# US 12,598,161 B2 · Extending a trust boundary between cloud domains of the same entity > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,598,161 B2 - Document ID: US12598161B2 - Status: Granted - Kind: B2 - Application number: 17/588,054 - Filed: 2022-01-28 - Published: 2023-08-03 - Granted: 2026-04-07 - Earliest claimed: 2022-01-28 - Assignees: Salesforce, Inc. - Applicants: Salesforce, Inc. - Inventors: Chaitanya Pemmaraju; Joshua Meier; Selim Ciraci - Web page: https://patentgrep.com/patent/US12598161B2 ## CPC - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 63/0245: {Filtering by information in the payload} - H04L 63/0272: {Virtual private networks} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/166: {at the transport layer} - H04L 63/168: {above the transport layer} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 63/0263: {Rule management} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A network protocol and architecture for extending trust between cloud domains of a same entity comprises adding, by egress logic executing on a first server, authentication information to a packet leaving a first cloud domain of the entity to indicate a source of the packet. The egress logic allows the packet to traverse to a target cloud domain of the entity. Ingress logic executing on a second server at the target cloud domain intercepts the packet and performs validation of the authentication information. Responsive to the authentication information passing validation, the ingress logic determines that the first cloud domain is trusted and allows the packet to proceed to a destination. Responsive to the authentication information failing validation, the ingress logic rejects the packet. ## Claims ### Claim 1 A computer-implemented method comprising: intercepting, by one or more computing devices at a target cloud domain of an entity, a packet from a source cloud domain received from a public network, wherein the packet includes an implicit certificate having authentication information indicating the cloud domain source of the packet, the authentication information having been added to the packet by egress logic associated with the source cloud domain; determining, by the one or more computing devices at the target cloud domain, whether the source cloud domain resides within the entity; in response to determining that the source cloud domain resides within the entity, automatically trusting the packet and forwarding the packet to a destination; and in response to determining that the source cloud domain resides outside the entity: extracting, by the one or more computing devices at the target cloud domain, the authentication information from the intercepted packet; validating, by the one or more computing devices at the target cloud domain, the intercepted packet based on the authentication information; and allowing or rejecting, by the one or more computing devices at the target cloud domain, the packet to proceed to a destination responsive to a determination whether the source cloud domain is trusted. ### Claim 2 (depends on 1) The method of claim 1, further comprising implementing an identity-based policy by associating an identifier of the entity or the source cloud domain with the authentication information to identify the source of the packet. ### Claim 3 (depends on 2) The method of claim 2, further comprising enforcing the identity-based policy on a transfer of data packets from server to server within a cloud platform. ### Claim 4 (depends on 1) The method of claim 1, further comprising implementing the authentication information as an explicit token. ### Claim 5 (depends on 4) The method of claim 4, further comprising implementing the authentication information as a Transport Layer Security (TLS) session tunnel for the packet. ### Claim 6 (depends on 5) The method of claim 5, further comprising using, by the one or more computing devices, an Open Systems Interconnection (OSI) layer 7 tunnel to set up the TLS session tunnel and placing the authentication information in a Server Name Indication (SNI) header of the packet. ### Claim 7 (depends on 6) The method of claim 6, further comprising: parsing, by the one or more computing devices, the SNI header to determine if the SNI header contains an identifier of a trusted entity, cloud domain or server; and responsive to the SNI header containing the identifier, decapsulating the SNI header from the packet, by the one or more computing devices, and forwarding an inner packet to a destination service. ### Claim 8 (depends on 4) The method of claim 4, further comprising: implementing the authentication information by encapsulating the packet with a User Datagram Protocol (UDP) header and a JSON Web Token (JWT). ### Claim 9 (depends on 8) The method of claim 8, further comprising inserting, by the one or more computing devices, the JWT into a UDP tunnel packet at a layer 3 network level. ### Claim 10 (depends on 9) The method of claim 9, further comprising validating the JWT, by the one or more computing devices, to determine if the sender is trusted; and responsive to the JWT being validated, stripping the UDP header and forwarding the packet to a destination service. ### Claim 11 A non-transitory machine-readable storage medium that provides instructions that, if executed by a processor, are configurable to cause said processor to perform operations comprising: intercepting, by one or more computing devices at a target cloud domain of an entity, a packet from a source cloud domain received from a public network, wherein the packet includes an implicit certificate having authentication information indicating the source cloud domain of the packet, the authentication information having been added to the packet by egress logic associated with the source cloud domain; determining, by the one or more computing devices at the target cloud domain, whether the source cloud domain resides within the entity; in response to determining that the source cloud domain resides within the entity, automatically trusting the packet and forwarding the packet to a destination; and in response to determining that the source cloud domain resides outside the entity: extracting, by the one or more computing devices at the target cloud domain, the authentication information from the intercepted packet; validating, by the one or more computing devices at the target cloud domain, the intercepted packet based on the authentication information; and allowing or rejecting, by the one or more computing devices at the target cloud domain, the packet to proceed to a destination responsive to a determination whether the source cloud domain is trusted. ### Claim 12 (depends on 11) The non-transitory machine-readable storage medium of claim 11, further comprising implementing an identity-based policy by associating an identifier of the entity or the source cloud domain with the authentication information to identify the source of the packet. ### Claim 13 (depends on 12) The non-transitory machine-readable storage medium of claim 12, further comprising enforcing the identity-based policy on a transfer of data packets from server to server within a cloud platform. ### Claim 14 (depends on 11) The non-transitory machine-readable storage medium of claim 11, further comprising implementing the authentication information as an explicit token. ### Claim 15 (depends on 14) The non-transitory machine-readable storage medium of claim 14, further comprising implementing the authentication information as a Transport Layer Security (TLS) session tunnel for the packet. ### Claim 16 (depends on 15) The non-transitory machine-readable storage medium of claim 15, further comprising using, by the one or more computing devices, an Open Systems Interconnection (OSI) layer 7 tunnel to set up the TLS session tunnel and placing the authentication information in a Server Name Indication (SNI) header of the packet. ### Claim 17 (depends on 16) The non-transitory machine-readable storage medium of claim 16, further comprising: parsing, by the one or more computing devices, the SNI header to determine if the SNI header contains an identifier of a trusted entity, cloud domain or server; and responsive to the SNI header containing the identifier, decapsulating the SNI header from the packet, by the one or more computing devices, and forwarding an inner packet to a destination service. ### Claim 18 (depends on 14) The non-transitory machine-readable storage medium of claim 14, further comprising: implementing the authentication information by encapsulating the packet with a User Datagram Protocol (UDP) header and a JSON Web Token (JWT). ### Claim 19 (depends on 18) The non-transitory machine-readable storage medium of claim 18, further comprising inserting, by the one or more computing devices, the JWT into a UDP tunnel packet at a layer 3 network level. ### Claim 20 (depends on 19) The non-transitory machine-readable storage medium of claim 19, further comprising validating the token, by the one or more computing devices, to determine if the sender is trusted; and responsive to the token being validated, stripping the UDP header and forwarding the packet to a destination service. ### Claim 21 An apparatus comprising: a processor, a non-transitory machine-readable storage medium that provides instructions that, if executed by the processor, are configurable to cause the apparatus to perform operations comprising, intercepting, by one or more computing devices at a target cloud domain of an entity, a packet from a source cloud domain received from a public network, wherein the packet includes an implicit certificate having authentication information indicating the source cloud domain of the packet, the authentication information having been added to the packet by egress logic associated with the source cloud domain; determining, by the one or more computing device at the target cloud domain, whether the source cloud domain resides within the entity; in response to determining that the source cloud domain resides within the entity, automatically trusting the packet and forwarding the packet to a destination; and in response to determining that the source cloud domain resides outside the entity: extracting, by the one or more computing devices at the target cloud domain, the authentication information from the intercepted packet; validating, by the one or more computing devices at the target cloud domain, the intercepted packet based on the authentication information; and allowing or rejecting, by the one or more computing devices at the target cloud domain, the packet to proceed to a destination responsive to a determination whether the source cloud domain is trusted.