Granted Patent B2

US 12,316,599 · App. 18/620,619 · Granted May 27, 2025

Inventors: Pascal Thubert (Roquefort les Pins, FR); Pradeep Kumar Kathail (Los Altos, CA); Eric Levy-Abegnoli (Roquefort les Pins, FR); David A. Maluf (Mountain View, CA)

Assignee: Cisco Technology, Inc.

H04L61/2503H04L61/4511

Abstract

Claims (92)

1. A system that anonymizes actual Internet Protocol (IP) addresses of destination endpoints, the system comprising:

one or more processors; and

one or more non-transitory computer-readable media storing computer-executable instructions that, when executed by the one or more processors, cause the one or more processors to perform operations comprising:

mapping an actual IP address of a destination endpoint to a randomized IP address;

receiving a request to provide the actual IP address to a source device that is requesting to be a source of traffic that is communicated with the destination endpoint; and

providing the randomized IP address for use by the source device to populate headers of packets in the traffic that are generated at the source device and sent to the destination endpoint, wherein the source device is not provided with the actual IP address of the destination endpoint.

2. The system of claim 1 , wherein the randomized IP address is a first randomized IP address, the operations further comprising:

mapping the first randomized IP address to a first client identifier (ID) associated with the source device;

receiving another request to provide the actual IP address to another source device;

identifying a second randomized IP address to provide to the other source device;

providing the second randomized IP address for use by the other source device to contact the destination endpoint; and

mapping the second randomized IP address to a second client ID associated with the other source device.

3. The system of claim 1 , the operations further comprising:

receiving a packet having a destination address that is the randomized IP address;

determining that a source address of the packet is a source IP address of the source device sent the packet;

performing Network Address Translation (NAT) by changing the destination address of the packet from the randomized IP address to the actual IP address of the destination endpoint; and

sending the packet to a next hop associated with the actual IP address of the destination endpoint.

4. The system of claim 3 , the operations further comprising:

performing NAT by changing the source address of the packet from the source IP address to a particular system address associated with the system; and

mapping the particular system address to the source IP address of the source device.

5. The system of claim 4 , the operations further comprising:

receiving a return packet from the endpoint;

determining that a destination address of the return packet is the particular system address;

based at least in part on the mapping of the particular system address to the source IP address, performing NAT by changing the destination address of the return packet from the particular system IP address to the source IP address; and

sending the return packet to the source device.

6. The system of claim 1 , the operations further comprising:

receiving a packet from a source device;

determining that a destination address of the packet is the randomized IP address;

determining that the source device is not the source device to which the randomized IP address was provided; and

dropping the packet.

7. The system of claim 1 , the operations further comprising:

receiving a packet from a source device;

determining that a destination address of the packet is the randomized IP address;

determining that the source device is the source device to which the randomized IP address was provided; and

forwarding the packet to a next hop associated with the endpoint.

8. The system of claim 1 , wherein the system includes a Network Address Translation (NAT) service and a Domain Name Service (DNS).

9. A method for anonymizing actual Internet Protocol (IP) addresses of destination endpoints, the method comprising:

mapping an actual IP address of a destination endpoint to a randomized IP address;

receiving a request to provide the actual IP address to a source device that is requesting to be a source of traffic that is communicated with the destination endpoint; and

providing the randomized IP address for use by the source device to populate headers of packets in the traffic that are generated at the source device and sent to the destination endpoint, wherein the source device is not provided with the actual IP address of the destination endpoint.

10. The method of claim 9 , wherein the randomized IP address is a first randomized IP address, further comprising:

mapping the first randomized IP address to a first client identifier (ID) associated with the source device;

receiving another request to provide the actual IP address to another source device;

identifying a second randomized IP address to provide to the other source device;

providing the second randomized IP address for use by the other source device to contact the destination endpoint; and

mapping the second randomized IP address to a second client ID associated with the other source device.

11. The method of claim 9 , further comprising:

receiving a packet having a destination address that is the randomized IP address;

determining that a source address of the packet is a source IP address of the source device sent the packet;

performing Network Address Translation (NAT) by changing the destination address of the packet from the randomized IP address to the actual IP address of the destination endpoint; and

sending the packet to a next hop associated with the actual IP address of the destination endpoint.

12. The method of claim 11 , further comprising:

performing NAT by changing the source address of the packet from the source IP address to a particular system address associated with a system; and

mapping the particular system address to the source IP address of the source device.

13. The method of claim 12 , further comprising:

receiving a return packet from the endpoint;

determining that a destination address of the return packet is the particular system address;

based at least in part on the mapping of the particular system address to the source IP address, performing NAT by changing the destination address of the return packet from the particular system IP address to the source IP address; and

sending the return packet to the source device.

14. The method of claim 9 , further comprising:

receiving a packet from a source device;

determining that a destination address of the packet is the randomized IP address;

determining that the source device is not the source device to which the randomized IP address was provided; and

dropping the packet.

15. The method of claim 9 , further comprising:

receiving a packet from a source device;

determining that a destination address of the packet is the randomized IP address;

determining that the source device is the source device to which the randomized IP address was provided; and

forwarding the packet to a next hop associated with the endpoint.

16. One or more non-transitory computer-readable media storing computer executable instructions that, when executed by one or more processors, cause the one or more processors to perform operations comprising:

mapping an actual Internet Protocol (IP) address of a destination endpoint to a randomized IP address;

receiving a request to provide the actual IP address to a source device that is requesting to be a source of traffic that is communicated with the destination endpoint; and

providing the randomized IP address for use by the source device to populate headers of packets in the traffic that are generated at the source device and sent to the destination endpoint, wherein the source device is not provided with the actual IP address of the destination endpoint.

17. The one or more non-transitory computer-readable media of claim 16 wherein the randomized IP address is a first randomized IP address, the operations further comprising:

mapping the first randomized IP address to a first client identifier (ID) associated with the source device;

receiving another request to provide the actual IP address to another source device;

identifying a second randomized IP address to provide to the other source device;

providing the second randomized IP address for use by the other source device to contact the destination endpoint; and

mapping the second randomized IP address to a second client ID associated with the other source device.

18. The one or more non-transitory computer-readable media of claim 16 , the operations further comprising:

receiving a packet having a destination address that is the randomized IP address;

determining that a source address of the packet is a source IP address of the source device sent the packet;

performing Network Address Translation (NAT) by changing the destination address of the packet from the randomized IP address to the actual IP address of the destination endpoint; and

sending the packet to a next hop associated with the actual IP address of the destination endpoint.

19. The one or more non-transitory computer-readable media of claim 18 , the operations further comprising:

performing NAT by changing the source address of the packet from the source IP address to a particular system address associated with a system; and

mapping the particular system address to the source IP address of the source device.

20. The one or more non-transitory computer-readable media of claim 19 , the operations further comprising:

receiving a return packet from the endpoint;

determining that a destination address of the return packet is the particular system address;

based at least in part on the mapping of the particular system address to the source IP address, performing NAT by changing the destination address of the return packet from the particular system IP address to the source IP address; and

sending the return packet to the source device.

Assignments (1)

Continuity (3)

References Cited (123)