US 12,756,687 B2Granted

Zero trust network infrastructure with location service for routing connections via intermediary nodes

AssigneeAkami Technologies, Inc.

InventorsCharles E. Gero, David Tang, Vishal A. Patel

Life of this patent

Estimating the term…

Loading patent…

Abstract

A location service for automatic discovery of locations at which instances of an internal enterprise application are located. The location service is configured to facilitate routing of connection requests directed to the internal enterprise application, which typically is hosted in distinct enterprise locations. The service works in association with a set of connectors that each have an associated public Internet Protocol (IP) address (typically of a device to which the connector is coupled) at which it is reachable and through which a connection to an internal enterprise application instance can be proxied. Connections to the internal enterprise application are routable along a network path from a client to a given connector through a set of intermediary nodes. Using information collected from the connectors, the service performs a series of correlations (viz., finding matching connections and their corresponding public IP addresses) to enable service provider mapping technologies to make both global and local traffic mapping decisions for these internal enterprise resources.

Claims18

Dependent claims

A method operative at in association with a location service, the location service associated with a service provider and configured to facilitate routing of connection requests directed to an internal enterprise application that is hosted in a set of locations associated with the enterprise, each location in the set of locations having associated therewith one or more connectors of a set of connectors, each connector of the set of connectors being hidden from the publicly-routable Internet, and wherein connections to the internal enterprise application are routable along a network path from a client to each of the connectors of the set of connectors through a set of intermediary nodes, comprising:

for at least one connector of the set of connectors at a particular location of the set of locations, discovering a set of data, the set of data comprising a public IP address of a device associated with the at least one connector, the IP addresses reachable within the particular location from the at least one connector, and a latency associated with a path between each of one or more intermediary nodes and the at least one connector;
responsive to receipt of a first query from a first intermediary node, the first query having been generated at the first intermediary node in response to receipt from a client of a connection request, providing the first intermediary node given information, the given information comprising a first list of connectors selected from the set of connectors that, based on the set of data discovered, can reach the internal enterprise application, and the public IP addresses associated with the connectors identified on the first list of connectors;
and
responsive to receipt of a second query from a second intermediary node, the second query having been generated at the second intermediary node in response to receipt at the second intermediary node of the connection request forwarded from the first intermediary node, forwarding the connection request to a particular connector on the first list of connectors.

1 more element

An apparatus, comprising:

a processor;
computer memory storing computer program instructions configured in association with a location service to facilitate routing of connection requests directed to an internal enterprise application that is hosted in a set of locations associated with an enterprise, each location in the set of locations having associated therewith a connector of a set of one or more connectors, each connector of the set of connectors being hidden from the publicly-routable Internet, and wherein connections to the internal enterprise application are routable along a network path from a client to each of the connectors of the set of connectors through a set of intermediary nodes, the computer program instructions comprising program code configured to:
for at least one connector of the set of connectors at a particular location of the set of locations, receive a set of data, the set of data comprising a public IP address of a device associated with the at least one connector, the IP addresses reachable within the particular location from the at least one connector, and a latency associated with a path between each of one or more intermediary nodes and the at least one connector;
responsive to receipt of a first query from a first intermediary node, the first query having been generated at the first intermediary node in response to receipt from a client of a connection request, provide the first intermediary node given information, the given information comprising a first list of connectors selected from the set of connectors that, based on the set of data discovered, can reach the internal enterprise application, and the public IP addresses associated with the connectors identified on the first list of connectors;
and
responsive to receipt of a second query from a second intermediary node, the second query having been generated at the second intermediary node in response to receipt at the second intermediary node of the connection request forwarded from the first intermediary node, identify a particular connector to which the second intermediary node should forward the connection request for handling.

3 more elements

Dependencies are inferred from the claim text.