Granted Patent B2

US 12,563,017 · App. 18/662,783 · Granted Feb 24, 2026

Inventors: Carlos Eliseo Salas Lumbreras (Vilnius, LT); Juta Gurinaviciute (Vilnius, LT)

Assignee: UAB 360 IT

H04L63/0272H04L63/0263

Abstract

Claims (53)

1 . A method of controlling access to network resources, the method comprising:

receiving an authentication request from a user device to a core security service;

upon authentication of the user device by the core security service, receiving a request from a user device at a core configuration service to connect to an outer resource, retrieving user-specific rule set, and sharing the user-specific rule set with the user device, wherein the user-specific rule set defines resources that are accessible directly over the internet and resources that require connectivity through an internal network;

adapting the shared rule set by the user device;

evaluating the request against the adapted rule set;

routing the connection to the outer resources directly via the internet when the adapted rule set indicates that the outer resource is accessible through the internet; and

routing the user's request to an internal network when the adapted rule set indicates that the outer resource is not accessible through the internet.

2 . The method of claim 1 , wherein the internal network is a private cloud comprising a gateway and a firewall and, wherein the method includes, upon authentication of the user device, retrieving user-specific, segmented firewall rules stored in the private cloud; and

wherein, if the user's request is routed to the private cloud, the method further includes:

routing a request by the user device to access an outer resource to the gateway;

evaluating the request against the segmented firewall rules;

if the request meets the segmented firewall rules, routing the request through security measures of the firewall; and

if the request does not meet the segmented firewall rules, denying the user device access to the outer resource.

3 . The method of claim 2 , wherein each private cloud includes a corresponding firewall, wherein the request is transmitted through a secure VPN tunnel established by the gateway before being received by the firewall.

4 . The method of claim 3 , wherein the segmented firewall rules include firewall rules associated with at least one of the user, a group of users, an organization, or the gateway.

5 . The method of claim 3 , further comprising forwarding the request to the outer resource and transmitting a response from the outer resource to the user device through the secure VPN tunnel if the request meets the segmented firewall rules and passes the security measures of the firewall.

6 . The method of claim 2 , wherein the core security service is located between the user device and at least one of the private cloud.

7 . The method of claim 2 , wherein the authentication request includes a request to connect to one or more private clouds associated with the user.

8 . An apparatus for controlling access to network resources, comprising at least one processor and at least one non-transient computer readable medium for storing instructions that, when executed by the at least one processor, causes the apparatus to perform operations comprising:

receiving an authentication request from a user device to a core security service;

upon authentication of the user by the core security service, receiving a request from a user device at a core configuration service to connect to an outer resource, retrieving user-specific rule set, and sharing the user-specific rule set with the user device, wherein the user-specific rule set defines resources that are accessible directly over the internet and resources that require connectivity through an internal network;

adapting the shared rule set by the user device;

evaluating the request against the adapted rule set;

routing the connection to the outer resources directly via the internet when the adapted rule set indicates that the outer resource is accessible through the internet; and

routing the user's request to an internal network when the adapted rule set indicates that the outer resource is not accessible through the internet.

9 . The apparatus according to claim 8 , wherein the internal network is a private cloud comprising a gateway and a firewall and, wherein the operations include, upon authentication of the user device, retrieving user-specific, segmented firewall rules stored in the private cloud; and

wherein, if the user's request is routed to the private cloud, the operations further includes:

routing a request by the user device to access an outer resource to the gateway;

evaluating the request against the segmented firewall rules;

if the request meets the segmented firewall rules, routing the request through security measures of the firewall; and

if the request does not meet the segmented firewall rules, denying the user device access to the outer resource.

10 . The apparatus of claim 9 , wherein each private cloud includes a corresponding firewall wherein the request is transmitted through a secure VPN tunnel established by the gateway before being received by the firewall.

11 . The apparatus of claim 10 , wherein the segmented firewall rules include firewall rules associated with at least one of the user, a group of users, an organization, or the gateway.

12 . The apparatus of claim 10 , further comprising forwarding the request to the outer resource and transmitting a response from the outer resource to the user device through the secure VPN tunnel if the request meets the segmented firewall rules and passes the security measures of the firewall.

13 . The apparatus of claim 9 , wherein the core security service is located between the user device and the private cloud.

14 . The apparatus of claim 9 , wherein the authentication request includes a request to connect to one or more private clouds associated with the user.

15 . One or more non-transitory computer readable media having instructions stored thereon which, when executed by one or more processors, cause the one or more processors to perform operations comprising:

receiving an authentication request from a user device to a core security service;

upon authentication of the user by the core security service receiving a request from a user device at a core configuration service to connect to an outer resource, retrieving user-specific rule set, and sharing the user-specific rule set with the user device, wherein the user-specific rule set defines resources that are accessible directly over the internet and resources that require connectivity through an internal network;

adapting the shared rule set by the user device;

evaluating the request against the adapted rule set;

routing the connection to the outer resources directly via the internet when the adapted rule set indicates that the outer resource is accessible through the internet; and

routing the user's request to an internal network when the adapted rule set indicates that the outer resource is not accessible through the internet.

16 . The computer readable media of claim 15 , wherein the internal network is a private cloud comprising a gateway and a firewall and, wherein the operations include, upon authentication of the user device, retrieving user-specific, segmented firewall rules stored in the private cloud; and

wherein, if the user's request is routed to the private cloud, the operations further includes:

routing a request by the user device to access an outer resource to the gateway;

evaluating the request against the segmented firewall rules;

if the request meets the segmented firewall rules, routing the request through security measures of the firewall; and

if the request does not meet the segmented firewall rules, denying the user device access to the outer resource.

17 . The computer readable media of claim 16 , wherein each private cloud includes a corresponding firewall, wherein the request is transmitted through a secure VPN tunnel established by the gateway before being received by the firewall.

18 . The computer readable media of claim 17 , wherein the segmented firewall rules include firewall rules associated with at least one of the user, a group of users, an organization, or the gateway.

19 . The computer readable media of claim 17 , forwarding the request to the outer resource and transmitting a response from the outer resource to the user device through the secure VPN tunnel if the request meets the segmented firewall rules and passes the security measures of the firewall.

20 . The computer readable media of claim 16 , wherein the authentication request includes a request to connect to one or more private clouds associated with the user.

Assignments (2)

Continuity (2)

References Cited (37)