# US 12,113,772 B2 · Cyber protections of remote networks via selective policy enforcement at a central network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,113,772 B2 - Document ID: US12113772B2 - Status: Granted - Kind: B2 - Application number: 18/368,831 - Filed: 2023-09-15 - Published: 2024-01-04 - Granted: 2024-10-08 - Earliest claimed: 2019-07-03 - Assignees: Centripetal Networks, Inc. - Applicants: Centripetal Networks, LLC - Inventors: Sean Moore; Peter P. Geremia - Web page: https://patentgrep.com/patent/US12113772B2 ## CPC - H04L 63/0245: {Filtering by information in the payload} - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L 12/66: Arrangements for connecting between networks having differing types of switching systems, e.g. gateways - H04L 63/0254: {Stateful filtering} - H04L 63/0263: {Rule management} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An enterprise organization may operate a central network and one or more remote networks, each comprising a plurality of computing devices. For protection against malicious actors, the central network may be configured to filter network traffic associated with the computing devices based on identified threats. Traffic corresponding to computing devices connected to the remote network may be tunneled to the central network for filtering by the central network. A tunnel gateway device, associated with the remote network, may efficiently identify which communications are associated with Internet threats, and tunnel such identified traffic to the central network, where actions may be taken to protect the enterprise network. ## Claims ### Claim 1 A method for selectively filtering traffic of a remote network by tunneling portions of that traffic to a central network to be filtered by the central network, the method comprising: receiving, by a security policy management server at the central network, threat information from a plurality of different independent cyber threat intelligence providers; generating, by the security policy management server and based on the threat information, a plurality of packet filtering rules of a security policy, wherein each of the plurality of packet filtering rules of the security policy comprises one or more packet matching criteria and corresponding rule actions to take on packets matching the packet matching criteria; generating, by the security policy management server, a policy probabilistic data structure that represents each of the plurality of packet filtering rules of the security policy; sending, by the security policy management server and to a remote network tunnel gateway at the remote network, the policy probabilistic data structure; receiving, from the remote network tunnel gateway and via a tunnel between the remote network and the central network, a packet, wherein the remote network tunnel gateway sent the packet via the tunnel based on a determination that a first packet matching criterion of the packet was represented in the policy probabilistic data structure; and filtering the packet based on the plurality of packet filtering rules of the security policy, wherein filtering the packet based on the plurality of packet filtering rules of the security policy comprises filtering the pack et in accordance with one or more rule actions. ### Claim 2 (depends on 1) The method of claim 1, further comprising: generating a new policy probabilistic data structure based on an update to the plurality of packet filtering rules of the security policy; and sending, by the security policy management server and to the remote network tunnel gateway at the remote network, the new policy probabilistic data structure. ### Claim 3 (depends on 1) The method of claim 1, further comprising: generating, by the security policy management server, a different policy probabilistic data structure that represents each of a different plurality of packet filtering rules of a different security policy; and sending, by the security policy management server and to a second remote network tunnel gateway, the different policy probabilistic data structure. ### Claim 4 (depends on 1) The method of claim 1, wherein filtering the packet comprises: preventing the packet from proceeding to its intended destination. ### Claim 5 (depends on 1) The method of claim 1, wherein the policy probabilistic data structure is one of: a Bloom filter; a blocked Bloom filter; a Cuckoo filter; or an xor filter. ### Claim 6 (depends on 1) The method of claim 1, wherein the packet originated in the remote network. ### Claim 7 A security policy management server at a central network and configured to selectively filter traffic of a remote network by tunneling portions of that traffic to a central network to be filtered by the central network, the security policy management server comprising: one or more processors; and memory storing instructions that, when executed by the one or more processors, cause the security policy management server to: receive threat information from a plurality of different independent cyber threat intelligence providers; generate, based on the threat information, a plurality of packet filtering rules of a security policy, wherein each of the plurality of packet filtering rules of the security policy comprises one or more packet matching criteria and corresponding rule actions to take on packets matching the packet matching criteria; generate a policy probabilistic data structure that represents each of the plurality of packet filtering rules of the security policy; send, to a remote network tunnel gateway at the remote network, the policy probabilistic data structure; receive, from the remote network tunnel gateway and via a tunnel between the remote network and the central network, a packet, wherein the remote network tunnel gateway sent the packet via the tunnel based on a determination that a first packet matching criterion of the packet was represented in the policy probabilistic data structure; and filter the packet based on the plurality of packet filtering rules of the security policy by filtering the packet in accordance with one or more rule actions. ### Claim 8 (depends on 7) The security policy management server of claim 7, wherein the instructions, when executed by the one or more processors, cause the security policy management server to: generate a new policy probabilistic data structure based on an update to the plurality of packet filtering rules of the security policy; and send, by the security policy management server and to the remote network tunnel gateway at the remote network, the new policy probabilistic data structure. ### Claim 9 (depends on 7) The security policy management server of claim 7, wherein the instructions, when executed by the one or more processors, cause the security policy management server to: generate a different policy probabilistic data structure that represents each of a different plurality of packet filtering rules of a different security policy; and send, to a second remote network tunnel gateway, the different policy probabilistic data structure. ### Claim 10 (depends on 7) The security policy management server of claim 7, wherein the instructions, when executed by the one or more processors, cause the security policy management server to filter the packet by causing the security policy management server to: prevent the packet from proceeding to its intended destination. ### Claim 11 (depends on 7) The security policy management server of claim 7, wherein the policy probabilistic data structure is one of: a Bloom filter; a blocked Bloom filter; a Cuckoo filter; or an xor filter. ### Claim 12 (depends on 7) The security policy management server of claim 7, wherein the packet originated in the remote network. ### Claim 13 One or more non-transitory computer-readable media storing instructions that, when executed by one or more processors of a security policy management server at a central network, cause the security policy management server to selectively filter traffic of a remote network by tunneling portions of that traffic to a central network to be filtered by the central network by causing the security policy management server to: receive threat information from a plurality of different independent cyber threat intelligence providers; generate, based on the threat information, a plurality of packet filtering rules of a security policy, wherein each of the plurality of packet filtering rules of the security policy comprises one or more packet matching criteria and corresponding rule actions to take on packets matching the packet matching criteria; generate a policy probabilistic data structure that represents each of the plurality of packet filtering rules of the security policy; send, to a remote network tunnel gateway at the remote network, the policy probabilistic data structure; receive, from the remote network tunnel gateway and via a tunnel between the remote network and the central network, a packet, wherein the remote network tunnel gateway sent the packet via the tunnel based on a determination that a first packet matching criterion of the packet was represented in the policy probabilistic data structure; and filter the packet based on the plurality of packet filtering rules of the security policy by filtering the packet in accord with one or more rule actions. ### Claim 14 (depends on 13) The one or more non-transitory computer-readable media of claim 13, wherein the instructions, when executed by the one or more processors, cause the security policy management server to: generate a new policy probabilistic data structure based on an update to the plurality of packet filtering rules of the security policy; and send, by the security policy management server and to the remote network tunnel gateway at the remote network, the new policy probabilistic data structure. ### Claim 15 (depends on 13) The one or more non-transitory computer-readable media of claim 13, wherein the instructions, when executed by the one or more processors, cause the security policy management server to: generate a different policy probabilistic data structure that represents each of a different plurality of packet filtering rules of a different security policy; and send, to a second remote network tunnel gateway, the different policy probabilistic data structure. ### Claim 16 (depends on 13) The one or more non-transitory computer-readable media of claim 13, wherein the instructions, when executed by the one or more processors, cause the security policy management server to filter the packet by causing the security policy management server to: prevent the packet from proceeding to its intended destination. ### Claim 17 (depends on 13) The one or more non-transitory computer-readable media of claim 13, wherein the policy probabilistic data structure is one of: a Bloom filter; a blocked Bloom filter; a Cuckoo filter; or an xor filter.