# US 2020/0288386 A1 · Management of network access request based on source address of device > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2020/0288386 A1 - Document ID: US20200288386A1 - Status: Published application - Kind: A1 - Application number: 16/805,368 - Filed: 2020-02-28 - Published: 2020-09-10 - Earliest claimed: 2019-03-04 - Assignees: Cyxtera Cybersecurity, Inc. - Applicants: Cyxtera Cybersecurity, Inc. - Inventors: Kurt Glazemakers; Gokhan Berberoglu; Kosmas Valianos; Per Johan Allansson; Hoang Long Nguyen; Thomas Bruno Emmanuel Cellerier; Aitor Perez Iturri; Harish Dinne; Salvatore Tomaselli - Web page: https://patentgrep.com/patent/US20200288386A1 ## CPC - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 12/66: Arrangements for connecting between networks having differing types of switching systems, e.g. gateways - H04L 45/50: using label swapping, e.g. multi-protocol label switch [MPLS] - H04L 45/54: {Organization of routing tables} - H04L 45/72: {Routing based on the source address} - H04L 45/74: Address processing for routing - H04L 63/0263: {Rule management} - H04L 63/0272: {Virtual private networks} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/10: {for controlling access to devices or network resources} - H04W 48/16: Discovering, processing access restriction or access information - H04W 48/18: Selecting a network or a communication service - H04W 76/12: Setup of transport tunnels - H04W 88/16: Gateway arrangements - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Network access is provided to a networking device. In one approach, a method includes: obtaining, by a gateway, access rules for a networking device; providing, by the gateway, one or more dedicated networking tunnels between the gateway and respective remote gateways to one or more respective network segments, wherein the networking device is authorized to access the one or more network segments by the access rules; and routing, by the gateway, networking packets from the networking device based on source address information in the networking packets to the one or more dedicated networking tunnels, and based on destination address information in the networking packets, routing the networking packets to a selection of the one or more dedicated networking tunnels. ## Claims ### Claim 1 A method comprising: obtaining, by a first gateway, access rules for a first networking device; providing, by the first gateway, one or more dedicated networking tunnels between the first gateway and respective remote gateways to one or more respective network segments, wherein the first networking device is authorized to access the one or more network segments by the access rules; and routing, by the first gateway, networking packets from the first networking device based on source address information in the networking packets to the one or more dedicated networking tunnels and, based on destination address information in the networking packets, routing the networking packets to a selection of the one or more dedicated networking tunnels. ### Claim 2 (depends on 1) The method of claim 1, wherein the providing the one or more dedicated networking tunnels further comprises providing a dedicated routing table for the first networking device for performing the routing the networking packets to the selection of the one or more dedicated networking tunnels. ### Claim 3 (depends on 1) The method of claim 1, further comprising providing, in the first gateway, a dedicated network container for the first networking device, wherein the routing comprises forwarding the networking packets to the dedicated network container. ### Claim 4 (depends on 3) The method of claim 3, wherein the dedicated network container comprises a dedicated routing table for routing the networking packets to the selection of the one or more dedicated networking tunnels. ### Claim 5 (depends on 1) The method of claim 1, further comprising: receiving, by the first gateway, a request from the first networking device for a hardware address of the first gateway; determining, by the first gateway from the access rules, whether the first gateway is a default gateway for the first networking device; in response to determining that the first gateway is the default gateway for the first networking device, providing, by the first gateway, the hardware address of the first gateway to the first networking device. ### Claim 6 (depends on 5) The method of claim 5, wherein the first networking device is configured to, upon receiving the hardware address of the first gateway, associate a network address of the first gateway with the hardware address of the first gateway. ### Claim 7 (depends on 5) The method of claim 5, further comprising: receiving, by a second gateway with a same network address as the first gateway, the request from the first networking device; determining, by the second gateway from access rules stored by the second gateway, that the second gateway is not the default gateway for the first networking device; and refraining, by the second gateway, from responding to the request. ### Claim 8 (depends on 7) The method of claim 7, further comprising: receiving, by the second gateway, a request to take over as the default gateway for the first networking device; and providing, by the second gateway, a hardware address of the second gateway to the first networking device. ### Claim 9 (depends on 8) The method of claim 8, further comprising: upon receiving the hardware address of the second gateway, removing, by the first networking device, an association of a network address of the first gateway with the hardware address of the first gateway, and associating the network address of the first gateway with the hardware address of the second gateway. ### Claim 10 (depends on 1) The method of claim 1, further comprising: receiving a network address request from the first networking device; based on the network address request, determining the access rules for the first networking device; and providing the determined access rules to the first gateway. ### Claim 11 (depends on 10) The method of claim 10, wherein the network address request from the first networking device comprises a hardware address associated with the first networking device, and wherein the determining the access rules further comprises: determining from the hardware address a device type of the first networking device; and determining the access rules based on the device type of the first networking device. ### Claim 12 (depends on 10) The method of claim 10, further comprising: deriving a device fingerprint for the first networking device from the network address request; wherein determining the access rules for the first networking device is based on the device fingerprint. ### Claim 13 (depends on 10) The method of claim 10, further comprising: in response to the network address request, providing a network address of the first networking device and a network address of the first gateway. ### Claim 14 A system comprising: a processor; and memory containing instructions configured to instruct the processor to: receive access rules for a networking device; provide dedicated networking tunnels between a gateway and respective remote gateways to one or more respective network segments, wherein the networking device is authorized to access the one or more network segments by the access rules; route, based on source address information in the networking packets, networking packets from the networking device to the dedicated networking tunnels; and route, based on destination address information in the networking packets, the networking packets to a selection of the dedicated networking tunnels. ### Claim 15 (depends on 14) The system of claim 14, wherein the providing the dedicated networking tunnels comprises providing a dedicated routing table for the networking device for performing the routing the networking packets to the selection of the dedicated networking tunnels. ### Claim 16 A method comprising: receiving, by an access controller, a network packet; determining, by the access controller, a set of networking tunnels to which the network packet is to be forwarded based on a source address of the network packet; selecting, by the access controller, a first networking tunnel of the set of networking tunnels based on a destination address of the network packet; and routing, by the access controller, the network packet to the first networking tunnel. ### Claim 17 (depends on 16) The method of claim 16, further comprising adding a destination-based route in a routing table to route networking packets received with the destination address to the first networking tunnel. ### Claim 18 (depends on 17) The method of claim 17, wherein the network packet is received from a first device, the method further comprising adding a source-based route to the routing table, wherein packets from the first device are routed to a virtual interface that corresponds to the set of networking tunnels. ### Claim 19 (depends on 18) The method of claim 18, further comprising: receiving access rules; establishing the virtual interface; and when the virtual interface is established, establishing networking tunnels as identified by the access rules, wherein the established networking tunnels include the set of networking tunnels. ### Claim 20 (depends on 16) The method of claim 16, wherein the networking packet is received from a networking device, and the first networking tunnel is a dedicated networking tunnel created for use only for network traffic between the networking device and a network segment accessed via a remote gateway.