# US 12,010,141 B1 · System gateway while accessing protected non-web resources connected to internet

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,010,141 B1
- Document ID: US12010141B1
- Status: Granted
- Kind: B1
- Application number: 18/349,848
- Filed: 2023-07-10
- Granted: 2024-06-11
- Earliest claimed: 2021-06-24
- Assignees: Airgap Networks Inc.
- Applicants: Airgap Networks Inc.
- Inventors: Lokesh Mogra; Balireddy Ramesh Kumar Reddy; Satish M. Mohan; Vinay Adavi; Ritesh R. Agrawal
- Web page: https://patentgrep.com/patent/US12010141B1

## CPC

- H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks}
- H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling}
- H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)}
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/0272: {Virtual private networks}
- H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A technique to improve security for a VLAN is disclosed. A security appliance is set as the default gateway for intra-LAN communication. Message traffic is analyzed and anomalies are detected relative to normal message traffic that correspond to device health problems that may require service by a field technician. Access to a cloud-based resource may be further protected by enforcing user-based access policies.

## Claims

### Claim 1

A method for ransomware protection in a Virtual Local Area Network (VLAN), comprising:
setting a security appliance as a default gateway using a subnet mask of 255.255.255.255 to set the security appliance as a default gateway for a plurality of client endpoint devices of a shared VLAN environment, monitor intra-VLAN communication between the plurality of endpoint devices of the shared VLAN environment, and detect attributes of intra-LAN messages indicative of lateral propagation of ransomware between endpoint devices via intra-VLAN communication in the shared VLAN environment; and
managing a secure private tunnel between a client endpoint device and private applications using a cloud gateway to enforce at least one user-based policy to control access to a private application or private data resource.

### Claim 2 (depends on 1)

The method of claim 1, wherein the cloud gateway receives a user ID during a sign-in step, allocate a private tunnel IP address, and provide the private tunnel IP address to an agent on the client endpoint device, and use the user ID and a private tunnel IP mapping to identify policies for limiting or permitting the client endpoint device to access a request resource.

### Claim 3 (depends on 2)

The method of claim 2, wherein the at least one user-based policy is selectable.

### Claim 4

A computer-implemented method of ransomware protection in a Virtual Local Area Network (VLAN), comprising:
setting a security appliance as a default gateway for a plurality of endpoint devices of the shared VLAN environment by using a subnet mask of 255.255.255.255, monitoring, by the security appliance, intra-VLAN communication between the plurality of endpoint devices of a shared VLAN environment, and detecting, by the security appliance, lateral propagation of ransomware between endpoint devices via intra-VLAN communication in the shared VLAN environment;
managing a secure tunnel between an endpoint device and a protected resource using a cloud-based gateway to implement at least one user-based access policy for a user to use the secure tunnel to access a private application or a private data resource.

### Claim 5 (depends on 4)

The computer-implemented method of claim 4, wherein the cloud gateway is configured to receive a user ID during a sign-in step, allocate a private tunnel IP address, and provide the tunnel IP address to an agent on the endpoint device, and use the user ID and a private tunnel IP mapping to identify policies for limiting or permitting the client endpoint device to access a request resource via the cloud.

### Claim 6 (depends on 5)

The computer-implemented method of claim 5, wherein the at least one user-based policy is selectable.

### Claim 7 (depends on 4)

The computer-implemented method of claim 4, wherein the cloud gateway comprises a backend and a front end:
the backend installing an agent in the endpoint device, receiving a user ID during a sign-in, allocating a private tunnel IP for a user, creating a user IP mapping, and sharing a private tunnel IP address with the endpoint device; and
the frontend receiving the user IP mapping and applying a user-based policy for user traffic of the private IP tunnel going through the frontend to allow or limit access to a data resource the endpoint device attempts to connect with using the private tunnel IP.

### Claim 8 (depends on 7)

The computer-implemented method of claim 7, wherein the policy applies a firewall to the private tunnel IP to block access to a private application.

### Claim 9 (depends on 7)

The computer-implemented method of claim 7, wherein the policy is executed to forward an access request to a private application.

### Claim 10 (depends on 7)

The computer-implemented method of claim 7, wherein user-based access policies are implemented for determining access to private applications.

### Claim 11 (depends on 7)

The computer-implemented method of claim 7, wherein the policy applies a firewall to the private tunnel IP to block access to a private application.

### Claim 12

An apparatus for ransomware protection in a Virtual Local Area Network (VLAN), comprising:
computer program instructions, stored on a non-transitory computer readable medium, which when executed on a process implements a method comprising:
setting a security appliance as a default gateway for a plurality of endpoint devices of the shared VLAN environment by using a subnet mask of 255.255.255.255, monitoring, by the security appliance, intra-VLAN communication between the plurality of endpoint devices of the shared VLAN environment, and detecting, by the security appliance, lateral propagation of ransomware between endpoint devices via intra-VLAN communication in the shared VLAN environment; and
managing a secure tunnel between an endpoint device and a protected resource using a cloud-based gateway to implement at least one user-based access policy for a user to use the secure tunnel to access a private application or a private data resource.

### Claim 13 (depends on 12)

The system of claim 12, wherein the cloud gateway is configured to receive a user ID during a sign-in step, allocate a private tunnel IP address, and provide the tunnel IP address to an agent on the endpoint deice, and use the user ID and a private tunnel IP mapping to identify policies for limiting or permitting the endpoint device to access a request resource via the cloud.

### Claim 14 (depends on 13)

The system of claim 13, wherein the at least one user-based policy is selectable.

### Claim 15 (depends on 12)

The system of claim 12, wherein the cloud gateway comprises a backend and a front end, and the method implemented by the computer program instructions includes:
the backend installing an agent in the endpoint device, receiving a user ID during a sign-in, allocating a private tunnel IP for a user, creating a user IP mapping, and sharing a private tunnel IP address with the endpoint device; and
the frontend receiving the user IP mapping and applying a user-based policy for user traffic of the private IP tunnel going through the frontend to allow or limit access to a data resource the endpoint device attempts to connect with using the private tunnel IP.