Granted Patent B2

US 12,506,710 · App. 17/856,038 · Granted Dec 23, 2025

Inventor: Sean Moore (Hollis, NH)

Assignee: Centripetal Networks, LLC

H04L63/0254H04L45/74H04L63/0263H04L63/1466H04L67/02H04L69/22

Abstract

Claims (63)

1 . A method comprising:

receiving, by a communication interface of a packet security gateway that interfaces between a protected network and a second network outside the protected network, a first plurality of packets corresponding to data transmitted via a first transport layer security (TLS) secure tunnel between the protected network and the second network, wherein each of the first plurality of packets comprises an application layer packet comprising an unencrypted TLS record protocol header;

inspecting packet header field values to determine whether the first plurality of packets comprises a first destination address matching a first packet-filtering rule;

responsive to determining that the first destination address matches the first packet-filtering rule, inspecting application layer packet header field values to determine whether the first plurality of packets comprises an unencrypted TLS record protocol header indicating a first TLS-version value that matches at least one TLS-version defined by the first packet-filtering rule as being a security vulnerability;

applying at least one first packet transformation function, defined by the first packet-filtering rule, to block the first plurality of packets from continuing toward the second network based on a determination that the first TLS-version value matches at least one TLS-version defined by the first packet-filtering rule as being a security vulnerability;

applying at least one second packet transformation function, defined by the first packet-filtering rule, to allow a second plurality of packets associated with a second TLS secure tunnel to be forwarded to the second network based on a determination that a second TLS-version value associated with the second plurality of packets does not match at least one TLS-version defined by the first packet-filtering rule;

receiving, via the communication interface and from the protected network, a third plurality of packets corresponding to data transmitted via a third TLS secure tunnel, wherein each of the third plurality of packets comprises an application layer packet comprising an unencrypted TLS record protocol header indicating a TLS-version value defined by the first packet-filtering rule as being a security vulnerability;

inspecting packet header field values to determine whether the third plurality of packets comprises a second destination address matching the first packet-filtering rule; and

responsive to determining that the second destination address that does not match the first packet-filtering rule, forwarding the second plurality of packets to the second destination address.

2 . The method of claim 1 , further comprising:

inspecting packet header field values to determine a third destination address for a fourth plurality of packets, wherein the third destination address comprises a trusted network; and

responsive to determining that the third destination address matches a second packet-filtering rule, applying at least one third packet transformation function, defined by the second packet-filtering rule, to forward each of the fourth plurality of packets toward the third destination address.

3 . The method of claim 1 , further comprising:

inspecting packet header field values to determine a third destination address for a fourth plurality of packets, wherein the third destination address comprises an untrusted network; and

responsive to determining that the third destination address matches a second packet-filtering rule, applying at least one third packet transformation function, defined by the second packet-filtering rule, to drop each of the fourth plurality of packets.

4 . The method of claim 1 , further comprising:

receiving, from a security policy management server, a dynamic security policy that comprises a set of packet-filtering rules, wherein the set of packet-filtering rules comprises the first packet-filtering rule.

5 . The method of claim 4 , wherein the security policy management server is external to the protected network.

6 . The method of claim 1 , wherein blocking the first plurality of packets from continuing toward the second network comprises sending the first plurality of packets to a location within the protected network.

7 . The method of claim 1 , wherein the security vulnerability comprises a vulnerability that allows a malicious user to exfiltrate data from the protected network to the second network.

8 . A packet security gateway that interfaces at a boundary of a protected network and a second network outside the protected network, the packet security gateway comprising:

a communication interface;

one or more processors; and

memory comprising instructions that, when executed by the one or more processors, cause the packet security gateway to:

receive, by a communication interface of a packet security gateway that interfaces between a protected network and a second network outside the protected network, a first plurality of packets corresponding to data transmitted via a first transport layer security (TLS) secure tunnel between the protected network and the second network, wherein each of the first plurality of packets comprises an application layer packet comprising an unencrypted TLS record protocol header;

inspect packet header field values to determine whether the first plurality of packets comprises a first destination address matching a first packet-filtering rule;

responsive to determining that the first destination address matches the first packet-filtering rule, inspect application layer packet header field values to determine whether the first plurality of packets comprises an unencrypted TLS record protocol header indicating a first TLS-version value that matches at least one TLS-version defined by the first packet-filtering rule as being a security vulnerability;

apply at least one first packet transformation function, defined by the first packet-filtering rule, to block the first plurality of packets from continuing toward the second network based on a determination that the first TLS-version value matches at least on TLS-version defined by the first packet-filtering rule as being a security vulnerability;

apply at least one second packet transformation function, defined by the first packet-filtering rule, to allow a second plurality of packets associated with a second TLS secure tunnel to be forwarded to the second network based on a determination that a second TLS-version value associated with the second plurality of packets does not match at least one TLS-version defined by the first packet-filtering rule;

receive, via the communication interface and from the protected network, a third plurality of packets corresponding to data transmitted via a third TLS secure tunnel, wherein each of the third plurality of packets comprises an application layer packet comprising an unencrypted TLS record protocol header indicating a TLS-version value defined by the first packet-filtering rule as being a security vulnerability;

inspect packet header field values to determine whether the third plurality of packets comprises a second destination address matching the first packet-filtering rule; and

responsive to determining that the second destination address does not match the first packet-filtering rule, forward the second plurality of packets to the second destination address.

9 . The packet security gateway of claim 8 , wherein the instructions, when executed by the one or more processors, cause the packet security gateway to:

inspect packet header field values to determine a third destination address for a fourth plurality of packets, wherein the third destination address comprises a trusted network; and

responsive to determining that the third destination address matches a second packet-filtering rule, apply at least one third packet transformation function, defined by the second packet-filtering rule, to forward each of the fourth plurality of packets toward the third destination address.

10 . The packet security gateway of claim 8 , wherein the instructions, when executed by the one or more processors, cause the packet security gateway to:

inspect packet header field values to determine a third destination address for each of a fourth plurality of packets, wherein the third destination address comprises an untrusted network; and

responsive to determining that the third destination address matches a second packet-filtering rule, apply at least one third packet transformation function, defined by a second packet-filtering rule, to drop each of the fourth plurality of packets.

11 . The packet security gateway of claim 8 , wherein the instructions, when executed by the one or more processors, cause the packet security gateway to:

receive, from a security policy management server, a dynamic security policy that comprises a set of packet-filtering rules, wherein the set of packet-filtering rules comprises the first packet-filtering rule.

12 . The packet security gateway of claim 11 , wherein the security policy management server is external to the protected network.

13 . The packet security gateway of claim 8 , wherein blocking the first plurality of packets from continuing toward the second network comprises sending the first plurality of packets to a location within the protected network.

14 . The packet security gateway of claim 8 , wherein the security vulnerability comprises a vulnerability that allows a malicious user to exfiltrate data from the protected network to the second network.

15 . One or more non-transitory computer-readable media comprising instructions that, when executed by one or more processors of a packet security gateway that interfaces at a boundary of a protected network and a second network outside of the protected network, cause the packet security gateway to:

receive, by a communication interface of a packet security gateway that interfaces between a protected network and a second network outside the protected network, a first plurality of packets corresponding to data transmitted via a first transport layer security (TLS) secure tunnel between the protected network and the second network, wherein each of the first plurality of packets comprises an application layer packet comprising an unencrypted TLS record protocol header;

inspect packet header field values to determine whether the first plurality of packets comprises a first destination address matching a first packet-filtering rule;

responsive to determining that the first destination address matches the first packet-filtering rule, inspect application layer packet header field values to determine whether the first plurality of packets comprises an unencrypted TLS record protocol header indicating a first TLS-version value that matches at least one TLS-version defined by the first packet-filtering rule as being a security vulnerability;

apply at least one first packet transformation function, defined by the first packet-filtering rule, to block the first plurality of packets from continuing toward the second network based on a determination that the first TLS-version value matches at least on TLS-version defined by the first packet-filtering rule as being a security vulnerability;

apply at least one second packet transformation function, defined by the first packet-filtering rule, to allow a second plurality of packets associated with a second TLS secure tunnel to be forwarded to the second network based on a determination that a second TLS-version value does not match at least one TLS-version defined by the first packet-filtering rule;

receive, via the communication interface and from the protected network, a third plurality of packets corresponding to data transmitted via a third TLS secure tunnel, wherein each of the third plurality of packets comprises an application layer packet comprising an unencrypted TLS record protocol header indicating a TLS-version value defined by the first packet-filtering rule as being a security vulnerability;

inspect packet header field values to determine whether the third plurality of packets comprises a second destination address matching the first packet-filtering rule; and

responsive to determining that the second destination address does not match the first packet-filtering rule, forward the second plurality of packets to the second destination address.

16 . The one or more non-transitory computer-readable media of claim 15 , wherein the instructions, when executed by the one or more processors, cause the packet security gateway to:

inspect packet header field values to determine a third destination address for a fourth plurality of packets, wherein the third destination address comprises a trusted network; and

responsive to determining that the third destination address matches a second packet-filtering rule, apply at least one third packet transformation function, defined by the second packet-filtering rule, to forward each of the fourth plurality of packets toward the third destination address.

17 . The one or more non-transitory computer-readable media of claim 15 , wherein the instructions, when executed by the one or more processors, cause the packet security gateway to:

inspect packet header field values to determine a third destination address for each of a fourth plurality of packets, wherein the third destination address comprises an untrusted network; and

responsive to determining that the third destination address matches a second packet-filtering rule, apply at least one third packet transformation function, defined by a second packet-filtering rule, to drop each of the fourth plurality of packets.

18 . The one or more non-transitory computer-readable media of claim 15 , wherein the instructions, when executed by the one or more processors, cause the packet security gateway to:

receive, from a security policy management server, a dynamic security policy that comprises a set of packet-filtering rules, wherein the set of packet-filtering rules comprises the first packet-filtering rule.

19 . The one or more non-transitory computer-readable media of claim 18 , wherein the security policy management server is external to the protected network.

20 . The one or more non-transitory computer-readable media of claim 15 , wherein blocking the first plurality of packets from continuing toward the second network comprises sending the first plurality of packets to a location within the protected network.

21 . The one or more non-transitory computer-readable media of claim 15 , wherein the security vulnerability comprises a vulnerability that allows a malicious user to exfiltrate data from the protected network to the second network.

Assignments (2)

Continuity (7)

References Cited (400)