# US 12,113,773 B2 · Dynamic path selection of VPN endpoint > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,113,773 B2 - Document ID: US12113773B2 - Status: Granted - Kind: B2 - Application number: 17/570,364 - Filed: 2022-01-06 - Published: 2022-12-08 - Granted: 2024-10-08 - Earliest claimed: 2021-06-07 - Assignees: VMware, Inc. - Applicants: VMware LLC - Inventors: Deepika Solanki; Awan Kumar Sharma; Yong Wang; Sourabh Bhattacharya; Sarthak Ray - Web page: https://patentgrep.com/patent/US12113773B2 ## CPC - H04L 63/0272: {Virtual private networks} - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 45/24: Multipath - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Some embodiments provide a method that identifies multiple paths between a first site and a second site. A security association (SA) is established for transmitting encrypted payload from the first site to the second site in a virtual private network (VPN) session. The method selects a path based on metrics that are obtained for the paths. The selected path is defined by a first endpoint address of the first site and a second endpoint address of the second site. The method sends a message from the first site to the second site to update the SA to switch from using an original path to using the selected path. The message indicates the first and second endpoint addresses. The method transmits a packet including a payload that is encrypted according to the updated SA. ## Claims ### Claim 1 A method comprising: identifying a plurality of paths between a first site and a second site, wherein a security association (SA) is established for transmitting encrypted payload from the first site to the second site in a virtual private network (VPN) session; selecting a path from the plurality of paths based on metrics that are obtained for the plurality of paths, the selected path defined by a first endpoint address of the first site and a second endpoint address of the second site; sending a message from the first site to the second site to update the SA to switch from using an original path to using the selected path, the message indicating the first and second endpoint addresses, and the SA being associated with a shared security attribute between the first site and the second site; and transmitting a packet comprising a payload that is encrypted according to the updated SA. ### Claim 2 (depends on 1) The method of claim 1, wherein only one path in one link is active at a time. ### Claim 3 (depends on 2) The method of claim 2, wherein the only one active path has a best path metric among the plurality of paths. ### Claim 4 (depends on 1) The method of claim 1, wherein sending the message to update the SA to use the selected path does not interrupt or re-establish the SA. ### Claim 5 (depends on 1) The method of claim 1 further comprising sending probe messages and receiving responses to the probe messages, wherein the obtained metrics for the identified paths are determined based on the received responses to the probe messages. ### Claim 6 (depends on 1) The method of claim 1, wherein outer addresses of the packet are updated according to the first and second endpoint addresses while addresses and other traffic selectors used for routing the packet inside a VPN tunnel remain unchanged. ### Claim 7 (depends on 1) The method of claim 1 further comprising exchanging a first list of endpoint addresses of the first site and a second list of endpoint addresses of the second site for the SA, wherein the first list of endpoint addresses comprises the first endpoint address and the second list of endpoint addresses comprises the second endpoint address. ### Claim 8 (depends on 7) The method of claim 7, wherein the obtained metrics are stored in a path matrix that is specified based on the first and second lists of endpoint addresses. ### Claim 9 (depends on 1) The method of claim 1, wherein the metric of a path is determined based on at least one of connectivity, latency, drop rate, jitter of the path. ### Claim 10 (depends on 1) The method of claim 1, wherein Equal-cost multi-path (ECMP) routing is performed based on the first and second endpoint addresses that define the selected path. ### Claim 11 A non-transitory machine-readable medium storing a program for execution by at least one processing unit, the program comprising sets of instructions for: identifying a plurality of paths between a first site and a second site, wherein a security association (SA) is established for transmitting encrypted payload from the first site to the second site in a virtual private network (VPN) session; selecting a path from the plurality of paths based on metrics that are obtained for the plurality of paths, the selected path defined by a first endpoint address of the first site and a second endpoint address of the second site; sending a message from the first site to the second site to update the SA to switch from using an original path to using the selected path, the message indicating the first and second endpoint addresses, and the SA being associated with a shared security attribute between the first site and the second site; and transmitting a packet comprising a payload that is encrypted according to the updated SA. ### Claim 12 (depends on 11) The non-transitory machine-readable medium of claim 11, wherein only one path in one link is active at a time and the only one active path has a best path metric among the plurality of paths. ### Claim 13 (depends on 11) The non-transitory machine-readable medium of claim 11, wherein sending the message to update the SA to use the selected path does not interrupt or re-establish the SA. ### Claim 14 (depends on 11) The non-transitory machine-readable medium of claim 11, wherein the program further comprises a set of instructions for sending probe messages and receiving responses to the probe messages, wherein the obtained metrics for the identified paths are determined based on the received responses to the probe messages. ### Claim 15 A computing device comprising: a set of processing units; and non-transitory machine-readable medium storing a program for execution by at least one of the processing units, the program comprising sets of instructions for: identifying a plurality of paths between a first site and a second site, wherein a security association (SA) is established for transmitting encrypted payload from the first site to the second site in a virtual private network (VPN) session; selecting a path from the plurality of paths based on metrics that are obtained for the plurality of paths, the selected path defined by a first endpoint address of the first site and a second endpoint address of the second site; sending a message from the first site to the second site to update the SA to switch from using an original path to using the selected path, the message indicating the first and second endpoint addresses, and the SA being associated with a shared security attribute between the first site and the second site; and transmitting a packet comprising a payload that is encrypted according to the updated SA. ### Claim 16 (depends on 15) The computing device of claim 15, wherein the program further comprises a set of instructions for exchanging a first list of endpoint addresses of the first site and a second list of endpoint addresses of the second site for the SA, wherein the first list of endpoint addresses comprises the first endpoint address and the second list of endpoint addresses comprises the second endpoint address. ### Claim 17 (depends on 16) The computing device of claim 16, wherein the obtained metrics are stored in a path matrix that is specified based on the first and second lists of endpoint addresses. ### Claim 18 (depends on 15) The computing device of claim 15, wherein the metric of a path is determined based on at least one of connectivity, latency, drop rate, jitter of the path. ### Claim 19 (depends on 15) The computing device of claim 15, wherein Equal-cost multi-path (ECMP) routing is performed based on the first and second endpoint addresses that define the selected path. ### Claim 20 (depends on 1) The method of claim 1, wherein the SA comprises at least one of a mutually agreed-upon key, a secure protocol, or a security parameter index (SPI) value identifying the SA.