US 12,335,232 B2
Distributed identity-based firewalls
Anirban Sengupta, Saratoga, CA (US); Subrahmanyam Manuguri, San Jose, CA (US); Mitchell T. Christensen, Livermore, CA (US); Azeem Feroz, San Jose, CA (US); and Todd Sabin, Morganville, NJ (US)
Assigned to VMWare LLC, Palo Alto, CA (US)
Filed by VMware LLC, Palo Alto, CA (US)
Filed on Jul. 3, 2023, as Appl. No. 18/217,666.
Application 18/217,666 is a continuation of application No. 17/063,415, filed on Oct. 5, 2020, granted, now 11,695,731.
Application 17/063,415 is a continuation of application No. 16/041,698, filed on Jul. 20, 2018, granted, now 10,798,058, issued on Oct. 6, 2020.
Application 16/041,698 is a continuation of application No. 14/043,714, filed on Oct. 1, 2013, granted, now 10,033,693, issued on Jul. 24, 2018.
Prior Publication US 2023/0362130 A1, Nov. 9, 2023
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 9/40 (2022.01); G06F 9/455 (2018.01); H04L 67/63 (2022.01)
CPC H04L 63/0218 (2013.01) [G06F 9/45558 (2013.01); H04L 67/63 (2022.05); G06F 2009/45595 (2013.01)] 18 Claims
OG exemplary drawing
 
1. For a virtual machine executing on a host computer, a method for providing firewall services on the host computer, the method comprising:
for a network connection, receiving a record associating a set of header values of packets sent from the virtual machine with an identifier associated with a process associated with the network connection;
associating a packet received from the virtual machine with the identifier by comparing the packet's set of header values with the set of header values of the record;
using the identifier to identify a firewall rule from a plurality of firewall rules that have rule identifiers defined by reference to a plurality of identifiers;
performing a firewall operation on the received packet based on the identified firewall rule by forwarding the packet to a virtual switch executing on the host computer for distribution to a destination of the packet, the virtual switch being configured to apply routing policies based on a user identity and a group membership.