# US 2021/0243159 A1 · Persistent device identifier driven compromised device quarantine > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0243159 A1 - Document ID: US20210243159A1 - Status: Published application - Kind: A1 - Application number: 16/776,887 - Filed: 2020-01-30 - Published: 2021-08-05 - Earliest claimed: 2020-01-30 - Assignees: Palo Alto Networks, Inc. - Applicants: Palo Alto Networks, Inc. - Inventors: Li Meng; Sarveshwar Meta Rao; Soundarya Sivaramakrishnan; Xin Yao - Web page: https://patentgrep.com/patent/US20210243159A1 ## CPC - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 61/103: across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP] - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/0254: {Stateful filtering} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G16Y 30/10: Security thereof - H04L 63/0272: {Virtual private networks} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G16Y: INFORMATION AND COMMUNICATION TECHNOLOGY SPECIALLY ADAPTED FOR THE INTERNET OF THINGS [IoT] ## Abstract Leveraging non-transient or persistent device identifiers to enforce device quarantine instead of IP addresses) accommodates the transient associations of IP addresses to devices without compromising the effectiveness of quarantine. When a device has been determined to be compromised and is quarantined, the quarantine of the device is enforced using the IP address of the device. However, IP address assignment is transient. With each connection, a device can be assigned a different IP address. After a connection is established, a gateway can collect a device identifying value(s) that persists across network connections (e.g., host identifier (hostid) and device serial number). With a persistent device identifier, a quarantine list can be enforced in a data/forwarding plane regardless of a compromised device being assigned different network addresses. ## Claims ### Claim 1 A method comprising: determining a plurality of identifiers of a first device connecting to a network via an intermediary network device, wherein the plurality of identifiers at least include a first transient identifier that can change across network connections and a first persistent identifier that persists across network connections; based on a determination that the first persistent identifier is indicated in a first structure for quarantining compromised devices, determining whether the first device is indicated as compromised in the first structure; based on a determination that the first device is indicated as compromised, determining whether the first transient identifier is already associated with the first persistent identifier for the first device; and based on a determination that the first persistent identifier is associated with a different transient identifier for the first device in the first structure and that the first device is indicated as compromised in the first structure, updating a second structure in a data plane of the intermediary device with the first transient identifier, wherein the data plane enforces quarantine of packets with the second structure. ### Claim 2 (depends on 1) The method of claim 1 further comprising: based on a determination that the first persistent identifier is associated with a different transient identifier for the first device in the first structure and that the first device is not indicated as compromised in the first structure, updating the first structure to associate the first persistent identifier with the first transient identifier instead of the different transient identifier; and updating a batch of updates for deferred communication with the update of association of the first persistent identifier with the first transient identifier. ### Claim 3 (depends on 2) The method of claim 2 further comprising: determining whether a condition to communicate the batch of updates is satisfied; and based on a determination that the condition is satisfied, communicating to a second intermediary device that enforces quarantine of compromised devices the batch of updates as updated with the update of association of the first persistent identifier with the first transient identifier. ### Claim 4 (depends on 1) The method of claim 1 further comprising communicating the update of association of the first persistent identifier with the first transient identifier to a second intermediary device that enforces quarantine of compromised devices. ### Claim 5 (depends on 1) The method of claim 1 further comprising: detecting that a compromised state of a second device has changed; updating the first structure to indicate the changed compromised state of the second device; and updating the second structure in the data plane to indicate the changed state for the second device. ### Claim 6 (depends on 5) The method of claim 5, wherein the changed compromised state is from not compromised to compromised and updating the second structure comprises determining a current transient identifier assigned to the second device and updating the second structure to indicate the current transient identifier assigned to the second device. ### Claim 7 (depends on 5) The method of claim 5, wherein the changed compromised state is from compromised to not compromised and updating the second structure comprises determining a current transient identifier assigned to the second device and removing from the second structure the current transient identifier assigned to the second device. ### Claim 8 (depends on 1) The method of claim 1 further comprising maintaining the first structure in a control plane of the intermediary device. ### Claim 9 (depends on 1) The method of claim 1, wherein the first transient identifier is a network address and the first persistent identifier is one of a devid and a hostid. ### Claim 10 A non-transitory, machine-readable medium having stored thereon program code to: collect device identifiers of devices based on the devices connecting to a network; maintain mappings of the device identifiers to corresponding network addresses of the devices that connect to the network, wherein the program code to maintain mappings comprises program code to update the mappings to indicate changes in assignments of network addresses to devices; set state indicators of whether devices are compromised or not compromised in association with the device identifiers in the mappings; propagate, to security devices of the network, changes in mappings based on changes in the network address assignments; and propagate, from a control plane to a data plane, changes in state indicators and changes in assignments of network addresses. ### Claim 11 (depends on 10) The non-transitory, machine-readable medium of claim 10, further comprising program code to propagate changes in state indicators to security devices of the network, wherein the program code to propagate the changes in state indicators to security devices uses the device identifiers. ### Claim 12 (depends on 10) The non-transitory, machine-readable medium of claim 10, wherein the program code to collect device identifiers comprises program code to collect device identifiers that persist across connections or session from headers of packets or messages corresponding to establishing a connection or session. ### Claim 13 (depends on 10) The non-transitory, machine-readable medium of claim 10, wherein the program code to propagate changes in assignments of network addresses from the control plane to the data plane comprises program code to determine whether a change in mapping occurs for a device indicated as compromised and to update the data plane identify the compromised device for quarantine with a currently assigned network address instead of a previously assigned network address. ### Claim 14 An apparatus comprising: a processor; a data plane; and a machine-readable medium having instructions stored thereon that are executable by the processor to cause the apparatus to, determine a plurality of identifiers of a first device connecting to a network via the apparatus, wherein the plurality of identifiers at least includes a first transient identifier that can change across network connections and a first persistent identifier that persists across network connections; based on a determination that the first persistent identifier is indicated in a first structure in a control plane, determine whether the first device is indicated as compromised in the first structure and whether the first persistent identifier for the first device is associated in the first structure with a different transient identifier; and based on a determination that the first persistent identifier is associated with a different transient identifier for the first device in the first structure and that the first device is indicated as compromised in the first structure, update a second structure in the data plane with the first transient identifier, wherein the data plane enforces quarantine of packets with the second structure. ### Claim 15 (depends on 14) The apparatus of claim 14, wherein the machine-readable medium further comprises instructions executable by the processor to cause the apparatus to: based on a determination that the first persistent identifier is associated with a different transient identifier for the first device in the first structure and that the first device is not indicated as compromised in the first structure, update the first structure to associate the first persistent identifier with the first transient identifier instead of the different transient identifier. ### Claim 16 (depends on 15) The apparatus of claim 15, wherein the machine-readable medium further comprises instructions executable by the processor to cause the apparatus to: update a batch of updates for deferred communication with the update of association of the first persistent identifier with the first transient identifier; determine whether a condition to communicate the batch of updates is satisfied; and based on a determination that the condition is satisfied, communicate to an intermediary network device that enforces quarantine of compromised devices the batch of updates as updated with the update of association of the first persistent identifier with the first transient identifier. ### Claim 17 (depends on 14) The apparatus of claim 14, wherein the machine-readable medium further comprises instructions executable by the processor to cause the apparatus to communicate the update of association of the first persistent identifier with the first transient identifier to an intermediary network device that enforces quarantine of compromised devices. ### Claim 18 (depends on 14) The apparatus of claim 14, wherein the machine-readable medium further comprises instructions executable by the processor to cause the apparatus to: based on a notification that a compromised state of a second device has changed, update the first structure to indicate the changed compromised state of the second device; and update the second structure in the data plane to indicate the changed state for the second device. ### Claim 19 (depends on 18) The apparatus of claim 18, wherein the changed compromised state is from not compromised to compromised and the instructions to update the second structure comprise instructions to determine a current transient identifier assigned to the second device and to update the second structure to indicate the current transient identifier assigned to the second device. ### Claim 20 (depends on 18) The apparatus of claim 18, wherein the changed compromised state is from compromised to not compromised and the instructions to update the second structure comprise instructions to determine a current transient identifier assigned to the second device and to remove from the second structure the current transient identifier assigned to the second device.