# US 2024/0205192 A1 · System and method for segmenting transit capabilities within a multi-cloud architecture > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2024/0205192 A1 - Document ID: US20240205192A1 - Status: Published application - Kind: A1 - Application number: 18/587,387 - Filed: 2024-02-26 - Published: 2024-06-20 - Earliest claimed: 2021-02-17 - Assignees: Aviatrix Systems, Inc. - Applicants: Aviatrix Systems, Inc. - Inventors: Xiaobo Sherry Wei; Shanshan Xu - Web page: https://patentgrep.com/patent/US20240205192A1 ## CPC - H04L 63/0272: {Virtual private networks} - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 12/66: Arrangements for connecting between networks having differing types of switching systems, e.g. gateways - H04L 45/04: {Interdomain routing, e.g. hierarchical routing} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/029: {Firewall traversal, e.g. tunnelling or, creating pinholes} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04L 12/462: {LAN interconnection over a bridge based backbone} - H04L 63/0263: {Rule management} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In one embodiment, a computing platform features a controller, one or more transit virtual private cloud networks (VPCs), and a plurality of spoke VPCs. Communicatively coupled to the transit virtual VPCs, the spoke VPCs include (i) a first spoke VPC associated with a first security region and (ii) a second spoke VPC associated with a second security region. Herein, the first security region is configured to permit spoke gateways of the first spoke VPC to communicate with each other while precluding communications with spoke gateways associated with another security region absent a connectivity policy being a set of rules established by the administrator/user of the network concerning permitted connectivity between different security regions. ## Claims ### Claim 1 A computing platform, comprising: a controller deployed within a cloud computing platform and maintained within a non-transitory storage medium; one or more transit virtual private cloud networks; and a plurality of spoke virtual private cloud networks communicatively coupled to the one or more transit virtual private cloud networks, the plurality of spoke virtual private cloud networks include (i) a first spoke virtual private cloud network associated with a first security region and (ii) a second spoke virtual private cloud network associated with a second security region, wherein communications between spoke gateways of the first and second security regions are precluded, wherein the controller is configured to replicate at least one routing connection between the spoke gateways of the first spoke virtual private cloud network and the spoke gateways of the second spoke virtual private cloud network maintained within a different routing transit data store accessible by a transit virtual private cloud network different than the one or more transit virtual private cloud networks. ### Claim 2 (depends on 1) The computing platform of claim 1, wherein the first spoke virtual private cloud network and the second spoke virtual private cloud network are deployed within a single public cloud network. ### Claim 3 (depends on 1) The computing platform of claim 1 being a multi-cloud computing platform that comprises the first spoke virtual private cloud network being deployed within a first public cloud network and the second spoke virtual private cloud network being deployed within a second public cloud network different that is different from the first public cloud network. ### Claim 4 (depends on 1) The computing platform of claim 1, wherein the controller is configured with access to one or more transit routing data stores including content that establishes the first security domain and the second security domain. ### Claim 5 (depends on 1) The computing platform of claim 1, wherein the plurality of spoke virtual private cloud networks further includes a third spoke virtual private cloud network associated with the first security region so that gateways associated with the third spoke virtual private cloud network are communicatively coupled to the spoke gateways of the first spoke virtual private cloud network and precluded from communications with spoke gateways associated with the second spoke private cloud network. ### Claim 6 (depends on 1) The computing platform of claim 1, wherein the controller is configured to monitor for a presence of a connection policy between the first security region and the second security region that, upon detection, allows for communications between the spoke gateways of the first spoke virtual private cloud network operating in the first security region and the spoke gateways of the second spoke virtual private cloud network operating within the second security region. ### Claim 7 (depends on 1) The computing platform of claim 1, wherein a transit virtual private cloud network of the one or more transit virtual private cloud networks includes data traffic processing logic that, upon receipt of an incoming message, is configured to parse and conduct analytics on the incoming message to determine a destination for the incoming message, and wherein the destination and a source of the incoming message are both members of the first security region, providing contents associated with the incoming message to the destination, and wherein the destination is a member of the second security region, the source of the incoming message is a member of the first security region and a connection policy is established between the first security region and the second security region, providing contents associated with the incoming message to the destination. ### Claim 8 (depends on 7) The computing platform of claim 7, where the destination is a member of the second security region, the source of the incoming message is a member of the first security region and no connection policy is established between the first security region and the second security region, discarding the incoming message and optionally reporting an error message to the source or the controller. ### Claim 9 (depends on 6) The computing platform of claim 6, wherein the connection policy includes one or more rules enforced to allow for cross security domain connectivity. ### Claim 10 A multi-cloud computing platform, comprising: a controller; a non-transitory storage medium including software that, upon execution, generates one or more transit virtual private cloud networks; and a plurality of spoke virtual private cloud networks communicatively coupled to the one or more transit virtual private cloud networks, the plurality of spoke virtual private cloud networks include (i) a first spoke virtual private cloud network associated with a first security region and (ii) a second spoke virtual private cloud network associated with a second security region, wherein communications between spoke gateways of the first and second security regions are precluded, wherein the controller is configured to replicate at least one routing connection between the spoke gateways of the first spoke virtual private cloud network and the spoke gateways of the second spoke virtual private cloud network maintained within a different routing transit data store accessible by a transit virtual private cloud network different than the one or more transit virtual private cloud networks. ### Claim 11 (depends on 10) The multi-cloud computing platform of claim 10, wherein the controller is configured with access to one or more transit routing data stores including content that establishes the first security domain and the second security domain. ### Claim 12 (depends on 10) The multi-cloud computing platform of claim 10, wherein the controller is configured to monitor for a presence of a connection policy between the first security region and the second security region that, upon detection, allows for communications between the spoke gateways of the first spoke virtual private cloud network operating in the first security region and the spoke gateways of the second spoke virtual private cloud network operating within the second security region. ### Claim 13 (depends on 10) The multi-cloud computing platform of claim 10, wherein a transit virtual private cloud network of the one or more transit virtual private cloud networks includes data traffic processing logic that, upon receipt of an incoming message, is configured to parse and conduct analytics on the incoming message to determine a destination for the incoming message, and wherein the destination and a source of the incoming message are both members of the first security region, the data traffic processing logic is configured to provide contents associated with the incoming message to the destination, and wherein the destination is a member of the second security region, the source of the incoming message is a member of the first security region and a connection policy is established between the first security region and the second security region, the data traffic processing logic is configured to provide contents associated with the incoming message to the destination. ### Claim 14 (depends on 18) The multi-cloud computing platform of claim 18, responsive to the destination is a member of the second security region, the source of the incoming message is a member of the first security region and no connection policy is established between the first security region and the second security region, the data traffic processing logic is configured to discard the incoming message and optionally reporting an error message to the source or the controller. ### Claim 15 (depends on 12) The multi-cloud computing platform of claim 12, wherein the connection policy includes one or more rules enforced to allow for cross security domain connectivity.