# US 12,603,865 B2 · Systems and methods for remote access latency reduction > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,603,865 B2 - Document ID: US12603865B2 - Status: Granted - Kind: B2 - Application number: 18/136,841 - Filed: 2023-04-19 - Published: 2024-10-24 - Granted: 2026-04-14 - Earliest claimed: 2023-04-19 - Assignees: Mastercard International Incorporated - Applicants: Mastercard International Incorporated - Inventors: Gregory T. Spillman - Web page: https://patentgrep.com/patent/US12603865B2 ## CPC - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 63/0218: {Distributed architectures, e.g. distributed firewalls} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/0272: {Virtual private networks} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Systems and methods are provided for use in providing remote access across multiple regions. One example method includes receiving a remote access request from a user terminal associated with a remote user, where the request is specific to a first data center of a network, and opening, by a front-end firewall, a first IP security (IPSec) tunnel with the user terminal. The method also includes forwarding, by the front-end firewall, the request to a distribution firewall and routing, by the distribution firewall, the request to a back-end firewall, which is specific to the first data center. The method then further includes opening, by the back-end firewall, a second IPSec tunnel with the network and forwarding the request, through the second IPSec tunnel, to the network to thereby support communication between the user terminal and the network, via the first and second IPSec tunnels. ## Claims ### Claim 1 A system for use in providing remote access across multiple regions, the system comprising: a cloud platform including multiple front-end firewalls, multiple back-end firewalls, and at least one distribution firewall disposed in communication between the multiple front-end firewalls and the multiple back-end firewalls; wherein each of the multiple front-end firewalls is associated with a different subregion of the multiple regions, and is configured to: receive a remote access request from a user terminal associated with a remote user, the remote access request specific to a first data center of a corporate network; enforce one or more policies for the remote access request; and upon conformance with the one or more policies, open a first IP security (IPSec) tunnel with a terminal associated with the remote access request and forward the remote access request to the at least one distribution firewall; and wherein the at least one distribution firewall is configured to receive the remote access request from the front-end firewall and to route the remote access request from the front-end firewall to one of the multiple back-end firewalls, which is specific to the first data center; and wherein the one of the multiple back-end firewalls is configured to: enforce one or more further policies associated with the remote access request; and upon conformance with the one or more further policies, open a second IPSec tunnel with the corporate network and forward the remote access request, through the second IPSec tunnel, to the corporate network, whereby remote access is provided to the user terminal through the first and second IPSec tunnels. ### Claim 2 (depends on 1) The system of claim 1, wherein each of the multiple back-end firewalls is associated with one of the different subregions of the multiple regions; and wherein the multiple regions include geographical regions. ### Claim 3 (depends on 2) The system of claim 2, wherein the one or more policies includes authentication of the remote user associated with the remote access request. ### Claim 4 (depends on 1) The system of claim 1, wherein each of the multiple back-end firewalls is not configured to forward traffic to a different one of the multiple back-end firewalls. ### Claim 5 (depends on 1) The system of claim 1, wherein the one of the multiple front-end firewalls, the at least one distribution firewall, and the one of the multiple back-end firewalls are configured to support communication between the user terminal and the corporate network, via the first and second IPSec tunnels. ### Claim 6 (depends on 5) The system of claim 5, wherein the corporate network includes a corporate firewall; and wherein the one of the multiple back-end firewalls is configured to open the second IPSec tunnel with the corporate firewall of the corporate network. ### Claim 7 (depends on 6) The system of claim 6, wherein the corporate network includes the first data center in communication with the corporate firewall; and wherein the communication is between the user terminal and the data center. ### Claim 8 (depends on 7) The system of claim 7, wherein the multiple front-end firewalls, the at least one distribution firewall, and the one of the multiple back-end firewalls are included in a single cloud platform. ### Claim 9 A computer-implemented method for use in providing remote access across multiple regions, the method comprising: receiving, by one of multiple front-end firewalls of a cloud platform, a remote access request from a user terminal associated with a remote user, the remote access request specific to a first data center of a corporate network, each of the multiple front-end firewalls associated with a different subregion of the multiple regions; enforcing, by the one of the multiple front-end firewalls, one or more policies for the remote access request; and upon conformance with the one or more policies: opening, by the one of the multiple front-end firewalls, a first IP security (IPSec) tunnel with a terminal associated with the remote access request; and forwarding, by the one of the multiple front-end firewalls, the remote access request to a distribution firewall of the cloud platform; and receiving, by the distribution firewall of the cloud platform, the remote access request from the one of the multiple front-end firewalls, the distribution firewall disposed in communication between the multiple front-end firewalls and multiple back-end firewalls of the cloud platform; routing, by the distribution firewall, the remote access request from the one of the multiple front-end firewalls to one of the multiple back-end firewalls of the cloud platform, which is specific to the first data center; enforcing, by the one of the multiple back-end firewalls, one or more further policies associated with the remote access request; and upon conformance with the one or more further policies: opening, by the one of the multiple back-end firewalls, a second IPSec tunnel with the corporate network; and forwarding, by the one of the multiple back-end firewalls, the remote access request, through the second IPSec tunnel, to the corporate network, whereby remote access is provided to the user terminal through the first and second IPSec tunnels. ### Claim 10 (depends on 9) The computer-implemented method of claim 9, wherein each of the multiple back-end firewalls is associated with one of the different subregions of the multiple regions; and wherein the multiple regions include geographical regions. ### Claim 11 (depends on 9) The computer-implemented method of claim 9, wherein the one or more policies includes authentication of the remote user associated with the remote access request. ### Claim 12 (depends on 9) The computer-implemented method of claim 9, wherein the corporate network includes a corporate firewall; and wherein opening, by the one of the multiple back-end firewalls, the second IPSec tunnel with the corporate network includes opening the second IPSec tunnel with the corporate firewall of the corporate network.