Cyber protections of remote networks via selective policy enforcement at a central network

A security policy management server at a central network and configured to selectively filter traffic of a remote network by tunneling portions of that traffic to a central network to be filtered by the central network, the security policy management server comprising:

• one or more processors;
• and
• memory storing instructions that, when executed by the one or more processors, cause the security policy management server to:
• receive threat information from a plurality of different independent cyber threat intelligence providers;
• generate, based on the threat information, a plurality of packet filtering rules of a security policy, wherein each of the plurality of packet filtering rules of the security policy comprises one or more packet matching criteria and corresponding rule actions to take on packets matching the packet matching criteria;
• generate a policy probabilistic data structure that represents each of the plurality of packet filtering rules of the security policy;
• send, to a remote network tunnel gateway at the remote network, the policy probabilistic data structure;
• receive, from the remote network tunnel gateway and via a tunnel between the remote network and the central network, a packet, wherein the remote network tunnel gateway sent the packet via the tunnel based on a determination that a first packet matching criterion of the packet was represented in the policy probabilistic data structure;
• and
• filter the packet based on the plurality of packet filtering rules of the security policy by filtering the packet in accordance with one or more rule actions.

One or more non-transitory computer-readable media storing instructions that, when executed by one or more processors of a security policy management server at a central network, cause the security policy management server to selectively filter traffic of a remote network by tunneling portions of that traffic to a central network to be filtered by the central network by causing the security policy management server to:

• receive threat information from a plurality of different independent cyber threat intelligence providers;
• generate, based on the threat information, a plurality of packet filtering rules of a security policy, wherein each of the plurality of packet filtering rules of the security policy comprises one or more packet matching criteria and corresponding rule actions to take on packets matching the packet matching criteria;
• generate a policy probabilistic data structure that represents each of the plurality of packet filtering rules of the security policy;
• send, to a remote network tunnel gateway at the remote network, the policy probabilistic data structure;
• receive, from the remote network tunnel gateway and via a tunnel between the remote network and the central network, a packet, wherein the remote network tunnel gateway sent the packet via the tunnel based on a determination that a first packet matching criterion of the packet was represented in the policy probabilistic data structure;
• and
• filter the packet based on the plurality of packet filtering rules of the security policy by filtering the packet in accord with one or more rule actions.