# US 2021/0243605 A1 · Firewall discovery and management

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2021/0243605 A1
- Document ID: US20210243605A1
- Status: Published application
- Kind: A1
- Application number: 16/779,226
- Filed: 2020-01-31
- Published: 2021-08-05
- Earliest claimed: 2020-01-31
- Assignees: salesforce.com, inc.
- Applicants: salesforce.com, inc.
- Inventors: Ramesh RAMANI; Anurag Bhatt
- Web page: https://patentgrep.com/patent/US20210243605A1

## CPC

- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- G06F 12/0804: with main memory updating (G06F12/0806 takes precedence)
- H04L 41/0813: characterised by the conditions triggering a change of settings
- H04L 41/28: Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
- H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)}
- H04W 12/06: Authentication
- H04W 12/088: using filters or firewalls
- H04W 12/71: Hardware identity
- G06F 2212/601: Reconfiguration of cache memory
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)

## Abstract

Updating firewalls can be difficult if many devices need to be manually reconfigured. To assist, vendors provide management tools. If the tool requires manual adding/deleting known firewalls, this is problematic in networks with many devices. If devices are hosted within a virtual private cloud, the tool may adopt a centralized “star” configuration and maintain live contact with all firewalls. This exposes firewalls to risk if the central tool is compromised. An alternative to a central tool is to implement a tool local to an environment, secure the tool with multi-level authentication, and provide automatic active firewall discovery, e.g., automate adding/deleting firewalls in an environment defined with respect to criteria that may be used to define a collection of active firewalls. Configuration changes may be pushed to the collection. Authentication credentials to access the firewalls are ephemerally cached and flushed after use so the tool cannot be compromised.

## Claims

### Claim 1

A method for a mobile device to collectively manage a collection of devices associated with an environment including devices, the method comprising:
receiving an identifier corresponding to a first device of the environment;
automatically determining the collection of devices based at least in part on a search for the identifier in the environment;
providing a first credential to a selected device of the collection of devices to enable reconfiguring the selected device;
caching the first credential in an ephemeral memory;
applying a new configuration to the selected device; and
flushing the ephemeral memory.

### Claim 2 (depends on 1)

The method of claim 1, in which the first credential includes an access authentication credential, the method further comprising:
providing a second credential to a cloud service; and
receiving a list of known devices including the collection of devices.

### Claim 3 (depends on 2)

The method of claim 2, further comprising:
prompting for the second credential;
caching the second credential in the ephemeral memory; and
flushing the one or more key from the transitory memory.

### Claim 4 (depends on 1)

The method of claim 1, in which determining the collection of devices comprises:
receiving a list of known devices; and
identifying active devices within the known devices.

### Claim 5 (depends on 4)

The method of claim 4, in which the list of known devices includes an inactive device associated with the environment but disconnected from the environment, and the searching the environment comprises ignoring the inactive device.

### Claim 6 (depends on 1)

The method of claim 1, in which the collection of devices are communicatively coupled to a network, and the identifier includes a network address for the first device.

### Claim 7 (depends on 1)

The method of claim 1, in which the mobile device has an associated operator credential, the method further comprising:
determining whether the operator credential is authorized to provide the first credential.

### Claim 8 (depends on 1)

The method of claim 1, in which the first credential is a login to the selected device and a cloud service has access to the identifier and is able to search for the identifier, the method further comprising:
receiving data corresponding to the collection of devices from the cloud service;
receiving an access key from the selected device in response to providing the first credential; and
storing the access key in the ephemeral memory;
wherein applying the new configuration includes sending the access key to the selected device.

### Claim 9 (depends on 8)

The method of claim 8 further comprising:
providing the first credential to each device in the collection of devices;
receiving from each device in the collection an associated access key; and
applying the new configuration to each of the devices in the collection based at least in part on providing each of the devices its associated access key.

### Claim 10

A computing system to collectively manage a collection of devices associated with an environment including devices, comprising:
at least one processor; and
a memory coupled to the at least one processor and storing instructions that, when executed by the at least one processor, cause the computing system to:
receive an identifier corresponding to a first device of the environment;
automatically determine the collection of devices based at least in part on a search for the identifier in the environment;
provide a first credential to a selected device of the collection of devices to enable reconfiguring the selected device;
cache the first credential in an ephemeral memory;
apply a new configuration to the selected device; and
flush the ephemeral memory.

### Claim 11 (depends on 10)

The system of claim 10, in which the first credential includes an access authentication credential, wherein execution of the instructions cause the system to:
provide a second credential to a cloud service;
receive a list of known devices including the collection of devices;
cache the second credential in the ephemeral memory; and
flush the one or more key from the transitory memory.

### Claim 12 (depends on 11)

The system of claim 11, in which the list of known devices includes an inactive device, and execution of the instructions cause the system to:
identify active devices within the known devices; and
exclude inactive devices within the known devices from the collection of devices.

### Claim 13 (depends on 10)

The system of claim 10, wherein the system is to communicate over a network with the collection of devices, and the identifier is a network address for the first device.

### Claim 14 (depends on 10)

The system of claim 10, in which the mobile device has an associated operator credential, and execution of the instructions cause the system to:
determine whether the operator credential is authorized to provide the first credential.

### Claim 15 (depends on 10)

The system of claim 10, in which the first credential is a login to the selected device and a cloud service has access to the identifier and is operable to perform the search for the identifier, and execution of the instructions cause the system to:
send the identifier to the cloud service;
receive data corresponding to the collection of devices from the cloud service;
receive an access key from the selected device in response to providing the first credential;
store the access key in the ephemeral memory;
provide the first credential to each device in the collection of devices;
receive from each device in the collection an associated access key; and
apply the new configuration to each of the devices in the collection based at least in part on providing each of the devices its associated access key.

### Claim 16

A computer readable medium having instructions stored thereon for managing a collection of devices associated with an environment including devices, that, in response to execution by a processor, the instructions are operable to cause a computing system to:
receive an identifier corresponding to a first device of the environment;
automatically determine the collection of devices based at least in part on a search for the identifier in the environment;
provide a first credential to a selected device of the collection of devices to enable reconfiguring the selected device;
cache the first credential in an ephemeral memory;
apply a new configuration to the selected device; and
flush the ephemeral memory.

### Claim 17 (depends on 16)

The medium of claim 16, in which the first credential includes an access authentication credential, and the list of known devices includes an inactive device, and execution of the instructions is to cause the computing system to perform:
provide a second credential to a cloud service;
receive a list of known devices including the collection of devices;
identify active devices within the known devices;
cache the second credential in the ephemeral memory;
exclude inactive devices within the known devices from the collection of devices; and
flush the one or more key from the transitory memory.

### Claim 18 (depends on 16)

The medium if claim 16, in which the mobile device has an associated operator credential, and execution of the instructions is to cause the system to:
determine whether the operator credential is authorized to provide the first credential.

### Claim 19 (depends on 16)

The medium of claim 16, in which the first credential is a login to the selected device and a cloud service has access to the identifier and is operable to perform the search for the identifier, and execution of the instructions is to cause the computing system to:
send the identifier to the cloud service;
receive data corresponding to the collection of devices from the cloud service;
receive an access key from the selected device in response to providing the first credential; and
store the access key in the ephemeral memory.

### Claim 20 (depends on 19)

The medium of claim 19, wherein execution of the instructions is to cause the computing system to:
provide the first credential to each device in the collection of devices;
receive from each device in the collection an associated access key; and
apply the new configuration to each of the devices in the collection based at least in part on providing each of the devices its associated access key.