Patent ID: 11916879
Assignee: VMWARE LLC
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 9:
10. A non-transitory computer readable medium storing a program for performing a firewall operation, the program executable by at least one processing unit, the program comprising sets of instructions for:
instantiating, on a computer, first and second firewall processes that are two separate processes;
using the first firewall process to examine a data message to determine whether a TLS-based firewall policy has to be enforced on the data message;
based on a determination that a TLS-based firewall policy has to be enforced on the data message, providing metadata, produced by the first firewall process in its examination of the data message, to the second firewall process; and
having the second firewall process use the provided metadata to perform a TLS-based firewall operation based on the TLS-based firewall policy;
wherein the computer executes a Linux operating system, and
wherein the set of instructions for providing the metadata comprises a set of instructions for providing the data message with the metadata to a kernel of the Linux OS,
said providing triggering an eBPF (Extended Berkley Packet Filter) program to store the metadata along with a set of header values of the data message in a connection tracker that associates metadata with sets of header values of received data messages for the second firewall process to examine.