# US 2019/0319918 A1 · Port and loopback ip addresses allocation scheme for full-mesh communications with transparent tls tunnels

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0319918 A1
- Document ID: US20190319918A1
- Status: Published application
- Kind: A1
- Application number: 15/950,983
- Filed: 2018-04-11
- Published: 2019-10-17
- Earliest claimed: 2018-04-11
- Assignees: VMware, Inc.
- Applicants: Vmware, Inc.
- Inventors: Daniel G. WING; Dexiang WANG; Nidheesh DUBEY
- Web page: https://patentgrep.com/patent/US20190319918A1

## CPC

- H04L 9/0825: {using asymmetric-key encryption or public key infrastructure [PKI], e.g. key signature or public key certificates}
- H04L 61/256: NAT traversal
- G06F 9/45558: {Hypervisor-specific management and integration aspects}
- H04L 9/0844: {with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys}
- H04L 9/0861: {Generation of secret information including derivation or calculation of cryptographic keys or passwords}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling}
- H04L 61/2525: {Translation at a client}
- H04L 61/2557: Translation policies or rules
- H04L 61/2592: using tunnelling or encapsulation
- H04L 63/0272: {Virtual private networks}
- H04L 63/0281: {Proxies}
- H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes}
- H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload}
- H04L 63/061: {for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838)}
- H04L 67/563: Data redirection of data network streams
- G06F 2009/45595: {Network integration; Enabling network access in virtual machine instances}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

The method for a virtual machine to use a port and loopback IP addresses allocation scheme for full-mesh communications with transparent transport layer security tunnels is presented. In an embodiment, the method comprises detecting, at a redirect agent implemented in a first machine, a packet that is sent from a client application executing on the first machine toward a server application executing on a second machine; and determining, by the redirect agent, whether a first redirect rule matches the packet. In response to determining that the first redirect rule matches the packet, the redirect agent applies the first redirect rule to the packet to translate the packet into a translated packet, and provides the translated packet to a client agent implemented in the first machine to cause the client agent to transmit the translated packet to a server agent implemented in the second machine.

## Claims

### Claim 1

A method for a virtual machine to use a port and loopback IP addresses allocation scheme for full-mesh communications with transparent transport layer security tunnels, the method comprising:
detecting, at a redirect agent implemented in a first machine, a packet that is sent from a client application, executing on the first machine, toward a server application executing on a second machine;
determining, by the redirect agent, whether a first redirect rule matches the packet;
wherein the first redirect rule specifies modifications to a header of the packet to cause redirecting the packet toward a secure tunnel between the first machine and the second machine;
in response to determining that the first redirect rule matches the packet, applying, by the redirect agent, the first redirect rule to the packet to translate the packet into a translated packet; and
providing the translated packet to a client agent implemented in the first machine to cause the client agent to transmit the translated packet to a server agent implemented in the second machine.

### Claim 2 (depends on 1)

The method of claim 1, wherein, upon detecting the translated packet, the client agent implemented in the first machine:
determines whether the translated packet is a request to establish a communications connection between the client application executing on the first machine and the server application executing on the second machine;
in response to determining that the translated packet is the request to establish the communications connection between the client application and the server application:
establishes a secure communications connection between the client agent implemented in the first machine and the server agent implemented in the second machine;
establishes a first communications connection between the client application executing on the first machine and the client agent implemented in the first machine; and
causes establishing a second communications connection between the server agent implemented in the second machine and the server application executing on the second machine.

### Claim 3 (depends on 2)

The method of claim 2, wherein the establishing the secure communications connection between the client agent implemented in the first machine and the server agent implemented in the second machine comprises generating encryption keys and communicating the encryption keys to the client agent and the server agent to be used by the client agent and the server agent to encrypt and decrypt data packets exchanged between the client agent and the server agent.

### Claim 4 (depends on 3)

The method of claim 3, wherein, upon detecting the translated packet, the client agent implemented in the first machine:
determines whether the translated packet is a data packet;
in response to determining that the translated packet is the data packet:
encrypts the translated packet using the encryption keys to generate an encrypted data packet; and
transmits the encrypted data packet to the server agent implemented in the second machine.

### Claim 5 (depends on 4)

The method of claim 4, wherein, upon detecting the encrypted data packet, the server agent implemented in the second machine: decrypts the encrypted data packet using the encryption keys to generate a decrypted data packet, and provides the decrypted data packet to a restore agent implemented in the second machine; and
wherein, upon detecting the decrypted data packet, the restore agent implemented in the second machine:
determines whether a first restore rule matches the decrypted data packet; and
in response to determining that the first restore rule matches the decrypted data packet, the restore agent applies the first restore rule to the decrypted data packet to translate the decrypted data packet into a restored data packet, and provides the restored data packet to the server application executing on the second machine.

### Claim 6 (depends on 5)

The method of claim 5, wherein, upon detecting a response data packet that is sent from the server application executing on the second machine toward the client application executing on the first machine, a redirect agent executing on the second machine:
determines whether a second redirect rule matches the response data packet;
in response to determining that the second redirect rule matches the response data packet:
applies the second redirect rule to the response data packet to translate the response data packet into a translated response data packet; and
provides the translated response data packet to the server agent implemented in the second machine to cause the server agent to encrypt the translated response data packet using the encryption keys to generate an encrypted response data packet, and transmit the encrypted response data packet to the client agent implemented in the first machine.

### Claim 7 (depends on 6)

The method of claim 6, wherein, upon detecting the encrypted response data packet, the client agent implemented in the first machine:
decrypts the encrypted response data packet using the encryption keys to generate a decrypted response data packet; and
provides the decrypted response data packet to a restore agent implemented in the first machine; and
wherein, upon detecting the decrypted response data packet, the restore agent implemented in the first machine:
determines whether a second restore rule matches the decrypted response data packet; and
in response to determining that the second restore rule matches the decrypted response data packet, the restore agent applies the second restore rule to the decrypted response data packet to translate the decrypted response data packet into a restored response data packet, and provides the restored response data packet to the client application executing on the first machine.

### Claim 8

One or more non-transitory computer-readable storage media storing one or more computer instructions which, when executed by one or more processors, cause the one or more processors to use a port and loopback IP addresses allocation scheme for full-mesh communications with transparent transport layer security tunnels, and to perform:
detecting, at a redirect agent implemented in a first machine, a packet that is sent from a client application, executing on the first machine, toward a server application executing on a second machine;
determining, by the redirect agent, whether a first redirect rule matches the packet;
wherein the first redirect rule specifies modifications to a header of the packet to cause redirecting the packet toward a secure tunnel between the first machine and the second machine;
in response to determining that the first redirect rule matches the packet, applying, by the redirect agent, the first redirect rule to the packet to translate the packet into a translated packet; and
providing the translated packet to a client agent implemented in the first machine to cause the client agent to transmit the translated packet to a server agent implemented in the second machine.

### Claim 9 (depends on 8)

The one or more non-transitory computer-readable storage media of claim 8, wherein, upon detecting the translated packet, the client agent implemented in the first machine:
determines whether the translated packet is a request to establish a communications connection between the client application executing on the first machine and the server application executing on the second machine;
in response to determining that the translated packet is the request to establish the communications connection between the client application and the server application:
establishes a secure communications connection between the client agent implemented in the first machine and the server agent implemented in the second machine;
establishes a first communications connection between the client application executing on the first machine and the client agent implemented in the first machine; and
causes establishing a second communications connection between the server agent implemented in the second machine and the server application executing on the second machine.

### Claim 10 (depends on 9)

The one or more non-transitory computer-readable storage media of claim 9, wherein the establishing the secure communications connection between the client agent implemented in the first machine and the server agent implemented in the second machine comprises generating encryption keys and communicating the encryption keys to the client agent and the server agent to be used by the client agent and the server agent to encrypt and decrypt data packets exchanged between the client agent and the server agent.

### Claim 11 (depends on 10)

The one or more non-transitory computer-readable storage media of claim 10, wherein, upon detecting the translated packet, the client agent implemented in the first machine:
determines whether the translated packet is a data packet;
in response to determining that the translated packet is the data packet:
encrypts the translated packet using the encryption keys to generate an encrypted data packet; and
transmits the encrypted data packet to the server agent implemented in the second machine.

### Claim 12 (depends on 11)

The one or more non-transitory computer-readable storage media of claim 11, wherein, upon detecting the encrypted data packet, the server agent implemented in the second machine:
decrypts the encrypted data packet using the encryption keys to generate a decrypted data packet, and provides the decrypted data packet to a restore agent implemented in the second machine; and
wherein, upon detecting the decrypted data packet, the restore agent implemented in the second machine:
determines whether a first restore rule matches the decrypted data packet; and
in response to determining that the first restore rule matches the decrypted data packet, the restore agent applies the first restore rule to the decrypted data packet to translate the decrypted data packet into a restored data packet, and provides the restored data packet to the server application executing on the second machine.

### Claim 13 (depends on 12)

The one or more non-transitory computer-readable storage media of claim 12, wherein, upon detecting a response data packet that is sent from the server application executing on the second machine toward the client application executing on the first machine, a redirect agent executing on the second machine:
determines whether a second redirect rule matches the response data packet;
in response to determining that the second redirect rule matches the response data packet:
applies the second redirect rule to the response data packet to translate the response data packet into a translated response data packet; and
provides the translated response data packet to the server agent implemented in the second machine to cause the server agent to encrypt the translated response data packet using the encryption keys to generate an encrypted response data packet, and transmit the encrypted response data packet to the client agent implemented in the first machine.

### Claim 14 (depends on 13)

The one or more non-transitory computer-readable storage media of claim 13, wherein, upon detecting the encrypted response data packet, the client agent implemented in the first machine:
decrypts the encrypted response data packet using the encryption keys to generate a decrypted response data packet; and
provides the decrypted response data packet to a restore agent implemented in the first machine; and
wherein, upon detecting the decrypted response data packet, the restore agent implemented in the first machine:
determines whether a second restore rule matches the decrypted response data packet; and
in response to determining that the second restore rule matches the decrypted response data packet, the restore agent applies the second restore rule to the decrypted response data packet to translate the decrypted response data packet into a restored response data packet, and provides the restored response data packet to the client application executing on the first machine.

### Claim 15

A virtual machine implemented in a host computer and configured to use a port and loopback IP addresses allocation scheme for full-mesh communications with transparent transport layer security tunnels, the virtual machine comprising:
one or more processors;
one or more memory units; and
one or more non-transitory computer-readable storage media storing one or more computer instructions which, when executed by the one or more processors, cause the one or more processors to perform:
detecting, at a redirect agent implemented in a first machine, a packet that is sent from a client application, executing on the first machine, toward a server application executing on a second machine;
determining, by the redirect agent, whether a first redirect rule matches the packet;
wherein the first redirect rule specifies modifications to a header of the packet to cause redirecting the packet toward a secure tunnel between the first machine and the second machine;
in response to determining that the first redirect rule matches the packet, applying, by the redirect agent, the first redirect rule to the packet to translate the packet into a translated packet; and
providing the translated packet to a client agent implemented in the first machine to cause the client agent to transmit the translated packet to a server agent implemented in the second machine.

### Claim 16 (depends on 15)

The virtual machine of claim 15, wherein, upon detecting the translated packet, the client agent implemented in the first machine:
determines whether the translated packet is a request to establish a communications connection between the client application executing on the first machine and the server application executing on the second machine;
in response to determining that the translated packet is the request to establish the communications connection between the client application and the server application:
establishes a secure communications connection between the client agent implemented in the first machine and the server agent implemented in the second machine;
establishes a first communications connection between the client application executing on the first machine and the client agent implemented in the first machine; and
causes establishing a second communications connection between the server agent implemented in the second machine and the server application executing on the second machine.

### Claim 17 (depends on 16)

The virtual machine of claim 16, wherein the establishing the secure communications connection between the client agent implemented in the first machine and the server agent implemented in the second machine comprises generating encryption keys and communicating the encryption keys to the client agent and the server agent to be used by the client agent and the server agent to encrypt and decrypt data packets exchanged between the client agent and the server agent.

### Claim 18 (depends on 17)

The virtual machine of claim 17, wherein, upon detecting the translated packet, the client agent implemented in the first machine:
determines whether the translated packet is a data packet;
in response to determining that the translated packet is the data packet:
encrypts the translated packet using the encryption keys to generate an encrypted data packet; and
transmits the encrypted data packet to the server agent implemented in the second machine.

### Claim 19 (depends on 18)

The virtual machine of claim 18, wherein, upon detecting the encrypted data packet, the server agent implemented in the second machine: decrypts the encrypted data packet using the encryption keys to generate a decrypted data packet, and provides the decrypted data packet to a restore agent implemented in the second machine; and
wherein, upon detecting the decrypted data packet, the restore agent implemented in the second machine:
determines whether a first restore rule matches the decrypted data packet; and
in response to determining that the first restore rule matches the decrypted data packet, the restore agent applies the first restore rule to the decrypted data packet to translate the decrypted data packet into a restored data packet, and provides the restored data packet to the server application executing on the second machine.

### Claim 20 (depends on 19)

The virtual machine of claim 19, wherein, upon detecting a response data packet that is sent from the server application executing on the second machine toward the client application executing on the first machine, a redirect agent executing on the second machine:
determines whether a second redirect rule matches the response data packet;
in response to determining that the second redirect rule matches the response data packet:
applies the second redirect rule to the response data packet to translate the response data packet into a translated response data packet; and
provides the translated response data packet to the server agent implemented in the second machine to cause the server agent to encrypt the translated response data packet using the encryption keys to generate an encrypted response data packet, and transmit the encrypted response data packet to the client agent implemented in the first machine.