# US 12,192,176 B2 · Cloud based platform to efficiently manage firewall rules and data traffic > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,176 B2 - Document ID: US12192176B2 - Status: Granted - Kind: B2 - Application number: 17/938,697 - Filed: 2022-10-07 - Published: 2023-04-20 - Granted: 2025-01-07 - Earliest claimed: 2021-10-18 - Assignees: Honeywell International Inc. - Applicants: Honeywell International Inc. - Inventors: Ajay Verma; Amod Kamat; William Smith; Daniel P. Giorgis; Hugh Eaves; Michael Smith; Patrick Sager; Upender Paravastu - Web page: https://patentgrep.com/patent/US12192176B2 ## CPC - H04L 63/0263: {Rule management} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/0272: {Virtual private networks} - H04L 63/0281: {Proxies} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Various embodiments described herein relate to a virtual network with a cloud-based server, cloud-based firewall and a cloud-based service. The cloud-based server is in communication with a client installed on a gateway to receive an encapsulated IP data packet from one or more applications installed on the gateway. The cloud-based configured to decapsulate the encapsulated IP data packet verify a security certificate based on a first information and configure a cloud-based firewall based on a second information. The cloud-based server is configured to route the one or more IP data packets to the cloud-based firewall for processing each IP data packet based on the second information. In response to the one or more IP data packets being compliant with the first information provided to authenticate the gateway and the second information provided to configure the cloud-based firewall, routing the one or more IP data packets to the cloud-based service. ## Claims ### Claim 1 A method comprising: receiving, by a cloud server with one or more processors, an encapsulated IP data packet from one or more applications installed on a gateway device, wherein the one or more applications request access to a cloud-based service; decapsulating, by the cloud server with the one or more processors, the encapsulated IP data packet from the gateway device to retrieve one or more IP data packets wrapped within the encapsulated IP data packet; verifying, by the cloud server with the one or more processors, a security certificate of the gateway device based on a first information from at least one of the one or more IP data packets; configuring, by the cloud server with the one or more processors, a cloud-based firewall based on a second information from the one or more applications; routing, by the cloud server with the one or more processors, the one or more IP data packets to the cloud-based firewall for processing each IP data packet based on the second information; and wherein in response to the one or more IP data packets being compliant with the first information provided to authenticate the gateway device and the second information provided to configure the cloud-based firewall, routing, by the cloud server with the one or more processors, the one or more IP data packets via a cloud communication network protocol to the cloud-based service. ### Claim 2 (depends on 1) The method of claim 1, wherein the first information is a request for a valid, new or updated identity certificates for the gateway device which is wrapped as a part of the encapsulated IP data packet. ### Claim 3 (depends on 1) The method of claim 1, wherein the second information is indicative of the firewall rules/policies for each application or the gateway device. ### Claim 4 (depends on 1) The method of claim 1, further comprises: routing, by the cloud server with the one or more processors, the first information to a virtual admin portal to retrieve the security certificate of the gateway device. ### Claim 5 (depends on 1) The method of claim 1, further comprises: automatically revoking, by the cloud server with the one or more processors, a previously issued security certificate when a new security certificate is issued by a virtual admin portal. ### Claim 6 (depends on 1) The method of claim 1, further comprises: retrieving, by the cloud-based server with the one or more processors from a virtual admin portal, a client configuration in response to the first information, wherein the first information is indicative of a new gateway device connected to the cloud server. ### Claim 7 A virtual cloud-based networking platform comprising: a cloud-based admin portal to manage a set of security services for gateway devices; a virtual database; one or more cloud-based servers with one or more processors communicably connected to the cloud-based admin portal and the virtual database, wherein the one or more processors configured to: receive an encapsulated data packet from a gateway device installed in an organization network, wherein the organization network comprises one or more hardware devices and applications transmitting one or more data packets to the gateway device, wherein the one or more data packets comprise a request to access one or more cloud-based services; decapsulate the encapsulated data packet from the gateway device to retrieve the one or more data packets wrapped within the encapsulated data packet; verify a security certificate of the gateway device by accessing the cloud-based admin portal, wherein the security certificate is issued by the cloud-based admin portal to validate an identity of a client on the gateway device; configure a cloud-based firewall based on a second information hosted by the virtual database; and process the one or more data packets based on the second information, wherein in response to the one or more data packets being compliant with the second information, route the one or more data packets via a cloud communication network protocol to the one or more cloud-based service. ### Claim 8 (depends on 7) The virtual cloud-based networking platform of claim 7, wherein the security certificate is one of a Bootstrap certificate or a OpenVPN certificate issued for a one of a new OpenVPN client or an existing OpenVPN client installed on the gateway device. ### Claim 9 (depends on 7) The virtual cloud-based networking platform of claim 7, wherein the second information is indicative of the network rules/policies for each application or the gateway device. ### Claim 10 (depends on 7) The virtual cloud-based networking platform of claim 7, wherein the second information is one of embedded as an additional file in the one or more applications or stored in the form of lookup tables in the virtual database. ### Claim 11 (depends on 7) The virtual cloud-based networking platform of claim 7, wherein the cloud-based admin portal comprises a firewall Configuration Service hosted as an application programming interface (API) through which the firewall rules or policies are administered by the cloud-based admin portal. ### Claim 12 A system comprising: a virtual client with one or more processors communicably connected to a virtual server, wherein the one or more processors configured to: receive one or more data packets from one or more applications installed on a gateway device installed in an organization network, wherein the organization network comprises one or more hardware devices and applications transmitting one or more data packets, wherein the one or more data packets comprise a request to access one or more cloud-based services; encapsulate the one or more data packets into an encapsulated data packet; and route the encapsulated data packet through a virtual tunnel interface to the virtual server; the virtual server with one or more processors communicably connected to a cloud-based admin portal and a virtual database, wherein the one or more processors configured to: receive the encapsulated data packet from the virtual client through the virtual tunnel interface in a data format compatible with a cloud-based firewall; decapsulate the encapsulated data packet to retrieve the one or more data packets wrapped within the encapsulated data packet; verify a security certificate of the gateway device by accessing the cloud-based admin portal, wherein the security certificate is issued by the cloud-based admin portal to validate an identity of the virtual client on the gateway device; configure the cloud-based firewall based on a second information hosted by the virtual database; and process the one or more data packets based on the second information, wherein in response to the one or more data packets being compliant with the second information, route the one or more data packets via a cloud communication network protocol to the one or more cloud-based service. ### Claim 13 (depends on 12) The system of claim 12, further comprises: a Domain Name System (DNS) server configured to maintain a track of IP address of the gateway device with a hostname and a destination IP address of the cloud-based service requested by each application on the gateway device. ### Claim 14 (depends on 12) The system of claim 12, further comprises: an organization's firewall configured with a single firewall exception in the form of a URL to redirect the encapsulated data packet to the virtual server. ### Claim 15 (depends on 12) The system of claim 12, wherein the virtual tunnel interface communicates the encapsulated data packet to the virtual server through one of a TLS-over-TCP connection or HTTP connection. ### Claim 16 A gateway device installed in a networking environment comprising: a first client to route a first data traffic from one or more applications installed at the gateway device to a data packet wrapper, wherein the first data traffic is indicative of a request to access one or more cloud services; a second client to route a second data traffic to the data packet wrapper, wherein the second traffic is indicative of a request for one of new or updated security certificates for the first client; the data packet wrapper to encapsulate the first data traffic and the second data traffic into a single data packet; and a user defined tunnel to communicate the single data packet to a cloud-based server in a protocol compatible with a cloud-based firewall, wherein the single data packet is communicated to the cloud-based server through one of a TLS-over-TCP connection or HTTP connection. ### Claim 17 (depends on 16) The gateway device of claim 16, wherein the first client is an Open VPN client and the second client is a Simple Connect client. ### Claim 18 (depends on 16) The gateway device of claim 16, wherein the protocol compatible with the cloud-based firewall is a TLS protocol. ### Claim 19 (depends on 16) The gateway device of claim 16, wherein the user defined tunnel is an OpenVPN tunnel. ### Claim 20 (depends on 16) The gateway device of claim 16, wherein an IP address of the single data packet is modified using a network address translation (NAT).