Multi-perimeter firewall in the cloud

What is this patent about?

'482 is related to the field of network security, specifically to systems and methods for providing multi-perimeter firewalls within a global virtual network (GVN). The background acknowledges the limitations of traditional WAN optimization and VPN technologies in addressing latency and security issues, especially in scenarios with geographically distributed users and cloud-based services. The patent aims to improve network performance and security by strategically positioning distributed firewalls at multiple perimeters in the cloud.

The underlying idea behind '482 is to create a multi-layered firewall system within a GVN that leverages the cloud's scalability and distributed nature. Instead of relying on a single firewall at the network edge, the invention proposes placing multiple firewalls at different points within the GVN. This allows for a more comprehensive and adaptable security posture, where different types of inspection (e.g., stateful packet inspection and deep packet inspection) can be applied at different stages of traffic flow.

The claims of '482 focus on a multi-perimeter firewall system located in a cloud and forming part of a global virtual network. The system includes an egress ingress point device, first and second access point servers, and an endpoint device. A first perimeter firewall performs stateful packet inspection (SPI) at the first access point server, while a second perimeter firewall performs deep packet inspection (DPI) on a cloned copy of traffic at the second access point server, preventing malicious traffic from reaching the endpoint device.

In practice, the system operates by routing network traffic through the GVN, where it encounters the first firewall performing stateful packet inspection. This firewall quickly examines packet headers to identify and block known threats. Traffic that passes this initial filter is then forwarded to the second firewall, which performs deep packet inspection on a copy of the traffic. This more thorough inspection analyzes the packet payload for sophisticated threats, without impacting the speed of the main traffic flow.

This approach differs from traditional firewalls by distributing the security functions across multiple points in the network and by using a combination of SPI and DPI. The use of a cloned traffic stream for DPI is a key differentiator, as it allows for in-depth analysis without introducing latency. Furthermore, the system is designed to be scalable, leveraging cloud resources to handle varying traffic loads and attack volumes, and the firewalls can share threat intelligence to improve overall security.