# US 12,003,424 B2 · Load balancing communication sessions in a networked computing environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,424 B2 - Document ID: US12003424B2 - Status: Granted - Kind: B2 - Application number: 18/111,075 - Filed: 2023-02-17 - Published: 2023-08-31 - Granted: 2024-06-04 - Earliest claimed: 2020-05-15 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Kyle Andrew Donald Mestery; Andree Toonk; Rahim Lalani; Ian James Wells - Web page: https://patentgrep.com/patent/US12003424B2 ## CPC - H04L 47/726: Reserving resources in multiple paths to be used simultaneously (by balancing the load H04L47/125) - H04L 45/12: Shortest path evaluation - H04L 45/42: Centralised routing - H04L 47/125: by balancing the load, e.g. traffic engineering - H04L 47/781: {Centralised allocation of resources} - H04L 47/801: {Real time traffic} - H04L 63/166: {at the transport layer} - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 67/1027: Persistence of sessions during load balancing - H04L 67/1097: for distributed storage of data in networks, e.g. transport arrangements for network file system [NFS], storage area networks [SAN] or network attached storage [NAS] - H04L 67/146: Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding - H04L 45/7453: using hashing - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques for load balancing communication sessions in a networked computing environment are described herein. The techniques may include establishing a first communication session between a client device and a first computing resource of a networked computing environment. Additionally, the techniques may include storing, in a data store, data indicating that the first communication session is associated with the first computing resource. The techniques may further include receiving, at a second computing resource of the networked computing environment, traffic associated with a second communication session that was sent by the client device, and based at least in part on accessing the data stored in the data store, establishing a traffic redirect such that the traffic and additional traffic associated with the second communication session is sent from the second computing resource to the first computing resource. ## Claims ### Claim 1 A method comprising: receiving a packet of a secure communication flow that is being sent to a first backend node, the packet including a server name indication (SNI) value; determining that the secure communication flow is to be terminated at a second backend node that is different than the first backend node based at least in part on a container associated with the SNI value running on the second backend node; and based at least in part on determining that the secure communication flow is to be terminated at the second backend node, establishing a redirect to forward packets of the secure communication flow from the first backend node to the second backend node. ### Claim 2 (depends on 1) The method of claim 1, further comprising determining a network 5-tuple associated with the packet, wherein establishing the redirect comprises storing, in a routing table, an indication that packets including the network 5-tuple are to be forwarded to the second backend node. ### Claim 3 (depends on 1) The method of claim 1, wherein determining that the secure communication flow is to be terminated at the second backend node comprises determining that a first portion of traffic of the secure communication flow is terminating at the second backend node, the first portion of the traffic originating from a same client device as the packet. ### Claim 4 (depends on 3) The method of claim 3, wherein the first portion of the traffic is encrypted according to a different protocol than the packet and the packets. ### Claim 5 (depends on 1) The method of claim 1, wherein determining that the secure communication flow is to be terminated at the second backend node comprises determining that a first mapping between the SNI value and the second backend node is stored in a database. ### Claim 6 (depends on 5) The method of claim 5, wherein the first mapping is stored in the database by the second backend node, the database further storing (i) a second mapping between the second backend node and a network 5-tuple associated with the secure communication flow and (ii) a third mapping between the second backend node and a session identifier associated with the secure communication flow. ### Claim 7 (depends on 1) The method of claim 1, wherein establishing the redirect comprises storing, in a routing table, an indication that packets including a network 5-tuple associated with the packet are to be forwarded to the second backend node. ### Claim 8 (depends on 1) The method of claim 1, further comprising determining that the container associated with the SNI value is running on the second backend node. ### Claim 9 A system associated with a networking device, the system comprising: one or more processors; and one or more non-transitory computer-readable media storing instructions that, when executed, cause the one or more processors to perform operations comprising: receiving a packet of a secure communication flow that is to be sent to a first backend node, the packet including a server name indication (SNI) value; determining that the secure communication flow is to be terminated at a second backend node that is different than the first backend node based at least in part on a container associated with the SNI value running on the second backend node; and based at least in part on determining that the secure communication flow is to be terminated at the second backend node, establishing a redirect to forward packets of the secure communication flow from the first backend node to the second backend node. ### Claim 10 (depends on 9) The system of claim 9, the operations further comprising determining a network 5-tuple associated with the packet, wherein establishing the redirect comprises storing, in a routing table, an indication that packets including the network 5-tuple are to be forwarded to the second backend node. ### Claim 11 (depends on 9) The system of claim 9, wherein determining that the secure communication flow is to be terminated at the second backend node comprises determining that a first portion of traffic of the secure communication flow is terminating at the second backend node, the first portion of the traffic originating from a same client device as the packet. ### Claim 12 (depends on 11) The system of claim 11, wherein the first portion of the traffic is encrypted according to a different protocol than the packet and the packets. ### Claim 13 (depends on 9) The system of claim 9, wherein determining that the secure communication flow is to be terminated at the second backend node comprises determining that a first mapping between the SNI value and the second backend node is stored in a database. ### Claim 14 (depends on 9) The system of claim 9, wherein establishing the redirect comprises storing, in a routing table, an indication that packets including a network 5-tuple associated with the packet are to be forwarded to the second backend node. ### Claim 15 (depends on 9) The system of claim 9, the operations further comprising determining that the container associated with the SNI value is running on the second backend node. ### Claim 16 One or more non-transitory computer-readable media storing instructions that, when executed, cause one or more processors to perform operations comprising: receiving a packet of a secure communication flow that is being sent to a first backend node, the packet including a server name indication (SNI) value; determining that the secure communication flow is to be terminated at a second backend node that is different than the first backend node based at least in part on a container associated with the SNI value running on the second backend node; and based at least in part on determining that the secure communication flow is to be terminated at the second backend node, establishing a redirect to forward packets of the secure communication flow from the first backend node to the second backend node. ### Claim 17 (depends on 16) The one or more non-transitory computer-readable media of claim 16, the operations further comprising determining a network 5-tuple associated with the packet, wherein establishing the redirect comprises storing, in a routing table, an indication that packets including the network 5-tuple are to be forwarded to the second backend node. ### Claim 18 (depends on 16) The one or more non-transitory computer-readable media of claim 16, wherein determining that the secure communication flow is to be terminated at the second backend node comprises determining that a first portion of traffic of the secure communication flow is terminating at the second backend node, the first portion of the traffic originating from a same client device as the packet. ### Claim 19 (depends on 18) The one or more non-transitory computer-readable media of claim 18, wherein the first portion of the traffic is encrypted according to a different protocol than the packet and the packets. ### Claim 20 (depends on 16) The one or more non-transitory computer-readable media of claim 16, the operations further comprising determining that the container associated with the SNI value is running on the second backend node.