# US 2014/0156818 A1 · Systems and methods for protecting an identity in network communications

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0156818 A1
- Document ID: US20140156818A1
- Status: Published application
- Kind: A1
- Application number: 13/961,379
- Filed: 2013-08-07
- Published: 2014-06-05
- Earliest claimed: 2012-12-03
- Assignees: Cutting Edge Consulting Associates, Inc.
- Applicants: Cutting Edge Consulting Associates, Inc.
- Inventors: Barbara M. Hunt
- Web page: https://patentgrep.com/patent/US20140156818A1

## CPC

- H04L 63/0407: {wherein the identity of one or more communicating identities is hidden (cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00)}
- G06F 9/5038: {considering the execution order of a plurality of tasks, e.g. taking priority or time dependency constraints into consideration (scheduling strategies G06F9/4881 and subgroups)}
- H04L 45/22: {Alternate routing}
- H04L 45/586: of virtual routers
- H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46)
- H04L 67/34: {involving the movement of software or configuration parameters (network booting or remote initial program loading [RIPL] G06F9/4416)}
- H04L 49/70: {Virtual switches}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

In some embodiments, a method includes sending a first data unit, received from a source device, to a destination device via a first data unit path. The first data unit path includes (1) a first virtual machine and a second virtual machine that are included in a first network, and (2) a third virtual machine that is included in a second network. Furthermore, the first data unit path includes the first virtual machine, the second virtual machine, and the third virtual machine in a first order. The method includes sending a second data unit, received from the source device, to the destination device via a second data unit path from the source device to the destination device. The second data unit path includes each of the first virtual machine, the second virtual machine, and the third virtual machine in a second order different from the first order.

## Claims

### Claim 1

An apparatus, comprising:
a network layout module configured to be operatively coupled to (1) a first network that includes a first virtual machine and a second virtual machine, and that is configured to be operatively coupled to a source device and a destination device; and (2) a second network, different from the first network, that includes a third virtual machine and a fourth virtual machine, and that is configured to be operatively coupled to the source device and the destination device,
the network layout module configured to define, at a first time, a first data unit path from the source device to the destination device, the first data unit path including each of the first virtual machine, the second virtual machine, the third virtual machine and the fourth virtual machine in a first order,
the network layout module configured define, at a second time after the first time, and in response to an event, a second data unit path from the source device to the destination device, the second data unit path including each of the first virtual machine, the second virtual machine, the third virtual machine and the fourth virtual machine in a second order different from the first order.

### Claim 2 (depends on 1)

The apparatus of claim 1, wherein first network is a local area network mutually exclusive from the second network that is a cloud network.

### Claim 3 (depends on 1)

The apparatus of claim 1, wherein the network layout module is configured to be operatively coupled to a virtual logical switch that is configured to operatively couple each of the first virtual machine, the second virtual machine, the third virtual machine and the fourth virtual machine together.

### Claim 4 (depends on 1)

The apparatus of claim 1, wherein:
the event is a first event;
the network layout module is configured to send a signal that is configured to cause a fifth virtual machine to be instantiated,
the network layout module is configured define, at a third time after the second time, and in response to a second event, a third data unit path from the source device to the destination device, the third data unit path including each of the first virtual machine, the second virtual machine, the third virtual machine, the fourth virtual machine, and the fifth virtual machine.

### Claim 5 (depends on 1)

The apparatus of claim 1, wherein the network layout module is configured to be operatively coupled to the destination device that includes a storage device.

### Claim 6 (depends on 1)

The apparatus of claim 1, wherein the event is scheduled.

### Claim 7 (depends on 1)

The apparatus of claim 1, wherein the event is indicative of a malicious activity.

### Claim 8

A method, comprising:
defining, at a first time, a first data unit path from a source device to a destination device, the first data unit path including (1) a first virtual machine and a second virtual machine that are included in a first network, and (2) a third virtual machine that is included in a second network, the first data unit path including the first virtual machine, the second virtual machine, and the third virtual machine in a first order;
modifying, in response to defining the first data unit path, a routing table such that a first data unit sent from the source device to the destination device, prior to a second time after the first time, follows the first data unit path;
defining, after the second time, a second data unit path from the source device to the destination device, the second data unit path including each of the first virtual machine, the second virtual machine, and the third virtual machine in a second order different from the first order; and
modifying, in response to defining the second data unit path, the routing table such that a second data unit sent from the source device to the destination device, after the second time, follows the second data unit path.

### Claim 9 (depends on 8)

The method of claim 8, wherein the first network is a first cloud network and the second network is a second cloud network mutually exclusive from the first cloud network.

### Claim 10 (depends on 8)

The method of claim 8, wherein the routing table is associated with a source device network address translation table.

### Claim 11 (depends on 8)

The method of claim 8, further comprising:
defining, at a third time after the second time, a third data unit path from the source device to the destination device, the third data unit path including each of the first virtual machine, the second virtual machine, and the third virtual machine in a third order different from the second order; and
modifying, in response to defining the third data unit path, the routing table such that a third data unit sent from the source device to the destination device, after the third time, follows the third data unit path.

### Claim 12 (depends on 8)

The method of claim 8, further comprising:
send a signal configured to cause a fourth virtual machine to be instantiated; and
defining, at a third time after the second time, a third data unit path from the source device to the destination device, the third data unit path including each of the first virtual machine, the second virtual machine, the third virtual machine and the fourth virtual machine.

### Claim 13 (depends on 8)

The method of claim 8, further comprising:
receiving a signal indicative of a malicious activity; and
defining the second data unit path in response to the signal.

### Claim 14 (depends on 8)

The method of claim 8, wherein the first network and the second network collectively define a virtual private network.

### Claim 15

A non-transitory processor-readable medium storing code representing instructions to cause a processor to perform a process, the code comprising code to:
send a first data unit, received from a source device, to a destination device via a first data unit path including (1) a first virtual machine and a second virtual machine that are included in a first network, and (2) a third virtual machine that is included in a second network, the first data unit path including the first virtual machine, the second virtual machine, and the third virtual machine in a first order; and
send a second data unit, received from the source device, to the destination device via a second data unit path from the source device to the destination device that includes each of the first virtual machine, the second virtual machine, and the third virtual machine in a second order different from the first order.

### Claim 16 (depends on 15)

The non-transitory processor-readable medium storing code representing instructions to cause a processor to perform a process of claim 15, wherein the first network is (1) logically mutually exclusive from the second network, and (2) physically overlapping with the second network.

### Claim 17 (depends on 15)

The non-transitory processor-readable medium storing code representing instructions to cause a processor to perform a process of claim 15, the code further comprising code to direct a third data unit, received from the source device, to the destination device via a third data unit path from the source device to the destination device, the third data unit path including each of the first virtual machine, the second virtual machine, and the third virtual machine in a third order, different from the first order and from the second order.

### Claim 18 (depends on 15)

The non-transitory processor-readable medium storing code representing instructions to cause a processor to perform a process of claim 15, the code further comprising code to:
send a signal configured to cause a fourth virtual machine to be instantiated; and
define, at a third time after the second time, a third data unit path from the source device to the destination device, the third data unit path including each of the first virtual machine, the second virtual machine, the third virtual machine and the fourth virtual machine in a third order, different from the second order.

### Claim 19 (depends on 15)

The non-transitory processor-readable medium storing code representing instructions to cause a processor to perform a process of claim 15, the code further comprising code to receive the first data unit via a Layer-3 protocol.

### Claim 20 (depends on 15)

The non-transitory processor-readable medium storing code representing instructions to cause a processor to perform a process of claim 15, the code further comprising code to direct the second data unit to the destination device via the second data unit path in response to a scheduled event.