Granted Patent B2

US 12,432,183 · App. 18/659,296 · Granted Sep 30, 2025

Inventors: David A. Maluf (Mountain View, CA); Srinath Gundavelli (San Jose, CA); Pascal Thubert (Roquefort les Pins, FR); Pradeep Kumar Kathail (Los Altos, CA); Eric Levy-Abegnoli (Roquefort les Pins, FR); Eric Voit (Bethesda, MD); Ali Sajassi (Alamo, CA)

Assignee: Cisco Technology, Inc.

H04L63/0421H04L61/2525H04L61/2539H04L61/4511

Abstract

Claims (73)

1. A method to anonymize Internet Protocol (IP) addresses of endpoints using anonymized IP addresses, the method comprising:

receiving, from a Domain Name Service (DNS) resolver of a DNS service, an indication of an actual IP address that corresponds to a domain name and is usable by a client device to communicate with an endpoint;

generating an anonymized IP address by:

populating a first portion of the anonymized IP address with a network IP address of an intermediate device, the intermediate device being disposed between the client device and the endpoint; and

populating a second portion of the anonymized IP address with anonymized IP address bits;

creating a mapping between the anonymized IP address and the actual IP address of the endpoint; and

providing the mapping to the intermediate device.

2. The method of claim 1 , further comprising providing the anonymized IP address to at least one of the client device or the DNS service to enable the DNS service to provide the anonymized IP address to the client device.

3. The method of claim 1 , wherein the anonymized IP address is a routable IP address that is routed between the client device and the endpoint.

4. The method of claim 1 , further comprising:

receiving, at the intermediate device, a packet having a destination address that is the anonymized IP address;

performing, at the intermediate device, Network Address Translation (NAT) by changing the destination address of the packet from the anonymized IP address to the actual IP address of the endpoint; and

sending the packet to a next hop associated with the actual IP address of the endpoint.

5. The method of claim 4 , further comprising:

receiving a return packet from the endpoint;

determining that a destination address of the return packet is a client IP address of the client device;

performing NAT by changing a source address of the return packet from the actual IP address to the anonymized IP address; and

sending the return packet to the client device.

6. The method of claim 1 , wherein:

an agent generates the anonymized IP address; and

the agent is running on the intermediate device or another device located in a network in which the endpoint is located.

7. The method of claim 1 , wherein:

an agent generates the anonymized IP address; and

the agent is running on the client device or another device associated with a same local area network (LAN) as the client device.

8. The method of claim 1 , wherein:

an agent generates the anonymized IP address; and

the agent is included in the DNS service.

9. A system that anonymizes Internet Protocol (IP) addresses of endpoints using anonymized IP addresses, the system comprising:

one or more processors; and

one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

receiving, from a Domain Name Service (DNS) resolver of a DNS service, an indication of an actual IP address that corresponds to a domain name and is usable by a client device to communicate with an endpoint;

generating an anonymized IP address by:

populating a first portion of the anonymized IP address with a network IP address of an intermediate device, the intermediate device being disposed between the client device and the endpoint; and

populating a second portion of the anonymized IP address with anonymized IP address bits;

creating a mapping between the anonymized IP address and the actual IP address of the endpoint; and

providing the mapping to the intermediate device.

10. The system of claim 9 , the operations further comprising providing the anonymized IP address to at least one of the client device or the DNS service to enable the DNS service to provide the anonymized IP address to the client device.

11. The system of claim 9 , wherein the anonymized IP address is a routable IP address that is routed between the client device and the endpoint.

12. The system of claim 9 , further comprising:

receiving a packet having a destination address that is the anonymized IP address;

performing Network Address Translation (NAT) by changing the destination address of the packet from the anonymized IP address to the actual IP address of the endpoint; and

sending the packet to a next hop associated with the actual IP address of the endpoint.

13. The system of claim 9 , the operations further comprising:

receiving a return packet from the endpoint;

determining that a destination address of the return packet is a client IP address of the client device;

performing NAT by changing a source address of the return packet from the actual IP address to the anonymized IP address; and

sending the return packet to the client device.

14. The system of claim 9 , wherein:

an agent generates the anonymized IP address; and

the agent is running on the intermediate device or another device located in a network in which the endpoint is located.

15. The system of claim 9 , wherein:

an agent generates the anonymized IP address; and

the agent is running on the client device or another device associated with a same local area network (LAN) as the client device.

16. A device that anonymizes Internet Protocol (IP) addresses of endpoints using anonymized IP addresses, the device comprising:

one or more processors; and

one or more non-transitory computer-readable media storing computer- executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

receiving, from a Domain Name Service (DNS) resolver of a DNS service, an indication of an actual IP address that corresponds to a domain name and is usable by a client device to communicate with an endpoint;

generating an anonymized IP address by:

populating a first portion of the anonymized IP address with a network IP address of an intermediate device, the intermediate device being disposed between the client device and the endpoint; and

populating a second portion of the anonymized IP address with anonymized IP address bits;

creating a mapping between the anonymized IP address and the actual IP address of the endpoint; and

providing the mapping to the intermediate device.

17. The device of claim 16 , the operations further comprising providing the anonymized IP address to at least one of the client device or the DNS service to enable the DNS service to provide the anonymized IP address to the client device.

18. The device of claim 16 , wherein the anonymized IP address is a routable IP address that is routed between the client device and the endpoint.

19. The device of claim 16 , further comprising:

receiving a packet having a destination address that is the anonymized IP address;

performing Network Address Translation (NAT) by changing the destination address of the packet from the anonymized IP address to the actual IP address of the endpoint; and

sending the packet to a next hop associated with the actual IP address of the endpoint.

20. The device of claim 16 , the operations further comprising:

receiving a return packet from the endpoint;

determining that a destination address of the return packet is a client IP address of the client device;

performing NAT by changing a source address of the return packet from the actual IP address to the anonymized IP address; and

sending the return packet to the client device.

Assignments (1)

Continuity (4)

References Cited (132)