# US 12,015,590 B2 · Methods and systems for efficient cyber protections of mobile devices > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,015,590 B2 - Document ID: US12015590B2 - Status: Granted - Kind: B2 - Application number: 17/837,085 - Filed: 2022-06-10 - Published: 2022-09-22 - Granted: 2024-06-18 - Earliest claimed: 2019-07-03 - Assignees: Centripetal Networks, Inc. - Applicants: Centripetal Networks, LLC - Inventors: Sean Moore; Peter P. Geremia - Web page: https://patentgrep.com/patent/US12015590B2 ## CPC - H04L 9/40: Network security protocols - H04L 63/0245: {Filtering by information in the payload} - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L 12/66: Arrangements for connecting between networks having differing types of switching systems, e.g. gateways - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/0263: {Rule management} - H04L 63/0272: {Virtual private networks} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04W 12/03: Protecting confidentiality, e.g. by encryption - H04W 12/088: using filters or firewalls - H04W 12/37: Managing security policies for mobile devices or for controlling mobile applications - H04L 45/70: {Routing based on monitoring results} - H04W 12/086: using security domains - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Enterprise users' mobile devices typically access the Internet without being protected by the enterprise's network security policy, which exposes the enterprise network to Internet-mediated attack by malicious actors. This is because the conventional approach to protecting the mobile devices and associated enterprise network is to tunnel all of the devices' Internet communications to the enterprise network, which is very inefficient since typically only a very small percentage of Internet communications originating from an enterprise's mobile devices are communicating with Internet hosts that are associated with threats. In the present disclosure, the mobile device efficiently identifies which communications are associated with Internet threats, and tunnels only such identified traffic to the enterprise network, where actions may be taken to protect the enterprise network. ## Claims ### Claim 1 A method comprising: generating, by a computing device and based on resource constraints of a mobile device, a policy probabilistic data structure that represents a plurality of packet filtering rules, wherein the plurality of packet filtering rules were automatically created or altered based on malicious traffic information received from a plurality of cyber threat intelligence providers, and wherein at least two of the plurality of cyber threat intelligence providers are managed by different organizations; sending, by the computing device and to the mobile device, the policy probabilistic data structure, wherein the policy probabilistic data structure is configured to cause the mobile device to, based on a determination that an attribute of a packet is represented in the policy probabilistic data structure, transmit the packet to a packet filtering device via a network; generating, by the computing device and based on the resource constraints of the mobile device, a new policy probabilistic data structure that represents a new plurality of packet filtering rules, wherein the new plurality of packet filtering rules were automatically created or altered based on updated malicious traffic information received from one or more of the plurality of cyber threat intelligence providers; and sending, by the computing device and to the mobile device, the new policy probabilistic data structure. ### Claim 2 (depends on 1) The method of claim 1, wherein the policy probabilistic data structure is a probabilistic data structure that comprises one or more of: a Bloom filter, or a Cuckoo filter. ### Claim 3 (depends on 1) The method of claim 1, wherein generating the new policy probabilistic data structure comprises combining two or more rules. ### Claim 4 (depends on 1) The method of claim 1, wherein generating the new policy probabilistic data structure comprises adding a new threat indicator of a new rule to the new policy probabilistic data structure. ### Claim 5 (depends on 1) The method of claim 1, wherein the policy probabilistic data structure is configured to cause the mobile device to transmit, to a packet filtering device and via a network tunnel gateway, a packet, originating from the mobile device, based on a first attribute of the packet. ### Claim 6 (depends on 1) The method of claim 1, wherein the new policy probabilistic data structure causes the mobile device to tunnel a packet having a first attribute via a network tunnel gateway, and wherein, prior to sending the new policy probabilistic data structure, the policy probabilistic data structure was configured to cause the mobile device to transmit packets having the first attribute to their respective destinations without transmitting the packets via the network tunnel gateway. ### Claim 7 (depends on 1) The method of claim 1, wherein a third policy probabilistic data structure is configured to cause the mobile device to block a second packet based on determining that a second attribute of the second packet is represented in the third policy probabilistic data structure. ### Claim 8 (depends on 1) The method of claim 1, wherein the resource constraints of the mobile device comprise an available memory of the mobile device. ### Claim 9 (depends on 1) The method of claim 1, wherein the policy probabilistic data structure is configured to cause logging of a packet based on a first attribute of the packet. ### Claim 10 (depends on 1) The method of claim 1, wherein the new plurality of packet filtering rules comprises: at least a portion of the plurality of packet filtering rules, and at least one second packet filtering rule. ### Claim 11 One or more non-transitory computer-readable media storing instructions that, when executed by one or more processors, cause a computing device to: generate, based on resource constraints of a mobile device, a policy probabilistic data structure that represents a plurality of packet filtering rules, wherein the plurality of packet filtering rules were automatically created or altered based on malicious traffic information received from a plurality of cyber threat intelligence providers, and wherein at least two of the plurality of cyber threat intelligence providers are managed by different organizations; send, to the mobile device, the policy probabilistic data structure, wherein the policy probabilistic data structure is configured to cause the mobile device to, based on a determination that an attribute of a packet is represented in the policy probabilistic data structure, transmit the packet to a packet filtering device via a network; generate, based on the resource constraints of the mobile device, a new policy probabilistic data structure that represents a new plurality of packet filtering rules, wherein the new plurality of packet filtering rules were automatically created or altered based on updated malicious traffic information received from one or more of the plurality of cyber threat intelligence providers; and send, to the mobile device, the new policy probabilistic data structure. ### Claim 12 (depends on 11) The non-transitory computer-readable media of claim 11, wherein the policy probabilistic data structure is a probabilistic data structure that comprises one or more of: a Bloom filter, or a Cuckoo filter. ### Claim 13 (depends on 11) The non-transitory computer-readable media of claim 11, wherein the policy probabilistic data structure is configured to cause the mobile device to transmit, to a packet filtering device and via a network tunnel gateway, a packet, originating from the mobile device, based on a first attribute of the packet. ### Claim 14 (depends on 11) The non-transitory computer-readable media of claim 11, wherein the new policy probabilistic data structure causes the mobile device to tunnel a packet having a first attribute via a network tunnel gateway, and wherein, prior to sending the new policy probabilistic data structure, the policy probabilistic data structure was configured to cause the mobile device to transmit packets having the first attribute to their respective destinations without transmitting the packets via the network tunnel gateway. ### Claim 15 (depends on 11) The non-transitory computer-readable media of claim 11, wherein a third policy probabilistic data structure is configured to cause the mobile device to block a second packet based on determining that a second attribute of the second packet is represented in the third policy probabilistic data structure. ### Claim 16 (depends on 11) The non-transitory computer-readable media of claim 11, wherein the resource constraints of the mobile device comprise an available memory of the mobile device. ### Claim 17 (depends on 11) The non-transitory computer-readable media of claim 11, wherein the policy probabilistic data structure is configured to cause logging of a packet based on a first attribute of the packet. ### Claim 18 (depends on 11) The non-transitory computer-readable media of claim 11, wherein the new plurality of packet filtering rules comprises: at least a portion of the plurality of packet filtering rules, and at least one second packet filtering rule. ### Claim 19 A computing device comprising: one or more processors; and memory storing instructions that, when executed by the one or more processors, cause the computing device to: generate, based on resource constraints of a mobile device, a policy probabilistic data structure that represents a plurality of packet filtering rules, wherein the plurality of packet filtering rules were automatically created or altered based on malicious traffic information received from a plurality of cyber threat intelligence providers, and wherein at least two of the plurality of cyber threat intelligence providers are managed by different organizations; send, to the mobile device, the policy probabilistic data structure, wherein the policy probabilistic data structure is configured to cause the mobile device to, based on a determination that an attribute of a packet is represented in the policy probabilistic data structure, transmit the packet to a packet filtering device via a network; generate, based on the resource constraints of the mobile device, a new policy probabilistic data structure that represents a new plurality of packet filtering rules, wherein the new plurality of packet filtering rules were automatically created or altered based on updated malicious traffic information received from one or more of the plurality of cyber threat intelligence providers; and send, to the mobile device, the new policy probabilistic data structure. ### Claim 20 (depends on 19) The computing device of claim 19, wherein the policy probabilistic data structure is a probabilistic data structure that comprises one or more of: a Bloom filter, or a Cuckoo filter. ### Claim 21 (depends on 19) The computing device of claim 19, wherein the policy probabilistic data structure is configured to cause the mobile device to transmit, to a packet filtering device and via a network tunnel gateway, a packet, originating from the mobile device, based on a first attribute of the packet. ### Claim 22 (depends on 19) The computing device of claim 19, wherein the new policy probabilistic data structure causes the mobile device to tunnel a packet having a first attribute via a network tunnel gateway, and wherein, prior to sending the new policy probabilistic data structure, the policy probabilistic data structure was configured to cause the mobile device to transmit packets having the first attribute to their respective destinations without transmitting the packets via the network tunnel gateway. ### Claim 23 (depends on 19) The computing device of claim 19, wherein a third policy probabilistic data structure is configured to cause the mobile device to block a second packet based on determining that a second attribute of the second packet is represented in the third policy probabilistic data structure. ### Claim 24 (depends on 19) The computing device of claim 19, wherein the resource constraints of the mobile device comprise an available memory of the mobile device. ### Claim 25 (depends on 19) The computing device of claim 19, wherein the policy probabilistic data structure is configured to cause logging of a packet based on a first attribute of the packet. ### Claim 26 (depends on 19) The computing device of claim 19, wherein the new plurality of packet filtering rules comprises: at least a portion of the plurality of packet filtering rules, and at least one second packet filtering rule.