# US 12,192,186 B2 · Automatic encryption for cloud-native workloads > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,186 B2 - Document ID: US12192186B2 - Status: Granted - Kind: B2 - Application number: 18/389,417 - Filed: 2023-11-14 - Published: 2024-03-07 - Granted: 2025-01-07 - Earliest claimed: 2021-10-28 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Kyle Andrew Donald Mestery; Vincent E. Parla - Web page: https://patentgrep.com/patent/US12192186B2 ## CPC - H04L 63/0485: {Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up} - H04L 63/18: {using different networks or channels, e.g. using out of band channels (cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215)} - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/0478: {applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key (cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14)} - H04L 63/166: {at the transport layer} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Techniques for routing service mesh traffic based on whether the traffic is encrypted or unencrypted are described herein. The techniques may include receiving, from a first node of a cloud-based network, traffic that is to be sent to a second node of the cloud-based network and determining whether the traffic is encrypted or unencrypted. If it is determined that the traffic is encrypted, the traffic may be sent to the second node via a service mesh of the cloud-based platform. Alternatively, or additionally, if it is determined that the traffic is unencrypted, the traffic may be sent to the second node via an encrypted tunnel. In some examples, the techniques may be performed at least partially by a program running on the first node of the cloud-based network, such as an extended Berkeley Packet Filter (eBPF) program, and the like. ## Claims ### Claim 1 A method comprising: receiving, from a first pod hosting a first container associated with a microservices application, traffic that is to be sent to a second pod; determining that Layer-7 (L7) data within the traffic is unencrypted; and based at least in part on the L7 data being unencrypted, causing the traffic to be sent to the second pod via a Layer-3 (L3) encrypted tunnel between the first pod and the second pod. ### Claim 2 (depends on 1) The method of claim 1, wherein the first pod is running on a first node associated with an orchestration system for managing containerized microservices applications. ### Claim 3 (depends on 2) The method of claim 2, wherein the second pod is running on a second node associated with the orchestration system. ### Claim 4 (depends on 1) The method of claim 1, wherein the second pod is hosting a second container associated with at least one of the microservices application or another microservices application. ### Claim 5 (depends on 1) The method of claim 1, wherein the method is performed at least partially by an extended Berkeley Packet Filter (eBPF) program that is running on a same node as the first pod. ### Claim 6 (depends on 1) The method of claim 1, wherein the L3 encrypted tunnel between the first pod and the second pod is established by an agent executing on a same node as at least one of the first pod or the second pod. ### Claim 7 (depends on 1) The method of claim 1, wherein the L3 encrypted tunnel between the first pod and the second pod is an internet protocol security (IPsec) tunnel. ### Claim 8 (depends on 1) The method of claim 1, wherein the L3 encrypted tunnel between the first pod and the second pod is at least one of a transport layer security (TLS) tunnel, datagram transport layer security (DTLS) tunnel, or a Wireguard tunnel. ### Claim 9 (depends on 1) The method of claim 1, wherein determining that the L7 data within the traffic is unencrypted is based at least in part on inspecting a first packet of the traffic. ### Claim 10 A system comprising: one or more processors; and one or more non-transitory computer-readable media storing instructions that, when executed, cause the one or more processors to perform operations comprising: receiving, from a first container host of an orchestration system for managing containerized microservices applications, traffic that is to be sent to a second container host of the orchestration system, the first container host and the second container host each hosting a container associated with a microservices application; determining that Layer-7 (L7) data within the traffic is unencrypted, wherein determining that the L7 data within the traffic is unencrypted is based at least in part on inspecting a first packet of the traffic; and based at least in part on the L7 data being unencrypted, causing the traffic to be sent to the second container host via a Layer-3 (L3) encrypted tunnel between the first container host and the second container host. ### Claim 11 (depends on 10) The system of claim 10, wherein the first container host is a first pod that is running on a first node of the orchestration system and the second container host is running on at least one of the first node or a second node associated with the orchestration system. ### Claim 12 (depends on 10) The system of claim 10, wherein the L3 encrypted tunnel between the first container host and the second container host is established by an agent executing on a same node as at least one of the first container host or the second container host. ### Claim 13 (depends on 10) The system of claim 10, wherein the L3 encrypted tunnel between the first container host and the second container host is an internet protocol security (IPsec) tunnel. ### Claim 14 (depends on 10) The system of claim 10, wherein the L3 encrypted tunnel between the first container host and the second container host is at least one of a transport layer security (TLS) tunnel, datagram transport layer security (DTLS) tunnel, or a Wireguard tunnel. ### Claim 15 One or more non-transitory computer-readable media storing instructions that, when executed, cause one or more processors to perform operations comprising: receiving, from a first container host of an orchestration system for managing containerized microservices applications, traffic that is to be sent to a second container host of the orchestration system, the first container host and the second container host each hosting a container associated with a microservices application; determining that Layer-7 (L7) data within the traffic is unencrypted; and based at least in part on the L7 data being unencrypted, causing the traffic to be sent to the second container host via a Layer-3 (L3) encrypted tunnel between the first container host and the second container host. ### Claim 16 (depends on 15) The one or more non-transitory computer-readable media of claim 15, wherein the first container host is a first pod that is running on a first node of the orchestration system and the second container host is running on at least one of the first node or a second node associated with the orchestration system. ### Claim 17 (depends on 15) The one or more non-transitory computer-readable media of claim 15, wherein the L3 encrypted tunnel between the first container host and the second container host is established by an agent executing on a same node as at least one of the first container host or the second container host. ### Claim 18 (depends on 15) The one or more non-transitory computer-readable media of claim 15, wherein the L3 encrypted tunnel between the first container host and the second container host is an internet protocol security (IPsec) tunnel. ### Claim 19 (depends on 15) The one or more non-transitory computer-readable media of claim 15, wherein the L3 encrypted tunnel between the first container host and the second container host is at least one of a transport layer security (TLS) tunnel, datagram transport layer security (DTLS) tunnel, or a Wireguard tunnel.