B1
- Status: Granted
- Kind: B1
- Application number: 18/378,370
- Filed: 2023-10-10
- Granted: 2024-06-11
- Earliest claimed: 2023-10-10
- Assignees: Uab 360 It
- Applicants: Uab 360 It
- Inventors: Carlos Eliseo Salas Lumbreras; Juta Gurinaviciute
- Web page: https://patentgrep.com/patent/US12010099B1

## CPC

- H04L 63/0263: {Rule management}
- H04L 63/0272: {Virtual private networks}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

According to some embodiments, a method of controlling access to network resources includes: receiving an authentication request from a user device to a core security service; if the user is authenticated, authorizing the user device to connect to a private cloud, and connecting the user device with the private cloud and retrieving user-specific segmented firewall rules stored in the private cloud; routing, through the firewall rules, a request by the user device to access an outer resource; evaluating the request against the firewall rules; if the request meets the firewall rules, routing the request through security measures of the firewall; and if the request does not meet the firewall rules, denying the user device access to the outer resource.

## Claims

### Claim 1

A method of controlling access to network resources, the method comprising:
receiving an authentication request from a user device to a core security service;
upon authentication of the user device by the core security service, authorizing the user device to connect to a private cloud, and connecting the user device to the private cloud comprising a gateway and a firewall and retrieving user-specific, segmented firewall rules stored in the private cloud;
routing a request by the user device to access an outer resource to the gateway;
evaluating the request against the segmented firewall rules;
if the request meets the segmented firewall rules, routing the request through security measures of the firewall; and
if the request does not meet the segmented firewall rules, denying the user device access to the outer resource.

### Claim 2 (depends on 1)

The method of claim 1, wherein each private cloud includes a corresponding firewall.

### Claim 3 (depends on 2)

The method of claim 2, wherein the request is transmitted through a secure VPN tunnel established by the gateway before being received by the firewall.

### Claim 4 (depends on 3)

The method of claim 3, wherein the segmented firewall rules include firewall rules associated with at least one of the user, a group of users, an organization, or the gateway.

### Claim 5 (depends on 3)

The method of claim 3, further comprising forwarding the request to the outer resource and transmitting a response from the outer resource to the user device through the secure VPN tunnel if the request meets the segmented firewall rules and passes the security measures of the firewall.

### Claim 6 (depends on 1)

The method of claim 1, wherein the core security service is located between the user device and at least one of the private cloud.

### Claim 7 (depends on 1)

The method of claim 1, wherein the authentication request includes a request to connect to one or more private clouds associated with the user.

### Claim 8

An apparatus for controlling access to network resources, comprising at least one processor and at least one non-transient computer readable medium for storing instructions that, when executed by the at least one processor, causes the apparatus to perform operations comprising:
receiving an authentication request from a user device to a core security service;
upon authentication of the user by the core security service, authorizing the user device to connect to a private cloud, and connecting the user device to the private cloud comprising a gateway and a firewall and retrieving user-specific, segmented firewall rules stored in the private cloud;
routing a request by the user device to access an outer resource to the gateway;
evaluating the request against the segmented firewall rules;
if the request meets the segmented firewall rules, routing the request through security measures of the firewall; and
if the request does not meet the segmented firewall rules, denying the user device access to the outer resource.

### Claim 9 (depends on 8)

The apparatus of claim 8, wherein each private cloud includes a corresponding firewall.

### Claim 10 (depends on 9)

The apparatus of claim 9, wherein the request is transmitted through a secure VPN tunnel established by the gateway before being received by the firewall.

### Claim 11 (depends on 10)

The apparatus of claim 10, wherein the segmented firewall rules include firewall rules associated with at least one of the user, a group of users, an organization, or the gateway.

### Claim 12 (depends on 10)

The apparatus of claim 10, further comprising forwarding the request to the outer resource and transmitting a response from the outer resource to the user device through the secure VPN tunnel if the request meets the segmented firewall rules and passes the security measures of the firewall.

### Claim 13 (depends on 8)

The apparatus of claim 8, wherein the core security service is located between the user device and the private cloud.

### Claim 14 (depends on 8)

The apparatus of claim 8, wherein the authentication request includes a request to connect to one or more private clouds associated with the user.

### Claim 15

One or more non-transitory computer readable media having instructions stored thereon which, when executed by one or more processors, cause the one or more processors to perform operations comprising:
receiving an authentication request from a user device to a core security service;
upon authentication of the user by the core security service authorizing the user device to connect to a private cloud, and connecting the user device to the private cloud comprising a gateway and a firewall and retrieving user-specific, segmented firewall rules stored in the private cloud;
routing a request by the user device to access an outer resource to the gateway;
evaluating the request against the segmented firewall rules;
if the request meets the segmented firewall rules, routing the request through security measures of the firewall; and
if the request does not meet the segmented firewall rules, denying the user device access to the outer resource.

### Claim 16 (depends on 15)

The computer readable media of claim 15, wherein each private cloud includes a corresponding firewall.

### Claim 17 (depends on 16)

The computer readable media of claim 16, wherein the request is transmitted through a secure VPN tunnel established by the gateway before being received by the firewall.

### Claim 18 (depends on 17)

The computer readable media of claim 17, wherein the segmented firewall rules include firewall rules associated with at least one of the user, a group of users, an organization, or the gateway.

### Claim 19 (depends on 17)

The computer readable media of claim 17, forwarding the request to the outer resource and transmitting a response from the outer resource to the user device through the secure VPN tunnel if the request meets the segmented firewall rules and passes the security measures of the firewall.

### Claim 20 (depends on 15)

The computer readable media of claim 15, wherein the authentication request includes a request to connect to one or more private clouds associated with the user.