# US 2021/0243276 A1 · Systems and methods for protecting an identity in network communications > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0243276 A1 - Document ID: US20210243276A1 - Status: Published application - Kind: A1 - Application number: 17/063,102 - Filed: 2020-10-05 - Published: 2021-08-05 - Earliest claimed: 2012-12-03 - Assignees: NetAbstraction, Inc. - Applicants: NetAbstraction, Inc. - Inventors: Barbara M. HUNT - Web page: https://patentgrep.com/patent/US20210243276A1 ## CPC - H04L 63/0407: {wherein the identity of one or more communicating identities is hidden (cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00)} - G06F 9/5038: {considering the execution order of a plurality of tasks, e.g. taking priority or time dependency constraints into consideration (scheduling strategies G06F9/4881 and subgroups)} - H04L 45/22: {Alternate routing} - H04L 45/586: of virtual routers - H04L 67/10: in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) - H04L 67/34: {involving the movement of software or configuration parameters (network booting or remote initial program loading [RIPL] G06F9/4416)} - H04L 49/70: {Virtual switches} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract In some embodiments, a method includes sending a first data unit, received from a source device, to a destination device via a first data unit path. The first data unit path includes (1) a first virtual machine and a second virtual machine that are included in a first network, and (2) a third virtual machine that is included in a second network. Furthermore, the first data unit path includes the first virtual machine, the second virtual machine, and the third virtual machine in a first order. The method includes sending a second data unit, received from the source device, to the destination device via a second data unit path from the source device to the destination device. The second data unit path includes each of the first virtual machine, the second virtual machine, and the third virtual machine in a second order different from the first order. ## Claims ### Claim 1 (canceled) ### Claim 2 A non-transitory processor-readable medium comprising code configured to be executed by a processor the code configured to cause the processor to: receive, during a first time period, a first packet at a virtual switch instantiated in a first commercial cloud implemented in at least a first physical data center, the first packet including an internal address; access, during the first time period, a routing table that specifies that packets that include the internal address are to be routed to a first virtual machine instantiated in a second commercial cloud implemented in at least a second physical data center; switch, during the first time period, the first data packet to a physical interface between the first physical data center and the second physical data center based on the routing table and the internal address such that the first packet is routed to a destination through the first virtual machine; receive, during a second time period, a second data packet at the virtual switch instantiated in the first commercial cloud, the second data packet including the internal address; access, during the second time period, an updated routing table that specifies that packets that include the internal address are to be routed to a second virtual machine different from the first virtual machine; and switch, during the second time period, the second data packet to the second virtual machine such that the second data packet is routed to the destination through the second virtual machine. ### Claim 3 (depends on 2) The non-transitory processor-readable medium of claim 2, wherein the second virtual machine is instantiated in the first commercial cloud. ### Claim 4 (depends on 2) The non-transitory processor-readable medium of claim 2, wherein: the second virtual machine is instantiated in a third commercial cloud implemented in at least a third physical data center, the code to cause the processor to switch the second data packet further comprising code to cause the processor to: switch the second data packet to a physical interface between the first physical data center and the third physical data center. ### Claim 5 (depends on 2) The non-transitory processor-readable medium of claim 2, the code further comprising code to cause the processor to update a forwarding state of the virtual switch such that the virtual switch switches the second packet to the second virtual machine. ### Claim 6 A non-transitory processor-readable medium comprising code configured to be executed by a processor the code configured to cause the processor to: instantiate, in a first commercial cloud, a first virtual machine; instantiate, in a second commercial cloud, a second virtual machine; define a routing table such that a first packet received from an origin device that identifies an address of the destination device is routed through the first virtual machine and the second virtual machine; detect a threat after defining the routing table; instantiate, in a third commercial cloud, a third virtual machine in response to the threat; and update the routing table in response to the threat such that a second packet received after the threat is detected from the origin device and that identifies the address of the destination device is routed through the third virtual machine. ### Claim 7 (depends on 6) The non-transitory processor-readable medium of claim 6, wherein the first commercial cloud is implemented in at least a first physical data center and the second commercial cloud is implemented in at least a second physical data center, the code further comprising code to cause the processor to: instantiate, in the first commercial cloud, a first virtual switch configured to route the first packet from the first virtual machine to a physical interface between the first physical data center and the second physical data center. ### Claim 8 (depends on 7) The non-transitory processor-readable medium of claim 7, wherein the first commercial cloud is implemented in at least a first physical data center and the second commercial cloud is implemented in at least a second physical data center, the code further comprising code to cause the processor to: instantiate, in the first commercial cloud, a first virtual switch configured to route the first data packet from the first virtual machine to a physical interface between the first physical data center and the second physical data center; and instantiate, in the second commercial cloud, a second virtual switch configured to route the first packet to the second virtual machine. ### Claim 9 (depends on 7) The non-transitory processor-readable medium of claim 7, wherein the first commercial cloud is implemented in at least a first physical data center and the second commercial cloud is implemented in at least a second physical data center, the code further comprising code to cause the processor to: instantiate, in the first commercial cloud, a first virtual switch configured to route the first packet from the first virtual machine to a physical interface between the first physical data center and the second physical data center; instantiate, in the second commercial cloud, a second virtual switch configured to route the first packet to the second virtual machine; and instantiate, in the second commercial cloud, a third virtual switch configured to route the first packet to an egress node of the second commercial cloud. ### Claim 10 (depends on 7) The non-transitory processor-readable medium of claim 7, the code further comprising code to cause the processor to: instantiate, in the first commercial cloud, a virtual switch configured to route the first packet from the first virtual machine to a physical interface between the first physical data center and the second physical data center; and modify, in response to detecting the threat, a forwarding state of the virtual switch such that the virtual switch switches the second packet to the third virtual machine. ### Claim 11 (depends on 7) The non-transitory processor-readable medium of claim 7, wherein: the first commercial cloud is implemented in at least a first physical data center; and the code to cause the processor to instantiate the third virtual machine includes code to cause the processor to instantiate the third virtual machine in a third commercial cloud implemented in at least a second physical data center. ### Claim 12 (depends on 7) The non-transitory processor-readable medium of claim 7, wherein code to updatei the routing table includes code to update the routing table such that the second packet is routed from the first commercial cloud, through the third virtual machine, and back through the first commercial cloud before being routed to the destination device. ### Claim 13 (depends on 7) The non-transitory processor-readable medium of claim 7, wherein the first cloud is implemented on a first plurality of servers and the second commercial cloud is implemented on a second plurality of servers mutually exclusive from the first plurality of servers. ### Claim 14 A non-transitory processor-readable medium comprising code configured to be executed by a processor, the code configured to cause the processor to: receive, at an ingress node, a first packet from an origin device, the first packet identifying an external address of a destination device; append an internal address to the first packet based on the external address of the destination device; define a routing table that defines a path from the ingress node to an egress node, the routing table identifying an internal address of a first virtual machine and an internal address of a second virtual machine, the first virtual machine associated with a first commercial cloud implemented in at least a first physical data center, the second virtual machine associated with a second commercial cloud implemented in at least a second physical data center, based on the internal address appended to the first packet and the routing table, the first packet switched to the first virtual machine by a first virtual switch associated with the first commercial cloud, switched to a physical interface between the first physical data center and the second physical data center by a second virtual switch associated with the first commercial cloud, switched to the second virtual machine by a third virtual switch associated with the second commercial cloud, and switched to the egress node by a fourth virtual switch associated with the second commercial cloud; update the routing table to define an updated routing table identifying an internal address of a third virtual machine and an internal address of a fourth virtual machine, the third virtual machine associated with a third commercial cloud implemented in at least a third physical data center, the fourth virtual machine associated with a fourth commercial cloud implemented in at least a fourth physical data center; receive, at the ingress node, a second packet from the origin device, the second packet identifying the external address of the destination device; and append the internal address to the second packet based on the external address of the destination device, based on the internal address of the second packet and the updated routing table, the second packet switched to the third virtual machine by a fifth virtual switch associated with the third commercial cloud, switched to a physical interface between the third physical data center and the fourth physical data center by a sixth virtual switch associated with the third commercial cloud, switched to the fourth virtual machine by a seventh virtual switch associated with the fourth commercial cloud, and switched to the egress node by an eighth virtual switch associated with the fourth commercial cloud. ### Claim 15 (depends on 14) The non-transitory processor-readable medium of claim 14, wherein: the first packet is associated with a first entity identifier associated with the origin device, the code further comprising code to cause the processor to: instantiate the second virtual machine in the second commercial cloud using a second entity identifier different from the first identity identifier. ### Claim 16 (depends on 14) The non-transitory processor-readable medium of claim 14, wherein the second virtual switch is configured to switch the first packet to the third virtual switch via an Internet Protocol Security (IPSec) tunnel. ### Claim 17 (depends on 14) The non-transitory processor-readable medium of claim 14, wherein the routing table is updated based on a scheduled event. ### Claim 18 (depends on 14) The non-transitory processor-readable medium of claim 14, wherein the routing table is updated in response to detecting a threat. ### Claim 19 (depends on 14) The non-transitory processor-readable medium of claim 14, wherein the routing table is updated in response to a signal received from an administrator. ### Claim 20 (depends on 14) The non-transitory processor-readable medium of claim 14, wherein the routing table is updated randomly or pseudo-randomly. ### Claim 21 (depends on 14) The non-transitory processor-readable medium of claim 14, wherein the first packet and the second packet are each routed from the origin device to the destination device via a secure virtual private network that includes a route defined by at least one of the routing table or the updated routing table.