# US 12,224,986 B2 · System and method for firewall policy rule management > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,224,986 B2 - Document ID: US12224986B2 - Status: Granted - Kind: B2 - Application number: 18/461,417 - Filed: 2023-09-05 - Published: 2025-01-02 - Granted: 2025-02-11 - Earliest claimed: 2023-06-29 - Assignees: Morgan Stanley Services Group Inc. - Applicants: Morgan Stanley Services Group Inc. - Inventors: Hongliang Wang; Jack Suzuki; Jun Wu; Rongfeng Zhou - Web page: https://patentgrep.com/patent/US12224986B2 ## CPC - H04L 63/0263: {Rule management} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system and method may update network policies by determining, among a set of hosts, a subset of hosts to have network policies updated; for each host in the subset of hosts, determining a set of policies relevant to the host; and for each of the subset of hosts, installing the set of policies relevant to the host. The subset of hosts may be determined based on a category or division such as the time zone corresponding to the location of each host in the subset of hosts. The policies relevant to the host may be received from a database and saved to a file with the set of policies relevant to the host; the host may then access the file. ## Claims ### Claim 1 A method for updating network policies, the method comprising: determining, from a set of hosts, a subset of hosts to have network policies updated; for each host in the subset of hosts, a calculator service among a plurality of calculator services determining a set of policies relevant to the host, the policies relevant to the host indexed with the hostname for the host; wherein determining a set of policies relevant to a host comprises: a calculator service from the plurality of calculator services receiving, from a database, a set of policies relevant to the host and producing a file with the set of policies relevant to the host, the calculator services operating at overlapping time periods, the plurality of calculator services producing a plurality of files; and for each of the subset of hosts, installing, using a process different from a calculator service, from the file with the set of policies relevant to the host, the set of policies relevant to the host. ### Claim 2 (depends on 1) The method of claim 1, wherein the subset of hosts is determined based on the time zone corresponding to the location of each host in the subset of hosts. ### Claim 3 (depends on 1) The method of claim 1, wherein the identities of the subset of hosts to have network policies updated are communicated, via a message bus, to a plurality of processes operating to determine a set of policies. ### Claim 4 (depends on 1) The method of claim 1, wherein each policy determines whether a host is prevented or allowed to connect to another host. ### Claim 5 (depends on 1) The method of claim 1, wherein each host accesses the file with the set of policies relevant to the host via a reader process. ### Claim 6 A system for updating network policies, the system comprising: at least one memory; and a plurality of processors, wherein: at least one processor among the plurality of processors is configured to determine, from a set of hosts, a subset of hosts to have network policies updated; a calculator service, among a plurality of calculator services, and executed by at least one processor among the plurality of processors, is to determine a set of policies relevant to the host, the policies relevant to the host indexed with the hostname for the host; wherein determining a set of policies relevant to a host comprises: a calculator service from the plurality of calculator services receiving, from a database, a set of policies relevant to the host and producing a file with the set of policies relevant to the host, the calculator services operating at overlapping time periods, the plurality of calculator services producing a plurality of files; and at least one processor among the plurality of processors is configured to install, using a process different from a calculator service, from the file with the set of policies relevant to the host, a set of policies relevant to a host. ### Claim 7 (depends on 6) The system of claim 6, wherein the subset of hosts is determined based on the time zone corresponding to the location of each host in the subset of hosts. ### Claim 8 (depends on 6) The system of claim 6, wherein the identities of the subset of hosts to have network policies updated are communicated, via a message bus, to a plurality of processes operating to determine a set of policies. ### Claim 9 (depends on 6) The system of claim 6, wherein each policy determines whether a host is prevented or allowed to connect to another host. ### Claim 10 A method for updating network policies, the method comprising: determining a subset of hosts to have network policies updated; for each host in the subset of hosts, a calculator service among a plurality of calculator services receiving from a database a set of policies relevant to the host, the policies relevant to the host indexed with the hostname for the host, the calculator service for each host in the subset of hosts storing in a file a set of policies relevant to the host, the calculator services operating at overlapping time periods, the plurality of calculator services producing a plurality of files; and for each of the subset of hosts, installing, using a process different from a calculator service, from the file with the set of policies relevant to the host, the set of policies relevant to the host. ### Claim 11 (depends on 10) The method of claim 10, wherein the subset of hosts is determined based on the time zone corresponding to the location of each host in the subset of hosts. ### Claim 12 (depends on 10) The method of claim 10, wherein the identities of the subset of hosts to have network policies updated are communicated, via a message bus, to a plurality of processes operating to determine a set of policies for each host in the subset. ### Claim 13 (depends on 10) The method of claim 10, wherein each policy determines whether a host is prevented or allowed to connect to another host.