# US 12,603,892 B2 · Global mapping to internal applications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,603,892 B2 - Document ID: US12603892B2 - Status: Granted - Kind: B2 - Application number: 18/236,454 - Filed: 2023-08-22 - Published: 2025-02-27 - Granted: 2026-04-14 - Earliest claimed: 2023-08-22 - Assignees: Akamai Technologies, Inc. - Applicants: Akamai Technologies, Inc. - Inventors: David Tang - Web page: https://patentgrep.com/patent/US12603892B2 ## CPC - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - H04L 43/10: Active monitoring, e.g. heartbeat, ping or trace-route - H04L 67/141: Setup of application sessions (admission control or resource allocation in data switching networks H04L47/70) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A service for automatic discovery of locations at which instances of an internal enterprise application are located. The service is configured to facilitate routing of connection requests directed to the internal enterprise application, which is hosted in distinct enterprise locations. The service works in association with a set of connectors that each have an associated Internet Protocol (IP) address (typically of a device to which the connector is coupled) at which it is reachable and through which a connection to an internal enterprise application instance can be proxied. Connections to the internal enterprise application are routable along a network path from a client to a given connector through a set of intermediary nodes. Using information collected from the connectors, the service performs a series of correlations to enable service provider mapping technologies to make both global and local traffic mapping decisions for these internal enterprise resources. In a variant embodiment wherein connectors can access the application across site-to-site connections, the system also leverages connector-to-origin latency data to facilitate a full path mapping solution. ## Claims ### Claim 1 A method of connection routing in an overlay network accessible to multiple tenants, wherein a tenant has an associated enterprise application that resides in multiple private geo-locations, the multiple private geo-locations being interconnected in a site-to-site manner, the overlay network comprising a set of intermediary nodes, and a mapping service, comprising: configuring a connector in each private geo-location, wherein the connector has connectivity to the enterprise application in the private geo-location in which the connector is configured, and to the enterprise application residing in at least one other private geo-location to which the connector can access via site-to-site interconnections; receiving information from each connector, the information comprising a public IP address of a device associated with the connector, a set of internal IP addresses reachable within the geo-location from the connector, and a measurement of the connector's relative connectivity to the enterprise application that resides in the multiple private geo-locations; responsive to receipt of a connection request from a client that is directed to the enterprise application, using the information received from the connectors to identify a path to a particular connector in a given private geo-location to handle the connection request; interoperating with the mapping service to cause the connection request to be forwarded across one or more intermediary nodes to the particular connector; and using the particular connector to establish an end-to-end connection between the client and the enterprise application. ### Claim 2 (depends on 1) The method as described in claim 1, wherein the measurement of the connector's relative connectivity to the enterprise application is obtained from a network traffic test. ### Claim 3 (depends on 2) The method as described in claim 2 wherein the network traffic test is a ping. ### Claim 4 (depends on 3) The method as described in claim 3 further including periodically initiating the ping to obtain a round trip time (RTT) from the connector to each instance of the enterprise application that is reachable via the site-to-site interconnections. ### Claim 5 (depends on 1) The method as described in claim 1, wherein the information is received by the mapping service. ### Claim 6 (depends on 5) The method as described in claim 5, wherein the mapping service uses the measurements of the connector's relative connectivity to each instance of the enterprise application that is reachable via the site-to-site interconnections in a shortest path algorithm. ### Claim 7 (depends on 1) The method as described in claim 1, wherein the overlay network provides the multiple tenants with a Zero Trust Network Access (ZTNA) service. ### Claim 8 (depends on 1) The method as described in claim 1, wherein the intermediary nodes are associated with the service provider. ### Claim 9 (depends on 1) The method as described in claim 1 wherein the site-to-site interconnections are via Multi-Protocol Label Switching (MPLS). ### Claim 10 An apparatus, comprising: a processor; computer memory storing computer program instructions configured to provide connection routing in an overlay network accessible to multiple tenants, wherein a tenant has an associated enterprise application that resides in multiple private geo-locations, the multiple private geo-locations being interconnected in a site-to-site manner, each private geo-location having a connector cnfigured therein that has connectivity to (i) the enterprise application in the private geo-location in which the connector is configured, and (ii) to the enterprise application in at least one other private geo-location to which the connector can access via site-to-site interconnections, the overlay network comprising a set of intermediary nodes, and a mapping service, the computer program instructions comprising program code configured to: receive information from each connector, the information comprising a public IP address of a device associated with the connector, a set of internal IP addresses reachable within the geo-location from the connector, and a measurement of the connector's relative connectivity to the enterprise application that resides in the multiple private geo-locations; responsive to receipt of a connection request from a client that is directed to the enterprise application, use the information received from the connectors to identify a path to a particular connector in a given private geo-location to handle the connection request; interoperate with the mapping service to cause the connection request to be forwarded across one or more intermediary nodes to the particular connector; and control the particular connector to establish an end-to-end connection between the client and the enterprise application. ### Claim 11 (depends on 10) The apparatus as described in claim 10, wherein the measurement of the connector's relative connectivity to the enterprise application is obtained from a network traffic test. ### Claim 12 (depends on 11) The apparatus as described in claim 11 wherein the network traffic test is a ping. ### Claim 13 (depends on 12) The apparatus as described in claim 12 wherein the program code is configured to periodically initiate the ping to obtain a round trip time (RTT) from the connector to each instance of the enterprise application that is reachable via the site-to-site interconnections. ### Claim 14 (depends on 10) The apparatus as described in claim 10, wherein the overlay network provides the multiple tenants with a Zero Trust Network Access (ZTNA) service. ### Claim 15 A computer program product in a non-transitory computer-readable medium, the computer program product comprising computer program instructions configured as program code and executable in one or more hardware processors to provide connection routing in an overlay network accessible to multiple tenants, wherein a tenant has an associated enterprise application that resides in multiple private geo-locations, the multiple private geo-locations being interconnected in a site-to-site manner, the overlay network comprising a set of intermediary nodes, and a mapping service, the program code comprising: a connector configured in each private geo-location, wherein the connector has connectivity to the enterprise application in the private geo-location in which the connector is configured, and to the enterprise application residing in at least one other private geo-location to which the connector can access via site-to-site interconnections; and a location service, the location service configured to: receive information from each connector, the information comprising a public IP address of a device associated with the connector, a set of internal IP addresses reachable within the geo-location from the connector, and a measurement of the connector's relative connectivity to the enterprise application that resides in the multiple private geo-locations; responsive to receipt of a connection request from a client that is directed to the enterprise application, use the information received from the connectors to identify a path to a particular connector in a given private geo-location to handle the connection request; interoperate with the mapping service to cause the connection request to be forwarded across one or more intermediary nodes to the particular connector; and control the particular connector to establish an end-to-end connection between the client and the enterprise application. ### Claim 16 (depends on 15) The computer program product as described in claim 15, wherein the measurement of the connector's relative connectivity to the enterprise application is obtained from a network traffic test. ### Claim 17 (depends on 16) The computer program product as described in claim 16 wherein the network traffic test is a ping. ### Claim 18 (depends on 15) The computer program product as described in claim 15 wherein the program code is configured to periodically initiate the ping to obtain a round trip time (RTT) from the connector to each instance of the enterprise application that is reachable via the site-to-site interconnections. ### Claim 19 (depends on 16) The computer program product as described in claim 16, wherein the overlay network provides the multiple tenants with a Zero Trust Network Access (ZTNA) service.