# US 2023/0055052 A1 · Securely managing network connections > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2023/0055052 A1 - Document ID: US20230055052A1 - Status: Published application - Kind: A1 - Application number: 18/048,248 - Filed: 2022-10-20 - Published: 2023-02-23 - Earliest claimed: 2016-03-24 - Assignees: Snowflake Inc. - Applicants: Snowflake Inc. - Inventors: James Calvin Armstrong; Jonathan Claybaugh - Web page: https://patentgrep.com/patent/US20230055052A1 ## CPC - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - G06F 21/566: {Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities} - G06F 21/57: Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities - H04L 41/0604: using filtering, e.g. reduction of information by using priority, element types, position or time - H04L 41/22: comprising specially adapted graphical user interfaces [GUI] - H04L 43/00: Arrangements for monitoring or testing data switching networks - H04L 43/026: using flow identification - H04L 43/062: related to network traffic - H04L 43/0811: by checking connectivity - H04L 63/0263: {Rule management} - H04L 63/104: {Grouping of entities} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - H04L 63/102: {Entity profiles} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract The disclosure relates generally to methods, systems, and apparatuses for managing network connections. An example method includes receiving one or more messages from a plurality of computing devices connected through a network, the one or more messages indicating actual connections among the plurality of computing devices. The example method further includes comparing, by one or more processors, the actual connections to a list of expected connections indicated by a connections master file that comprises connection information for the plurality of computing devices. The method further includes, responsive to detecting one or more differences between the list of expected connections and the actual connections, providing a notification indicating the one or more differences to a log file or a notification area of a user interface. ## Claims ### Claim 1 A method comprising: receiving one or more messages from a plurality of computing devices connected through a network, the one or more messages indicating actual connections among the plurality of computing devices; comparing, by one or more processors, the actual connections to a list of expected connections indicated by a connections master file that comprises connection information for the plurality of computing devices; and responsive to detecting one or more differences between the list of expected connections and the actual connections, providing a notification indicating the one or more differences to a log file or a notification area of a user interface. ### Claim 2 (depends on 1) The method of claim 1, wherein the actual connections are determined from configuration files included in each of the plurality of computing devices. ### Claim 3 (depends on 1) The method of claim 1, wherein each expected connection in the list defines a first computing device of the plurality of computing devices and a second computing device of the plurality of computing devices between which the expected connection exists. ### Claim 4 (depends on 1) The method of claim 1, wherein each of the actual connections among the plurality of computing devices comprises a protocol, a port number, a port number range, or a security group. ### Claim 5 (depends on 1) The method of claim 1, wherein each detected difference indicates an unauthorized connection or an inaccuracy of the master connection file. ### Claim 6 (depends on 1) The method of claim 1, further comprising determining, based on one or more detected differences between the list of expected connections and the actual connections among the plurality of computing devices, whether the list of expected connections is inaccurate. ### Claim 7 (depends on 6) The method of claim 6, further comprising, responsive to a determination that the list of expected connections is inaccurate, updating the connections master file. ### Claim 8 (depends on 1) The method of claim 1, further comprising determining, based on one or more detected differences between the list of expected connections and the actual connections among the plurality of computing devices, whether one or more of the actual connections are unauthorized. ### Claim 9 (depends on 8) The method of claim 8, further comprising, responsive to a determination that one of the actual connections between two computing devices of the plurality of computing devices is an unauthorized connection, reconfiguring the two computing devices to eliminate the unauthorized connection. ### Claim 10 (depends on 9) The method of claim 9, wherein reconfiguring the two computing devices to eliminate the unauthorized connection comprises pushing a configuration file to each of the computing devices to delete a rule corresponding to the unauthorized connection. ### Claim 11 A system comprising: a memory comprising instructions; and one or more processors operatively coupled to the memory to execute the instructions, wherein the instructions cause the one or more processors to: receive one or more messages from a plurality of computing devices connected through a network, the one or more messages indicating actual connections among the plurality of computing devices; compare, by the one or more processors, the actual connections to a list of expected connections indicated by a connections master file that comprises connection information for the plurality of computing devices; and responsive to a detection of one or more differences between the list of expected connections and the actual connections, provide a notification indicating the one or more differences to a log file or a notification area of a user interface. ### Claim 12 (depends on 11) The system of claim 11, wherein the actual connections are determined from configuration files included in each of the plurality of computing devices. ### Claim 13 (depends on 11) The system of claim 11, wherein each expected connection in the list defines a first computing device of the plurality of computing devices and a second computing device of the plurality of computing devices between which the expected connection exists. ### Claim 14 (depends on 11) The system of claim 11, wherein each of the actual connections among the plurality of computing devices comprises a protocol, a port number, a port number range, or a security group. ### Claim 15 (depends on 11) The system of claim 11, wherein each detected difference indicates an unauthorized connection or an inaccuracy of the master connection file. ### Claim 16 (depends on 11) The system of claim 11, wherein the one or more processors are further to: determine, based on one or more detected differences between the list of expected connections and the actual connections among the plurality of computing devices, whether the list of expected connections is inaccurate. ### Claim 17 (depends on 16) The system of claim 16, wherein the one or more processors are further to, responsive to a determination that the list of expected connections is inaccurate, update the connections master file. ### Claim 18 (depends on 11) The system of claim 11, wherein the one or more processors are further to determine, based on one or more detected differences between the list of expected connections and the actual connections among the plurality of computing devices, whether one or more of the actual connections are unauthorized. ### Claim 19 (depends on 18) The system of claim 18, wherein the one or more processors are further to, responsive to a determination that one of the actual connections between two computing devices of the plurality of computing devices is an unauthorized connection, reconfigure the two computing devices to eliminate the unauthorized connection. ### Claim 20 (depends on 19) The system of claim 19, wherein to reconfigure the two computing devices to eliminate the unauthorized connection comprises to push a configuration file to each of the computing devices to delete a rule corresponding to the unauthorized connection. ### Claim 21 A non-transitory computer readable medium having instructions stored thereon which, when executed by one or more processors, cause the one or more processors to: receive one or more messages from a plurality of computing devices connected through a network, the one or more messages indicating actual connections among the plurality of computing devices; compare the actual connections to a list of expected connections indicated by a connections master file that comprises connection information for the plurality of computing devices; and responsive to a detection of one or more differences between the list of expected connections and the actual connections, provide a notification indicating the one or more differences to a log file or a notification area of a user interface. ### Claim 22 (depends on 21) The non-transitory computer readable medium of claim 21, wherein the actual connections are determined from configuration files included in each of the plurality of computing devices. ### Claim 23 (depends on 21) The non-transitory computer readable medium of claim 21, wherein each expected connection in the list defines a first computing device of the plurality of computing devices and a second computing device of the plurality of computing devices between which the expected connection exists. ### Claim 24 (depends on 21) The non-transitory computer readable medium of claim 21, wherein each of the actual connections among the plurality of computing devices comprises a protocol, a port number, a port number range, or a security group. ### Claim 25 (depends on 21) The non-transitory computer readable medium of claim 21, wherein each detected difference indicates an unauthorized connection or an inaccuracy of the master connection file. ### Claim 26 (depends on 21) The non-transitory computer readable medium of claim 21, wherein the one or more processors are further to determine, based on one or more detected differences between the list of expected connections and the actual connections among the plurality of computing devices, whether the list of expected connections is inaccurate. ### Claim 27 (depends on 26) The non-transitory computer readable medium of claim 26, wherein the one or more processors are further to, responsive to a determination that the list of expected connections is inaccurate, update the connections master file. ### Claim 28 (depends on 21) The non-transitory computer readable medium of claim 21, wherein the one or more processors are further to determine, based on one or more detected differences between the list of expected connections and the actual connections among the plurality of computing devices, whether one or more of the actual connections are unauthorized. ### Claim 29 (depends on 28) The non-transitory computer readable medium of claim 28, wherein the one or more processors are further to, responsive to a determination that one of the actual connections between two computing devices of the plurality of computing devices is an unauthorized connection, reconfigure the two computing devices to eliminate the unauthorized connection. ### Claim 30 (depends on 29) The non-transitory computer readable medium of claim 29, wherein to reconfigure the two computing devices to eliminate the unauthorized connection comprises to push a configuration file to each of the computing devices to delete a rule corresponding to the unauthorized connection.