US 8789135

Patent Overview: US 8,789,135 B1

Title: Scalable stateful firewall design in openflow based networks

Patent Number: US 8,789,135 B1

Inventor: Ayaskant Pani

Assignee: Google LLC (originally Google Inc.; assignment to Google Inc. recorded 2012-06-18; change of name to Google LLC recorded 2017-10-02)

Key Dates: Priority/filing date 2012-06-15; publication (grant) date 2014-07-22; adjusted expiration 2032-09-07. Legal status listed as Active, with the caveat that status is an assumption, not a legal conclusion.

Purpose: The patent addresses the tradeoff between firewall security and network speed. Traditional filter-based firewalls cannot detect sophisticated attacks; proxy firewalls are secure but too processing-intensive for large networks; stateful firewalls compromise between the two but still bottleneck bandwidth because all traffic must pass through them. The disclosed system aims to provide a scalable stateful firewall that lets approved traffic flows bypass the firewall.

Plain-Language Scope: A logically centralized controller (which may be an OpenFlow controller) identifies packets in a traffic flow. A first set of packets is routed through a firewall that checks the flow against a predetermined rule; if the flow violates the rule, the controller may block it. If no violation is found, those packets proceed to the destination while a second set are routed directly to the destination, reducing firewall congestion. The controller may route more or fewer packets through the firewall based on how likely a flow is to violate the rule. Flows are marked in a "flow state" or "breach state," and the software-configured switch receives updated routing plans (blocking breach-state flows, bypassing the firewall for flow-state packets, and routing all other packets through the firewall). The predetermined rule may check headers for authorized protocols or IP addresses, or search packet bodies for banned regular expressions. The system also describes aggregate-behavior checks, end-of-flow removal, and topology-change updates.

Source: https://patents.google.com/patent/US8789135/en

What the excerpt does not establish: The supplied text contains only a partial description and lists "FIG. 1" and "FIG. 2" without their contents. No claims are included, so the exact legal scope of coverage cannot be confirmed from this source alone. The excerpt provides no information on prosecution history, prior art, validity, or ownership beyond the recorded assignments.