# US 12,603,875 B2 · Connection establishment using shared certificate in global server load balancing (GSLB) environment > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,603,875 B2 - Document ID: US12603875B2 - Status: Granted - Kind: B2 - Application number: 18/377,825 - Filed: 2023-10-08 - Published: 2025-04-10 - Granted: 2026-04-14 - Earliest claimed: 2023-10-08 - Assignees: VMware, Inc. - Applicants: VMware LLC - Inventors: Ravi Kumar Reddy Kottapalli; Sudarshana Kandachar Sridhara Rao; Venkata Swamy Babu Budumuru; Dinesh Kumar Kamalakannan; Prasanna Kumar Subramanyam; Vidya Koteeswaran; Prashant Mishra; Santosh Singh - Web page: https://patentgrep.com/patent/US12603875B2 ## CPC - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/0807: {using tickets, e.g. Kerberos (cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213)} - H04L 61/4511: using domain name system [DNS] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Example methods and systems for connection establishment in a global server load balancer (GSLB) environment are described. In one example, a computer system may establish a first connection with a first entity and a second connection with the second entity. The first connection may be established based on first parameter information that includes a shared certificate and a first identifier (ID). The second connection may be established based on second parameter information that includes the shared certificate and a second ID. The shared certificate may be shared by multiple entities that include the first entity and a second entity. In response to receiving a first request, a first response may be generated and sent towards the first entity via the first connection. In response to receiving a second request, a second response may be generated and sent towards the second entity via the second connection. ## Claims ### Claim 1 A method for a computer system to perform connection establishment in a global server load balancer (GSLB) environment that includes at least a first site and a second site, wherein the method comprises: establishing a first connection with a first entity associated with the first site based on first parameter information that includes (a) a shared certificate and (b) a first identifier (ID) that is uniquely associated with the first entity or the first site, the shared certificate being shared by multiple entities that include the first entity and a second entity; establishing a second connection with the second entity associated with the second site based on second parameter information that includes (a) the shared certificate and (b) a second ID that is uniquely associated with the second entity or the second site; in response to receiving a first request from the first entity associated with the first site via the first connection, generating and sending a first response towards the first entity via the first connection; and in response to receiving a second request from the second entity associated with the second site via the second connection, generating and sending a second response towards the second entity via the second connection. ### Claim 2 (depends on 1) The method of claim 1, wherein establishing the first connection comprises: receiving, from the first entity acting as a first client, a first connection establishment packet that includes (a) the shared certificate and (b) the first ID, wherein the first ID is included in a type-length-value (TLV) option field in the first connection establishment packet; and performing identity verification of the first entity based on the shared certificate in the first connection establishment packet. ### Claim 3 (depends on 1) The method of claim 1, wherein establishing the second connection comprises: receiving, from the second entity acting as a second client, a second connection establishment packet that includes (a) the shared certificate and (b) the second ID, wherein the shared certificate and the second ID are encoded in a secure token format in the second connection establishment packet; and performing identity verification of the second entity based on the shared certificate in the second connection establishment packet. ### Claim 4 (depends on 1) The method of claim 1, wherein establishing the first connection and the second connection comprises: establishing, by the computer system acting as a server, (a) the first connection with the first entity acting as a first client and (b) the second connection with the second entity acting as a second client, the shared certificate being sent from the first site towards the second site via a management channel. ### Claim 5 (depends on 1) The method of claim 1, wherein the method further comprises: generating health information based on multiple traffic flows between (a) multiple client devices accessing a service and (b) a pool of backend servers providing the service, wherein the pool is accessible via the computer system in the form of a load balancer. ### Claim 6 (depends on 5) The method of claim 5, wherein the method further comprises: generating the health information to include (a) mapping information that maps at least one of the multiple traffic flows to the first ID or the second ID and (b) one or more of the following health scores: security score, network utilization score and resource utilization score. ### Claim 7 (depends on 5) The method of claim 5, wherein generating the first response and the second response comprises: generating the first response to include the health information and sending the first response towards the first entity in the form of a first health monitor associated with a first domain name system (DNS) server; and generating the second response to include the health information and sending the second response towards the second entity in the form of a second health monitor associated with a second DNS server. ### Claim 8 A non-transitory computer-readable storage medium that includes a set of instructions which, in response to execution by a processor of a computer system, cause the processor to perform a method of connection establishment in a global server load balancer (GSLB) environment that includes at least a first site and a second site, wherein the method comprises: establishing a first connection with a first entity associated with the first site based on first parameter information that includes (a) a shared certificate and (b) a first identifier (ID) that is uniquely associated with the first entity or the first site, the shared certificate being shared by multiple entities that include the first entity and a second entity; establishing a second connection with the second entity associated with the second site based on second parameter information that includes (a) the shared certificate and (b) a second ID that is uniquely associated with the second entity or the second site; in response to receiving a first request from the first entity associated with the first site via the first connection, generating and sending a first response towards the first entity via the first connection; and in response to receiving a second request from the second entity associated with the second site via the second connection, generating and sending a second response towards the second entity via the second connection. ### Claim 9 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein establishing the first connection comprises: receiving, from the first entity acting as a first client, a first connection establishment packet that includes (a) the shared certificate and (b) the first ID, wherein the first ID is included in a type-length-value (TLV) option field in the first connection establishment packet; and performing identity verification of the first entity based on the shared certificate in the first connection establishment packet. ### Claim 10 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein establishing the second connection comprises: receiving, from the second entity acting as a second client, a second connection establishment packet that includes (a) the shared certificate and (b) the second ID, wherein the shared certificate and the second ID are encoded in a secure token format in the second connection establishment packet; and performing identity verification of the second entity based on the shared certificate in the second connection establishment packet. ### Claim 11 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein establishing the first connection and the second connection comprises: establishing, by the computer system acting as a server, (a) the first connection with the first entity acting as a first client and (b) the second connection with the second entity acting as a second client, the shared certificate being sent from the first site towards the second site via a management channel. ### Claim 12 (depends on 8) The non-transitory computer-readable storage medium of claim 8, wherein the method further comprises: generating health information based on multiple traffic flows between (a) multiple client devices accessing a service and (b) a pool of backend servers providing the service, wherein the pool is accessible via the computer system in the form of a load balancer. ### Claim 13 (depends on 12) The non-transitory computer-readable storage medium of claim 12, wherein the method further comprises: generating the health information to include (a) mapping information that maps at least one of the multiple traffic flows to the first ID or the second ID and (b) one or more of the following health scores: security score, network utilization score and resource utilization score. ### Claim 14 (depends on 12) The non-transitory computer-readable storage medium of claim 12, wherein generating the first response and the second response comprises: generating the first response to include the health information and sending the first response towards the first entity in the form of a first health monitor associated with a first domain name system (DNS) server; and generating the second response to include the health information and sending the second response towards the second entity in the form of a second health monitor associated with a second DNS server. ### Claim 15 A method for an entity, being a first entity, to perform connection establishment in a global server load balancer (GSLB) environment that includes at least a first site and a second site, wherein the method comprises: obtaining a shared certificate and a first identifier (ID), wherein the shared certificate is shared by multiple entities that include the first entity associated with the first site and a second entity associated with the second site, and the first ID is uniquely associated with the first entity or the first site; establishing a first connection with a computer system based on first parameter information that includes (a) the shared certificate and (b) the first ID, wherein a load balancer is capable of establishing a second connection with the second entity based on second parameter information that includes (a) the shared certificate and (b) a second ID that is uniquely associated with the second entity or the second site; generating and sending, via the first connection, a request for health information towards the computer system via the first connection; and receiving, from the computer system via the first connection, a response that includes the health information. ### Claim 16 (depends on 15) The method of claim 15, wherein establishing the first connection comprises: generating and sending, towards the computer system, a first connection establishment packet that includes (a) the shared certificate and (b) the first ID, wherein the first ID is included in a type-length-value (TLV) option field in the first connection establishment packet. ### Claim 17 (depends on 15) The method of claim 15, wherein establishing the first connection comprises: establishing the first connection between (a) the first entity in the form of health monitor configured for a service and (b) the computer system that implements the load balancer via which a pool of backend servers providing the service are accessible. ### Claim 18 (depends on 17) The method of claim 17, wherein establishing the first connection comprises: generating and sending, towards the computer system, a first connection establishment packet that includes (a) the shared certificate and (b) the first ID, wherein the shared certificate and the first ID are encoded in a secure token format in the second connection establishment packet. ### Claim 19 (depends on 15) The method of claim 15, wherein obtaining the shared certificate comprises: obtaining the shared certificate from one of the following: (a) a management entity or (b) the second site via a management channel. ### Claim 20 (depends on 15) The method of claim 15, wherein receiving the response comprises: receiving the response that includes the health information that is generated based on multiple traffic flows between (a) multiple client devices accessing a service and (b) a pool of backend servers providing the service, wherein the pool is accessible via the computer system in the form of the load balancer. ### Claim 21 (depends on 15) The method of claim 15, wherein receiving the response comprises: receiving the response that includes the health information that includes (a) mapping information that maps at least one of the multiple traffic flows to the first ID or the second ID and (b) one or more of the following health scores: security score, network utilization score and resource utilization score.