Back to results
US 8,259,571 B1Granted
Handling overlapping IP addresses in multi-tenant architecture
AssigneeZscaler, Inc.
InventorsJose Raphel, Kailash Kailash, Srikanth Devarajan
Life of this patent
Estimating the term…
Abstract
Systems, methods and apparatus for tunneling in a cloud based security system. A multi-tenant cloud-based security system that can distinguish between client computing devices with overlapping private IP addresses is disclosed. Client devices communicate through a processing node to which a tunnel is established. The processing node is able to detect the client devices and apply security policies to the device.
Claims22
A system, comprising:
- a data processing apparatus external to a plurality of logically independent internet protocol (IP) subnets;
- a memory store in data communication with the data processing apparatus and storing computer-readable instructions executable by the data processing apparatus and that upon execution cause the data processing apparatus to perform operations comprising:
- for each logically independent IP subnet:
- hosting a tunnel endpoint, the tunnel endpoint being for a corresponding tunnel connection between the data processing apparatus and the logically independent IP subnet, the tunnel endpoint being identified by a tunnel identifier;
- receiving tunnel packets through the tunnel, each tunnel packet encapsulating a payload packet, the payload packet including a packet source address and a packet destination address, the packet source address defining a source IP address and a source port number, the source IP address being an IP address assigned to a device in the logically independent subnet with which the corresponding tunnel connection is established, and the packet destination address defining a destination IP address to which the payload packet is addressed;
- generating a source identifier from the tunnel identifier and packet address;
- mapping the source identifier to a translated packet source address;
- and
- addressing the payload packet to the destination address using the translated packet source address;
- wherein:
- generating the source identifier from the tunnel identifier and packet address comprises generating the source identifier from the tunnel identifier, source IP address, and source port number;
- and
- mapping the source identifier to the translated packet source address comprises:
- generating, by the data processing apparatus, a new source IP address and a new port number;
- and
- mapping the source identifier to the new source IP address and the new port number.
13 more elements
A method performed by a data processing apparatus external to a plurality of logically independent internet protocol (IP) subnets, comprising:
- for each logically independent IP subnet:
- hosting a tunnel endpoint, the tunnel endpoint being for a corresponding tunnel connection between the data processing apparatus and the logically independent IP subnet, the tunnel endpoint being identified by a tunnel identifier;
- receiving tunnel packets through the tunnel, each tunnel packet encapsulating a payload packet, the payload packet including a packet source address and a packet destination address, the packet source address defining a source IP address and a source port number, the source IP address being an IP address assigned to a device in the logically independent subnet with which the corresponding tunnel connection is established, and the packet destination address defining a destination IP address to which the payload packet is addressed;
- generating a source identifier from the tunnel identifier and packet address;
- mapping the source identifier to a translated packet source address;
- and
- addressing the payload packet to the destination address using the translated packet source address;
- wherein:
- generating the source identifier from the tunnel identifier and packet address comprises generating the source identifier from the tunnel identifier, source IP address, and source port number;
- and
- mapping the source identifier to the translated packet source address comprises:
- generating, by the data processing apparatus, a new source IP address and a new port number;
- and
- mapping the source identifier to the new source IP address and the new port number.
11 more elements
A system, comprising:
- a data processing apparatus external to a plurality of logically independent internet protocol (IP) subnets;
- a memory store in data communication with the data processing apparatus and storing computer-readable instructions executable by the data processing apparatus and that upon execution cause the data processing apparatus to perform operations comprising:
- for each logically independent IP subnet:
- hosting a tunnel endpoint, the tunnel endpoint being for a corresponding tunnel connection between the data processing apparatus and the logically independent IP subnet, the tunnel endpoint being identified by a tunnel identifier;
- receiving tunnel packets through the tunnel, each tunnel packet encapsulating a payload packet, the payload packet including a packet source address and a packet destination address, the packet source address defining a source IP address and a source port number, the source IP address being an IP address assigned to a device in the logically independent subnet with which the corresponding tunnel connection is established, and the packet destination address defining a destination IP address to which the payload packet is addressed;
- generating a source identifier from the tunnel identifier and packet address;
- mapping the source identifier to a translated packet source address;
- and
- addressing the payload packet to the destination address using the translated packet source address;
- wherein:
- generating a source identifier from the tunnel identifier and packet address comprises generating a tuple comprising the tunnel identifier, the source IP address, and the destination IP address;
- and
- mapping the source identifier to the translated packet source address comprises generating connection data defining an association of first and second sockets, the first socket defining a connection from an edge router that is assigned the source IP address to the data processing apparatus, and the second socket defining a connection from the data processing apparatus to a device at the destination IP address.
10 more elements
Dependencies are inferred from the claim text.