# US 12,225,058 B2 · Systems and methods for security policy organization using a dual bitmap > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,225,058 B2 - Document ID: US12225058B2 - Status: Granted - Kind: B2 - Application number: 18/620,080 - Filed: 2024-03-28 - Published: 2024-07-18 - Granted: 2025-02-11 - Earliest claimed: 2022-03-01 - Assignees: Fortinet, Inc. - Applicants: Fortinet, Inc. - Inventors: Shushan Wen; John Cortes; Zhi Guo - Web page: https://patentgrep.com/patent/US12225058B2 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/0263: {Rule management} - H04L 63/104: {Grouping of entities} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems, devices, and methods for correlating security policies to received packets are provided. In one example, a network device, maintains information regarding multiple security policies within a dual bitmap based search tree including a first bitmap and a second bitmap formatted as information embedded in a node structure. A packet is received by the network. A first field of the packet is compared with a first range, corresponding to a first bit location in the first bitmap in which the first bit location in the first bitmap is associated with at least a first security policy. After determining the first field is within the first range, the network device accesses a second bit location in the second bitmap, corresponding to the first bit location. Based at least in part upon a value in the second bit location, a set of one or more security policies are applied to the packet. ## Claims ### Claim 1 A method comprising: maintaining, by a network device, information regarding a plurality of security policies within a dual bitmap based search tree in which a first bitmap and a second bitmap are formatted as information embedded in a node structure in the dual bitmap based search tree; receiving, by the network device, a packet; comparing, by the network device, at least a portion of a first field of the packet with a first range, where the first range corresponds to a first bit location in the first bitmap, and wherein the first bit location in the first bitmap is associated with at least a first security policy of the plurality of security policies; after determining the at least a portion of the first field is within the first range, accessing, by the network device, a second bit location in the second bitmap, wherein the second bit location in the second bitmap corresponds to the first bit location in the first bitmap; and based at least in part upon a value in the second bit location in the second bitmap, applying, by the network device, a set of one or more security policies of the plurality of security policies to the packet. ### Claim 2 (depends on 1) The method of claim 1, wherein the first field comprises an Internet Protocol (IP) source address, an IP destination address, a protocol number, a source port number, or a destination port number. ### Claim 3 (depends on 1) The method of claim 1, wherein said comparing involves comparing a segment of a plurality of segments into which the first field has been cut to the first range. ### Claim 4 (depends on 3) The method of claim 3, wherein the plurality of segments are of random segment sizes or a size of the plurality of segments is defined by a power-of-two partitioning. ### Claim 5 (depends on 1) The method of claim 1, wherein the first bitmap is less than or equal to 33 bits and the second bitmap is less than or equal to 32 bits. ### Claim 6 A network device comprising: one or more processing resources; and instructions that when executed by the one or more processing resources cause the network device to: maintain information regarding a plurality of security policies within a dual bitmap based search tree in which a first bitmap and a second bitmap are formatted as information embedded in a node structure in the dual bitmap based search tree; receive a packet; compare at least a portion of a first field of the packet with a first range, where the first range corresponds to a first bit location in the first bitmap, and wherein the first bit location in the first bitmap is associated with at least a first security policy of the plurality of security policies; after determining the at least a portion of the first field is within the first range, access a second bit location in the second bitmap, wherein the second bit location in the second bitmap corresponds to the first bit location in the first bitmap; and based at least in part upon a value in the second bit location in the second bitmap, apply a set of one or more security policies of the plurality of security policies to the packet. ### Claim 7 (depends on 6) The network device of claim 6, wherein the first field comprises an Internet Protocol (IP) source address, an IP destination address, a protocol number, a source port number, or a destination port number. ### Claim 8 (depends on 6) The network device of claim 6, wherein comparing the at least the portion of the first field with the first range involves comparing a segment of a plurality of segments into which the first field has been cut to the first range. ### Claim 9 (depends on 8) The network device of claim 8, wherein the plurality of segments are of random segment sizes or a size of the plurality of segments is defined by a power-of-two partitioning. ### Claim 10 (depends on 6) The network device of claim 6, wherein the network device comprises a network security device. ### Claim 11 (depends on 6) The network device of claim 6, in which a processing resource of the one or more processing resources comprises a hardware acceleration circuit and wherein comparing the at least the portion of the first field with the first range is performed by the hardware acceleration circuit. ### Claim 12 (depends on 6) The network device of claim 6, wherein application of the set of security policies to the packet results in a packet disposition including one of dropping the packet, reporting the packet to another entity for further investigation, and forwarding the packet to a destination address associated with the packet. ### Claim 13 (depends on 6) The network device of claim 6, wherein the first bitmap is less than or equal to 33 bits and the second bitmap is less than or equal to 32 bits. ### Claim 14 A non-transitory computer readable medium having stored therein instructions that when executed by one or more processing resources of a network device, cause the network device to: maintain information regarding a plurality of security policies within a dual bitmap based search tree in which a first bitmap and a second bitmap are formatted as information embedded in a node structure in the dual bitmap based search tree; receive a packet; compare at least a portion of a first field of the packet with a first range, where the first range corresponds to a first bit location in the first bitmap, and wherein the first bit location in the first bitmap is associated with at least a first security policy of the plurality of security policies; after determining the at least a portion of the first field is within the first range, access a second bit location in the second bitmap, wherein the second bit location in the second bitmap corresponds to the first bit location in the first bitmap; and based at least in part upon a value in the second bit location in the second bitmap, apply a set of one or more security policies of the plurality of security policies to the packet. ### Claim 15 (depends on 14) The non-transitory computer readable medium of claim 14, wherein the first field comprises an Internet Protocol (IP) source address, an IP destination address, a protocol number, a source port number, or a destination port number. ### Claim 16 (depends on 14) The non-transitory computer readable medium of claim 14, wherein comparing the at least the portion of the first field with the first range involves comparing a segment of a plurality of segments into which the first field has been cut to the first range. ### Claim 17 (depends on 16) The non-transitory computer readable medium of claim 16, wherein the plurality of segments are of random segment sizes or a size of the plurality of segments is defined by a power-of-two partitioning. ### Claim 18 (depends on 14) The non-transitory computer readable medium of claim 14, wherein the network device comprises a network security device. ### Claim 19 (depends on 14) The non-transitory computer readable medium of claim 14, in which a processing resource of the one or more processing resources comprises a hardware acceleration circuit and wherein comparing the at least the portion of the first field with the first range is performed by the hardware acceleration circuit. ### Claim 20 (depends on 14) The non-transitory computer readable medium of claim 14, wherein application of the set of security policies to the packet results in a packet disposition including one of dropping the packet, reporting the packet to another entity for further investigation, and forwarding the packet to a destination address associated with the packet.