US 12,224,982 B2
Distributed identity-based firewall policy evaluation
Liron Levin, Kefar Sava (IL); Eran Yanay, Modiin (IL); and Dima Stopel, Herzliya (IL)
Assigned to Palo Alto Networks, Inc., Santa Clara, CA (US)
Filed by Palo Alto Networks, Inc., Santa Clara, CA (US)
Filed on Oct. 18, 2023, as Appl. No. 18/489,392.
Application 18/489,392 is a continuation of application No. 16/930,732, filed on Jul. 16, 2020, granted, now 11,838,267.
Prior Publication US 2024/0073185 A1, Feb. 29, 2024
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/0236 (2013.01) [H04L 63/101 (2013.01); H04L 63/126 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method comprising:
intercepting a first packet incoming to a first entity, wherein the first packet comprises metadata;
based on determining that the metadata of the first packet comprise an extension header, determining whether the first packet can be verified, wherein the determination of whether the first packet can be verified comprises determining whether the extension header comprises a signature that includes an encoded identifier of a sender entity of the first packet;
in response to determining that the first packet can be verified based on determining that the extension header comprises the signature that includes the encoded identifier of the sender entity of the first packet, determining based on a firewall policy whether the sender entity and the first entity are permitted to communicate, wherein determining whether the sender entity and the first entity are permitted to communicate comprises:
decoding the encoded identifier to obtain an identifier of the sender entity, wherein the identifier of the sender entity was determined for the sender entity based on the firewall policy and differs from an Internet Protocol (IP) address of the sender entity; and
evaluating the first packet for compliance with the firewall policy based on the identifier of the sender entity, wherein the firewall policy comprises rules for communications of a plurality of entities based on a plurality of identifiers of a corresponding plurality of entities, wherein the plurality of identifiers are unique to respective ones of the plurality of entities and differs from IP addresses of the plurality of entities, and wherein the plurality of identifiers includes the identifier of the sender entity; and
in response to determining that the first packet cannot be verified based on determining that the extension header does not comprise the signature that includes the encoded identifier of the sender entity of the first packet or that the metadata of the first packet do not comprise an extension header, performing one or more mitigation actions.