# US 12,225,022 B2 · Systems and methods for secure communication in cloud computing environments > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,225,022 B2 - Document ID: US12225022B2 - Status: Granted - Kind: B2 - Application number: 17/506,186 - Filed: 2021-10-20 - Published: 2022-02-03 - Granted: 2025-02-11 - Earliest claimed: 2019-01-22 - Assignees: Capital One Services, LLC - Applicants: Capital One Services, LLC - Inventors: Paul Ellis Mayes - Web page: https://patentgrep.com/patent/US12225022B2 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1433: {Vulnerability analysis} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Disclosed embodiments provide systems, methods, and computer-readable storage media for secure data communication between two devices. A disclosed system responds to a request from an originating communication device in a first network to connect with a communication device in a second network, for communication, by receiving a request from the communication device in the first network, the request including payload data and a destination network address in the second network. The system then transmits the received payload data to the destination address in the second network after analyzing the payload data for network intrusion. When the analysis does not indicate network intrusion, the system determines a route to the destination network address by looking up the destination address in a routing table and forwarding the payload data to the destination network address in the second network. If the analysis indicates network intrusion, the system discards the payload data. ## Claims ### Claim 1 A system for secure data communications, comprising: an external detection device; and a cloud environment associated with a cloud computing service, comprising: one or more memory devices; a first set of partitioned communication devices; a second set of partitioned communication devices; and one or more processors executing instructions stored in the one or more memory devices to perform operations comprising: receiving, at the first set of partitioned communication devices, out-bound data for the second set of partitioned communication devices, wherein devices in the first set of partitioned communication devices are prevented from directly communicating with other communication devices outside of the first set of partitioned communication devices by rejecting direct inbound data communication from the other communication devices; routing the out-bound data from the first set of partitioned communication devices to the external detection device; and causing the external detection device to; analyze the out-bound data, and selectively forward at least a portion the out-bound data that has been analyzed by the external detection device to the second set of partitioned communication devices. ### Claim 2 (depends on 1) The system of claim 1, wherein routing the out-bound data further comprises adding a destination network address to the out-bound data. ### Claim 3 (depends on 1) The system of claim 1, wherein causing the external detection device to selectively forward at least the portion of the out-bound data further comprises; adding an address of an originating communication device, wherein communication traffic received by the first set of partitioned communication devices is further associated with the originating communication device. ### Claim 4 (depends on 3) The system of claim 3, wherein only a first data communication from the originating communication device contains the address. ### Claim 5 (depends on 1) The system of claim 1, wherein the external detection device is in a geographically different location from the first set of partitioned communication devices and the second set of partitioned communication devices. ### Claim 6 (depends on 1) The system of claim 1, wherein causing the external detection device to analyze the out-bound data comprises: causing the external detection device to review addresses of allowed networked addresses. ### Claim 7 (depends on 1) The system of claim 1, wherein causing the external detection device to analyze the out-bound data comprises: causing the external detection device to discard a particular portion of the out-bound data having signs of network intrusion. ### Claim 8 (depends on 1) The system of claim 1, wherein causing the external detection device to selectively forward the out-bound data comprises: causing the external detection device to transmit at least the portion of the out-bound data to a communication device in a third set of partitioned communication devices of the cloud environment. ### Claim 9 A method comprising: receiving, at a first set of partitioned communication devices of a cloud environment, out-bound data directed to a second set of partitioned communication devices of the cloud environment, wherein devices in the first set of partitioned communication devices are prevented from directly communicating with other communication devices outside of the first set of partitioned communication devices by rejecting direct inbound data communication from the other communication devices; routing the out-bound data from the first set of partitioned communication devices to an external detection device, the external detection device is external to the cloud environment; and causing the external detection device to analyze the out-bound data and selectively forward at least a portion the out-bound data that has been analyzed by the external detection device to the second set of partitioned communication devices. ### Claim 10 (depends on 9) The method of claim 9, wherein routing the out-bound data further comprises adding a destination network address to the out-bound data. ### Claim 11 (depends on 9) The method of claim 9, wherein causing the external detection device to selectively forward at least the portion of the out-bound data further comprises: adding an address of an originating communication device, wherein communication traffic received by the first set of partitioned communication devices is further associated with the originating communication device. ### Claim 12 (depends on 11) The method of claim 11, wherein only a first data communication from the originating communication device contains the address. ### Claim 13 (depends on 9) The method of claim 9, wherein the external detection device is in a geographically different location from the first set of partitioned communication devices and the second set of partitioned communication devices. ### Claim 14 (depends on 9) The method of claim 9, wherein causing the external detection device to analyze the out-bound data comprises: causing the external detection device to review addresses of allowed networked addresses. ### Claim 15 (depends on 9) The method of claim 9, wherein causing the external detection device to analyze the out-bound data comprises: causing the external detection device to discard a particular portion of the out-bound data having signs of network intrusion. ### Claim 16 (depends on 9) The method of claim 9, wherein causing the external detection device to selectively forward the out-bound data comprises: causing the external detection device to transmit at least the portion of the out-bound data to a communication device in a third set of partitioned communication devices. ### Claim 17 One or more non-transitory computer-readable storage media storing instructions that when executed by one or more processors cause the one or more processors to perform operations comprising: receiving, at a first set of partitioned communication devices of a network environment, out-bound data directed to a second set of partitioned communication devices of the network environment, wherein devices in the first set of partitioned communication devices are prevented from directly communicating with other communication devices outside of the first set of partitioned communication devices by rejecting direct inbound data communication from the other communication devices; routing the out-bound data from the first set of partitioned communication devices to an external detection device; and causing the external detection device to analyze the out-bound data and selectively forward at least a portion the out-bound data that has been analyzed by the external detection device to the second set of partitioned communication devices. ### Claim 18 (depends on 17) The one or more non-transitory computer-readable storage media of claim 17, wherein routing the out-bound data further comprises; adding a destination network address to the out-bound data. ### Claim 19 (depends on 17) The one or more non-transitory computer-readable storage media of claim 17, wherein causing the external detection device to selectively forward at least the portion of the out-bound data further comprises; adding an address of an originating communication device, wherein communication traffic received by the first set of partitioned communication devices is further associated with the originating communication device. ### Claim 20 (depends on 19) The one or more non-transitory computer-readable storage media of claim 19, wherein only a first data communication from the originating communication device contains the address.