# US 12,015,722 B2 · Methods and systems for cryptographic identity based network microsegmentation

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,015,722 B2
- Document ID: US12015722B2
- Status: Granted
- Kind: B2
- Application number: 16/958,611
- Filed: 2018-12-20
- Published: 2020-10-22
- Granted: 2024-06-18
- Earliest claimed: 2017-12-29
- Assignees: Pensando Systems Inc.
- Applicants: Pensando Systems Inc.
- Inventors: Vipin Jain; Ravi Kumar Gadde; Enrico Schiattarella; Sukhesh Halemane
- Web page: https://patentgrep.com/patent/US12015722B2

## CPC

- H04L 9/3268: {using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]}
- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- G06F 21/33: using certificates
- G06F 21/44: Program or device authentication
- H04L 9/0833: {involving conference or group key (network architectures or network communication protocols for key management in group communication in a packet data network H04L63/065)}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/3273: {for mutual authentication (network architectures or network communication protocols for achieving mutual authentication in a packet data network H04L63/0869)}
- H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL}
- H04L 63/205: {involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved (negotiation of communication capabilities H04L69/24)}
- G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances}
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 67/141: Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Methods and network interface devices for establishing a secure and authenticated network connection are provided. The method comprises: receiving, from a requesting entity, a destination IP address and a first certificate that is used to establish a secure network connection, wherein the first certificate comprises a first security attribute that is associated with a source destination IP address; identifying, with aid of one or more processors, a stored second security attribute associated with the destination IP address; and determining, with aid of the one or more processors, a policy action based at least in part on the first security attribute and the second security attribute.

## Claims

### Claim 1

A method for establishing a secure and authenticated network connection, the method comprising:
a) receiving, from a requesting entity, a destination IP address and a first certificate that is used to establish a secure network connection, wherein the first certificate comprises a first security attribute associated with a source IP address, wherein the first certificate is a trusted certificate issued by a certificate authority, wherein the first security attribute in the first certificate comprises a security group associated with the source IP address, the security group including multiple endpoints identified to share a security attribute;
b) identifying, with aid of one or more processors, a stored second security attribute associated with the destination IP address; and
c) determining, with aid of the one or more processors, a policy action based at least in part on the first security attribute and the second security attribute.

### Claim 2 (depends on 1)

The method of claim 1, wherein the certificate authority comprises an intermediate certificate authority, the method further comprising transmitting, from the requesting entity, a certificate signing request (CSR) to the intermediate certificate authority, wherein the CSR comprises the first security attribute and the associated source IP address.

### Claim 3 (depends on 2)

The method of claim 2, wherein a mapping relationship between the first security attribute and the source IP address is received from a computing device running the intermediate certificate authority.

### Claim 4 (depends on 3)

The method of claim 3, wherein the mapping relationship is at least in part managed by the intermediate certificate authority.

### Claim 5 (depends on 2)

The method of claim 2, further comprising receiving a certificate from the intermediate certificate authority, wherein the certificate comprises the first security attribute.

### Claim 6 (depends on 2)

The method of claim 2, further comprising storing the certificate in a local database managed by the requesting entity.

### Claim 7 (depends on 2)

The method of claim 2, wherein the intermediate certificate authority is verified by a root certificate authority.

### Claim 8 (depends on 1)

The method of claim 1, further comprising identifying, with aid of the one or more processors, a second certificate associated with the destination IP address.

### Claim 9 (depends on 8)

The method of claim 8, further comprising transmitting the second certificate to the requesting entity.

### Claim 10 (depends on 8)

The method of claim 8, wherein the first certificate and the second certificate are issued by the certificate authority.

### Claim 11 (depends on 8)

The method of claim 8, wherein the certificate authority comprises a first intermediate certificate authority, wherein the second certificate is issued by a second intermediate certificate authority, the first intermediate certificate authority being different than the second intermediate certificate authority.

### Claim 12 (depends on 11)

The method of claim 11, wherein the first intermediate certificate authority and the second intermediate certificate authority are verified by the same root certificate authority.

### Claim 13 (depends on 1)

The method of claim 1, further comprising executing the policy action on a base system logic or by the requesting entity.

### Claim 14 (depends on 13)

The method of claim 13, wherein the base system logic comprises a bare metal server, a hypervisor or a docker base for controlling one or more virtual machines or containers.

### Claim 15 (depends on 1)

The method of claim 1, wherein the policy action comprises at least one of the following: allow, block, rate-limit, mark and alert.

### Claim 16 (depends on 1)

The method of claim 1, wherein the security group is mapped to the source IP address in a database.

### Claim 17 (depends on 1)

The method of claim 1, wherein the second security attribute comprises a security group the destination IP address is associated therewith.

### Claim 18

A network interface device comprising: a memory for storing a set of instructions and one or more processors configured to execute the set of instructions to perform at least the following:
a) receive, from a requesting entity, a destination IP address and a first certificate that is used to establish a secure network connection, wherein the first certificate comprises a first security attribute associated with a source IP address, wherein the first certificate is a trusted certificate issued by a certificate authority, and wherein the first security attribute in the first certificate comprises a security group associated with the source IP address, the security group including multiple endpoints identified to share a security attribute;
b) identify a stored second security attribute associated with the destination IP address; and
c) determine a policy action based at least in part on the first security attribute and the second security attribute.

### Claim 19 (depends on 18)

The network interface device of claim 18, wherein the certificate authority comprises an intermediate certificate authority, wherein the one or more processors are further configured to generate and transmit a certificate signing request (CSR) to the intermediate certificate authority, and wherein the CSR comprises the first security attribute and the associated source IP address.

### Claim 20 (depends on 19)

The network interface device of claim 19, wherein a mapping relationship between the first security attribute and the source IP address is received from a computing device running the intermediate certificate authority.

### Claim 21 (depends on 20)

The network interface device of claim 20, wherein the mapping relationship is at least in part managed by the intermediate certificate authority.

### Claim 22 (depends on 19)

The network interface device of claim 19, wherein the one or more processors are further configured to receive a signed certificate from the intermediate certificate authority, and wherein the signed certificate comprises the first security attribute.

### Claim 23 (depends on 22)

The network interface device of claim 22, wherein the one or more processors are further configured to store the signed certificate in a local database managed by the network interface device.

### Claim 24 (depends on 19)

The network interface device of claim 19, wherein the intermediate certificate authority is verified by a root certificate authority.

### Claim 25 (depends on 18)

The network interface device of claim 18, wherein the one or more processors further configured to identity a second certificate associated with the destination IP address.

### Claim 26 (depends on 25)

The network interface device of claim 25, wherein the one or more processors further configured to transmit the second certificate to the requesting entity.

### Claim 27 (depends on 25)

The network interface device of claim 25, wherein the first certificate and the second certificate are issued by the certificate authority.

### Claim 28 (depends on 25)

The network interface device of claim 25, wherein the certificate authority comprises a first intermediate certificate authority, wherein the second certificate is issued by a second intermediate certificate authority, the first intermediate certificate authority being different than the second intermediate certificate authority.

### Claim 29 (depends on 28)

The network interface device of claim 28, wherein the first intermediate certificate authority and the second intermediate certificate authority are verified by the same root certificate authority.

### Claim 30 (depends on 18)

The network interface device of claim 18, wherein the policy action is executed on a base system logic.

### Claim 31 (depends on 30)

The network interface device of claim 30, wherein the base system logic comprises a bare metal server, a hypervisor or a docker base for controlling one or more virtual machines or containers and wherein the bare metal server, the hypervisor or the docker base is coupled to the network interface device.

### Claim 32 (depends on 18)

The network interface device of claim 18, wherein the policy action is selected from the group consisting of: allow, block, rate-limit, mark and alert.

### Claim 33 (depends on 18)

The network interface device of claim 18, wherein the second security attribute comprises a security group the destination IP address is associated therewith.