Granted Patent B1

US 12,335,351 · App. 18/968,906 · Granted Jun 17, 2025

Inventors: Rumen Nikolov Telbizov (Burnaby, CA); Matthew Gordon Mercer (Rossland, CA); Christopher Turra (Port Coquitlam, CA); Omid Ehtemam-Haghighi (North Saanich, CA); Hugo Marius Slabbert (Mission, CA)

Assignee: Menlo Security, Inc.

H04L67/56H04L12/4633H04L45/306

Abstract

Claims (49)

1. A system, comprising:

a first server, comprising at least one processor and at least one memory, configured to:

process a received first IPv4 packet, including by:

inserting data into an IPV4 field of the first IPv4 packet to form an augmented IPv4 packet;

translating the augmented IPv4 packet to a first IPv6 packet, wherein the first IPv6 packet includes the inserted data; and

encapsulating the first IPv6 packet to form an encapsulation; and

transmit the encapsulation to a second server;

the second server, configured to:

receive the encapsulation from the first server; and

determine a third server to which the encapsulation should be routed and transmit the encapsulation to the third server; and

the third server, configured to:

receive the encapsulation from the second server;

process the encapsulation to form a second IPv6 packet;

translate the second IPv6 packet to a second IPv4 packet, including by stripping options data; and

select a public IP address and transmit the second IPv4 packet using the selected public IP address as a source address of the second IPv4 packet.

2. The system of claim 1 , wherein the IPV4 field comprises an IPV4 Options field.

3. The system of claim 2 , wherein translating the generated IPv4 packet includes translating the data inserted into the IPV4 Options field.

4. The system of claim 1 , wherein translating the generated IPv4 packet includes disambiguating the IPv4 packet.

5. The system of claim 1 , wherein inserting the data includes inserting a tenant identifier.

6. The system of claim 1 , wherein inserting the data includes inserting a consistency identifier.

7. The system of claim 1 , wherein inserting the data includes inserting a policy identifier.

8. The system of claim 1 , wherein inserting the data includes inserting a policy routing marker.

9. The system of claim 8 , wherein the policy routing marker comprises a consistency identifier and a policy identifier.

10. The system of claim 8 , wherein a given packet is dropped in the event the given packet is missing the policy routing marker.

11. The system of claim 1 , wherein the received first IPv4 packet has an associated policy requirement.

12. The system of claim 11 , wherein the policy requirement is determined by the first server.

13. The system of claim 11 , wherein the policy requirement includes a geolocation requirement.

14. The system of claim 11 , wherein the third server is configured to select the public IP address at least in part by evaluating the policy.

15. The system of claim 1 , wherein the third server is configured to select the public IP address at least in part based on the policy routing marker.

16. The system of claim 1 , wherein the first server is configured to use Geneve to perform the encapsulation.

17. The system of claim 1 , wherein at least one of the servers has an eBPF kernel extension.

18. The system of claim 1 , wherein the received first IPv4 packet is part of a web session comprising a first TCP connection and second TCP connection, and wherein the second TCP connection is processed so as to maintain IP stickiness for the session.

19. The system of claim 1 , wherein the second server is configured to further encapsulate the encapsulation with Wireguard.

20. The system of claim 1 , wherein the second server is configured to provide IP space continuity via a failover datacenter.

21. A method, comprising:

at a first server:

processing a received first IPv4 packet, including by:

inserting data into an IPV4 field of the first IPv4 packet to form an augmented IPv4 packet;

translating the augmented IPv4 packet to a first IPv6 packet, wherein the first IPv6 packet includes the inserted data; and

encapsulating the first IPv6 packet to form an encapsulation; and

transmit the encapsulation to a second server;

at the second server:

receiving the encapsulation from the first server; and

determining a third server to which the encapsulation should be routed and transmit the encapsulation to the third server; and

at the third server:

receiving the encapsulation from the second server;

processing the encapsulation to form a second IPv6 packet;

translating the second IPv6 packet to a second IPv4 packet, including by stripping options data; and

selecting a public IP address and transmit the second IPv4 packet using the selected public IP address as a source address of the second IPv4 packet.

Assignments (1)

Continuity (2)

References Cited (17)