# US 9,882,876 B2 · System and method for redirected firewall discovery in a network environment

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 9,882,876 B2
- Document ID: US9882876B2
- Status: Granted
- Kind: B2
- Application number: 15/168,004
- Filed: 2016-05-28
- Published: 2016-12-01
- Granted: 2018-01-30
- Earliest claimed: 2011-10-17
- Assignees: McAfee, Inc.
- Applicants: McAfee, LLC.
- Inventors: Geoffrey Cooper; Michael W. Green; John Richard Guzik
- Web page: https://patentgrep.com/patent/US9882876B2

## CPC

- H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)}
- H04L 63/0209: {Architectural arrangements, e.g. perimeter networks or demilitarized zones}
- H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)}
- G06F 2221/2101: Auditing as a secondary aspect
- H04L 43/10: Active monitoring, e.g. heartbeat, ping or trace-route
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A method is provided in one example embodiment that includes receiving metadata from a host over a metadata channel. The metadata may be correlated with a network flow and a network policy may be applied to the connection. In other embodiments, a network flow may be received from a host without metadata associated with the flow, and a discovery redirect may be sent to the host. Metadata may then be received and correlated with the flow to identify a network policy action to apply to the flow.

## Claims

### Claim 1

A method for redirected firewall discovery, the method comprising:
transmitting a network flow from a source node to a first firewall;
transmitting, from the source node to a second firewall, metadata associated with the network flow;
receiving, from the first firewall at the source node, a discovery redirect including information identifying the first firewall; and
in response to receiving the discovery redirect, transmitting the metadata from the source node to the first firewall, the metadata associated with a network policy applicable to the network flow at the first firewall.

### Claim 2 (depends on 1)

The method of claim 1, further comprising:
in response to receiving the discovery redirect, updating a firewall cache at the source node to include the first firewall as a firewall corresponding to a route associated with the network flow, the updating the firewall cache including adding a subnet associated with the discovery redirect to the firewall cache, or generalizing one or more existing entries in the firewall cache if the discovery redirect overlaps with previously received discovery redirects.

### Claim 3 (depends on 1)

The method of claim 1, further comprising:
holding, using a firewall agent at the source node, a connection establishing packet of the network flow until the metadata is transmitted to the first firewall; and
transmitting the connection establishing packet to the first firewall.

### Claim 4 (depends on 1)

The method of claim 1, further comprising:
in response to receiving the discovery redirect, authenticating the discovery redirect using a hash-based message authentication code (HMAC), the HMAC including a cryptographic hash function in combination with a secret shared between the first firewall and the source node.

### Claim 5 (depends on 1)

The method of claim 1, further comprising:
in response to receiving the discovery redirect, retransmitting a connection establishing packet of the network flow to the first firewall, the connection establishing packet being cached at the source node.

### Claim 6

A source node for redirected firewall discovery, the source node comprising:
an interface that transmits a network flow to a first firewall and transmits, to a second firewall, metadata associated with the network flow, wherein
the interface receives, from the first firewall, a discovery redirect including information identifying the first firewall, and
the interface is configured to transmit, in response to receiving the discovery redirect, the metadata to the first firewall, the metadata associated with a network policy applicable to the network flow at the first firewall.

### Claim 7 (depends on 6)

The source node of claim 6, further comprising:
a processor that performs, in response to a reception of the discovery redirect, an update of a firewall cache at the source node to include the first firewall as a firewall corresponding to a route associated with the network flow, the update including adding a subnet associated with the discovery redirect to the firewall cache, or generalizing one or more existing entries in the firewall cache if the discovery redirect overlaps with previously received discovery redirects.

### Claim 8 (depends on 6)

The source node of claim 6, further comprising:
a memory that holds a connection establishing packet of the network flow until the metadata is transmitted to the first firewall, wherein the interface transmits the connection establishing packet to the first firewall.

### Claim 9 (depends on 6)

The source node of claim 6, further comprising:
a processor configured to authenticate, in response to a reception of the discovery redirect, the discovery redirect using a hash-based message authentication code (HMAC), the HMAC including a cryptographic hash function in combination with a secret shared between the first firewall and the source node.

### Claim 10 (depends on 6)

The source node of claim 6, wherein the interface retransmits, in response to receiving the discovery redirect, a connection establishing packet of the network flow to the first firewall, the connection establishing packet being cached at the source node.

### Claim 11

A method implemented by a firewall, the method comprising:
intercepting, at the firewall, a connection establishing packet of a network flow received over a network environment from a source node;
determining whether the firewall has metadata associated with the network flow in a metadata cache of the firewall;
in response to determining that the firewall does not have the metadata, transmitting, from the firewall to the source node, a discovery redirect including information to allow the source node to identify the firewall; and
receiving, at the firewall from the source node, the metadata, after the transmitting the discovery redirect to the source node.

### Claim 12 (depends on 11)

The method of claim 11, further comprising:
in response to determining that the firewall does not have the metadata:
releasing the network flow without the metadata; and
logging an event that the network flow is released to indicate to a host manager at the firewall that the discovery redirect is to be sent to the source node.

### Claim 13 (depends on 11)

The method of claim 11, further comprising:
in response to determining that the firewall does not have the metadata:
blocking the network flow without the metadata; and
logging an event that the network flow is blocked to indicate to a host manager at the firewall that the discovery redirect is to be sent to the source node.

### Claim 14 (depends on 13)

The method of claim 13, wherein the blocking the network flow includes:
dropping the connection establishing packet without attempting to reset a connection associated with the network flow.

### Claim 15 (depends on 11)

The method of claim 11, further comprising:
providing, from a host manager at the firewall to a policy module at the firewall, connection data associated with the network flow, the connection data including a source internet protocol address and port, a destination internet protocol address and port, and a protocol; and
correlating, using the policy module at the firewall, the connection data with metadata in the metadata cache to apply a network policy to the network flow.

### Claim 16

An apparatus that implements a firewall, the apparatus comprising:
an interface that intercepts a connection establishing packet of a network flow received over a network environment from a source node; and
a processor that determines whether the firewall has metadata associated with the network flow in a metadata cache of the firewall, wherein
the interface transmits, in response to a determination that the firewall does not have the metadata, a discovery redirect to the source node, the discovery redirect including information to allow the source node to identify the firewall, and
the interface receives, from the source node, the metadata, after transmitting the discovery redirect to the source node.

### Claim 17 (depends on 16)

The apparatus of claim 16, wherein the processor, in response to the determination that the firewall does not have the metadata, both releases the network flow without the metadata and logs an event that the network flow is released to indicate to a host manager that the discovery redirect is to be sent to the source node.

### Claim 18 (depends on 16)

The apparatus of claim 16, wherein the network flow is blocked, in response to the determination that the firewall does not have the metadata, and
the processor logs an event that the network flow is blocked to indicate to a host manager at the firewall that the discovery redirect is to be sent to the source node, in response to the determination that the firewall does not have the metadata.

### Claim 19 (depends on 18)

The apparatus of claim 18, wherein the network flow is blocked by a dropping of the connection establishing packet without an attempt to reset a connection associated with the network flow.

### Claim 20 (depends on 16)

The apparatus of claim 16, wherein connection data associated with the network flow is provided from a host manager at the firewall to a policy module at the firewall, the connection data including a source internet protocol address and port, a destination internet protocol address and port, and a protocol, and
the processor correlates, using the policy module at the firewall, the connection data with metadata in the metadata cache to apply a network policy to the network flow.