# US 12,010,097 B2 · Network architecture for cloud computing environments

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 12,010,097 B2
- Document ID: US12010097B2
- Status: Granted
- Kind: B2
- Application number: 17/651,417
- Filed: 2022-02-16
- Published: 2022-06-02
- Granted: 2024-06-11
- Earliest claimed: 2018-09-21
- Assignees: Google Inc.
- Applicants: Google LLC
- Inventors: Maurilio Cometto; Mate Ferenczy; Sriganesh Kini; Mohammad Y. Hajjat; Manoj Sharma
- Web page: https://patentgrep.com/patent/US12010097B2

## CPC

- H04L 63/0263: {Rule management}
- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling}
- H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)}
- H04L 61/2514: between local and global IP addresses
- H04L 61/2575: using address mapping retrieval, e.g. simple traversal of user datagram protocol through session traversal utilities for NAT [STUN]
- H04L 63/0209: {Architectural arrangements, e.g. perimeter networks or demilitarized zones}
- H04L 63/101: {Access control lists [ACL]}
- H04L 67/1001: for accessing one among a plurality of replicated servers
- G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

In one embodiment, a system includes a plurality of first host machines implementing a public-cloud computing environment, wherein at least one of the first host machines comprises at least one public-cloud virtual machine (VM) that performs network address translation; and a plurality of second host machines implementing a private-cloud computing environment, wherein at least one of the second host machines comprises one or more private-cloud virtual machines, wherein the public-cloud VM is configured to receive, via a network tunnel from the private-cloud VM, one or more first packets to be sent to a public Internet Protocol (IP) address of a public network host, translate, using a NAT mapping, a source address of each first packet from a private IP address of the private-cloud VM to an IP address of the public-cloud VM, and send the first packet to the IP address of the public-cloud VM.

## Claims

### Claim 1

A computer-implemented method, when executed by data processing hardware of a public-cloud computing environment, causes the data processing hardware to perform operations comprising:
receiving, from a first virtual machine (VM) of a first private-cloud computing environment, via a network tunnel established between the first private-cloud computing environment and the public-cloud computing environment, a first packet comprising:
a source address comprising a first private IP address of the first VM; and
a destination address comprising a second private IP address of a second VM of a second private-cloud computing environment;
translating, using a network address translation (NAT) mapping at a private virtual network of the public-cloud computing environment, the source address of the first packet from the first private IP address of the first VM to a third private IP address of a third VM of the public-cloud computing environment;
sending the first packet to the second private IP address of the second VM of the second private-cloud computing environment;
receiving, from the second VM of the second private-cloud computing environment, a second packet to be sent to the first VM of the first private-cloud computing environment, the second packet comprising a destination address comprising the third private IP address of the third VM;
translating, using the NAT mapping at the private virtual network of the public-cloud computing environment, the destination address of the second packet from the third private IP address of the third VM to the first private IP address of the first VM corresponding to an actual destination of the second packet; and
sending the second packet to the first private IP address of the first VM of the first private-cloud computing environment.

### Claim 2 (depends on 1)

The method of claim 1, wherein the operations further comprise
translating, using the NAT mapping, a second source address of the second packet from the second private IP address of the second VM to the first private IP address of the first VM.

### Claim 3 (depends on 1)

The method of claim 1, wherein the second packet was received in response to sending the first packet.

### Claim 4 (depends on 1)

The method of claim 1, wherein translating the source address of the first packet from the first private IP address of the first VM to the third private IP address of the third VM of the public-cloud computing environment comprises storing, in the NAT mapping, the first private IP address of the first VM.

### Claim 5 (depends on 1)

The method of claim 1, wherein the network tunnel comprises a VxLAN tunnel.

### Claim 6 (depends on 1)

The method of claim 1, wherein translating the source address of the first packet from the first private IP address of the first VM to the third private IP address of the third VM of the public-cloud computing environment comprises de-encapsulating the first packet.

### Claim 7 (depends on 1)

The method of claim 1, wherein translating the source address of the first packet from the first private IP address of the first VM to the third private IP address of the third VM of the public-cloud computing environment comprises load-balancing, using a load balancer, the first packet.

### Claim 8 (depends on 1)

The method of claim 1, wherein the first private-cloud computing environment comprises a leaf-spine network.

### Claim 9 (depends on 1)

The method of claim 1, wherein:
the public-cloud computing environment comprises a public-cloud VM; and
the public-cloud VM receives the first packet from the first VM of the first private-cloud computing environment.

### Claim 10 (depends on 1)

The method of claim 1, wherein the NAT mapping comprises a lookup table.

### Claim 11

A system comprising:
data processing hardware of a public-cloud computing environment; and
memory hardware in communication with the data processing hardware, the memory hardware storing instructions that when executed on the data processing hardware cause the data processing hardware to perform operations comprising:
receiving, from a first virtual machine (VM) of a first private-cloud computing environment, via a network tunnel established between the first private-cloud computing environment and the public-cloud computing environment, a first packet comprising:
a source address comprising a first private IP address of the first VM; and
a destination address comprising a second private IP address of a second VM of a second private-cloud computing environment;
translating, using a network address translation (NAT) mapping at a private virtual network of the public-cloud computing environment, the source address of the first packet from the first private IP address of the first VM to a third private IP address of a third VM of the public-cloud computing environment;
sending the first packet to the second private IP address of the second VM of the second private-cloud computing environment;
receiving, from the second VM of the second private-cloud computing environment, a second packet to be sent to the first VM of the first private-cloud computing environment, the second packet comprising a destination address comprising the third private IP address of the third VM;
translating, using the NAT mapping at the private virtual network of the public-cloud computing environment, the destination address of the second packet from the third private IP address of the third VM to the first private IP address of the first VM corresponding to an actual destination of the second packet; and
sending the second packet to the first private IP address of the first VM of the first private-cloud computing environment.

### Claim 12 (depends on 11)

The system of claim 11, wherein the operations further comprise
translating, using the NAT mapping, a second source address of the second packet from the second private IP address of the second VM to the first private IP address of the first VM.

### Claim 13 (depends on 11)

The system of claim 11, wherein the second packet was received in response to sending the first packet.

### Claim 14 (depends on 11)

The system of claim 11, wherein translating the source address of the first packet from the first private IP address of the first VM to the third private IP address of the third VM of the public-cloud computing environment comprises storing, in the NAT mapping, the first private IP address of the first VM.

### Claim 15 (depends on 11)

The system of claim 11, wherein the network tunnel comprises a VxLAN tunnel.

### Claim 16 (depends on 11)

The system of claim 11, wherein translating the source address of the first packet from the first private IP address of the first VM to the third private IP address of the third VM of the public-cloud computing environment comprises de-encapsulating the first packet.

### Claim 17 (depends on 11)

The system of claim 11, wherein translating the source address of the first packet from the first private IP address of the first VM to the third private IP address of the third VM of the public-cloud computing environment comprises load-balancing, using a load balancer, the first packet.

### Claim 18 (depends on 11)

The system of claim 11, wherein the first private-cloud computing environment comprises a leaf-spine network.

### Claim 19 (depends on 11)

The system of claim 11, wherein:
the public-cloud computing environment comprises a public-cloud VM; and
the public-cloud VM receives the first packet from the first VM of the first private-cloud computing environment.

### Claim 20 (depends on 11)

The system of claim 11, wherein the NAT mapping comprises a lookup table.