Internet protocol based security over port forwarding tunnels

Patent metadata

Field	Value
Publication number	US-12418513-B2
Application number	US-202217855764-A
Country	US
Kind code	B2
Filing date	Jun 30, 2022
Priority date	Jun 30, 2022
Publication date	Sep 16, 2025
Grant date	Sep 16, 2025

Abstract

An application server host may receive, via a port forwarding tunnel, a connection request that includes an indication of a client internet protocol (IP) address for a client host. The application server host may identify based at least in part on the client IP address and using a mapping maintained for a plurality of client hosts, a virtual IP address that is associated with the client IP address and a client network identifier associated with the port forwarding tunnel from which the connection request is received. The application server host may open a connection between an application server hosted by the application server host and the client host using the identified virtual IP address.

First claim

What is claimed is:

1. A method for data management comprising:
receiving, at an application server host and via a port forwarding tunnel, a connection request that includes an indication of a client internet protocol (IP) address for a client host;
identifying, based at least in part on the client IP address and using a mapping maintained for a plurality of client hosts, a virtual IP address that is assigned to both the client IP address and a client network identifier, wherein the client network identifier is mapped to the port forwarding tunnel from which the connection request is received; and
opening a connection between an application server hosted by the application server host and the client host using the identified virtual IP address.

2. The method of claim 1 , wherein identifying the virtual IP address comprises:
identifying, based at least in part on the client IP address and the client network identifier, the virtual IP address from a file including the mapping and maintained at the application server host.

3. The method of claim 1 , wherein identifying the virtual IP address comprises:
transmitting, via an application programming interface (API), a request for the virtual IP address, wherein the request includes the client IP address and the client network identifier; and
receiving, in response to the request, an indication of the virtual IP address.

4. The method of claim 1 , further comprising:
receiving, at the application server host and via a second port forwarding tunnel, a second connection request that includes an indication of a second client IP address for a second client host, wherein the second client IP address has a same value as the client IP address;
identifying, based at least in part on the second client IP address and using the mapping, a second virtual IP address that is assigned to both the second client IP address and a second client network identifier, wherein the client network identifier is mapped to the second port forwarding tunnel from which the connection request is received, wherein the second client network identifier is used to differentiate between the second client IP address and the client IP address that have the same value; and
opening a second connection between the application server hosted and the second client host using the identified second virtual IP address.

5. The method of claim 1 , wherein receiving the connection request comprises:
receiving the connection request via a tunnel endpoint for the port forwarding tunnel, wherein the tunnel endpoint is provisioned for access by a second plurality of client hosts associated with the client network identifier.

6. The method of claim 1 , wherein the plurality of client hosts are associated with a plurality of loopback IP addresses in the mapping.

7. The method of claim 1 , wherein the application server host is configured to enforce security policies based at least in part on the identified virtual IP address.

8. The method of claim 1 , further comprising:
receiving, via the connection, a packet that is to be received at the application server, wherein the packet includes an IP address associated with the port forwarding tunnel;
replacing the IP address associated with the port forwarding tunnel with the virtual IP address associated with the client host based at least in part on the connection via which the packet is received; and
forwarding the packet to the application server.

9. An apparatus, comprising:
a processor;
memory coupled with the processor; and
instructions stored in the memory and executable by the processor to cause the apparatus to:
receive, at an application server host and via a port forwarding tunnel, a connection request that includes an indication of a client internet protocol (IP) address for a client host;
identify, based at least in part on the client IP address and using a mapping maintained for a plurality of client hosts, a virtual IP address that is assigned to both the client IP address and a client network identifier, wherein the client network identifier is mapped to the port forwarding tunnel from which the connection request is received; and
open a connection between an application server hosted by the application server host and the client host using the identified virtual IP address.

10. The apparatus of claim 9 , wherein the instructions to identify the virtual IP address are executable by the processor to cause the apparatus to:
identify, based at least in part on the client IP address and the client network identifier, the virtual IP address from a file including the mapping and maintained at the application server host.

11. The apparatus of claim 9 , wherein the instructions to identify the virtual IP address are executable by the processor to cause the apparatus to:
transmit, via an application programming interface (API), a request for the virtual IP address, wherein the request includes the client IP address and the client network identifier; and
receive, in response to the request, an indication of the virtual IP address.

12. The apparatus of claim 9 , wherein the instructions are further executable by the processor to cause the apparatus to:
receive, at the application server host and via a second port forwarding tunnel, a second connection request that includes an indication of a second client IP address for a second client host, wherein the second client IP address has a same value as the client IP address;
identify, based at least in part on the second client IP address and using the mapping, a second virtual IP address that is assigned to both the second client IP address and a second client network identifier, wherein the client network identifier is mapped to the second port forwarding tunnel from which the connection request is received, wherein the second client network identifier is used to differentiate between the second client IP address and the client IP address that have the same value; and
open a second connection between the application server hosted and the second client host using the identified second virtual IP address.

13. The apparatus of claim 9 , wherein the instructions to receive the connection request are executable by the processor to cause the apparatus to:
receive the connection request via a tunnel endpoint for the port forwarding tunnel, wherein the tunnel endpoint is provisioned for access by a second plurality of client hosts associated with the client network identifier.

14. The apparatus of claim 9 , wherein the plurality of client hosts are associated with a plurality of loopback IP addresses in the mapping.

15. The apparatus of claim 9 , wherein the application server host is configured to enforce security policies based at least in part on the identified virtual IP address.

16. The apparatus of claim 9 , wherein the instructions are further executable by the processor to cause the apparatus to:
receive, via the connection, a packet that is to be received at the application server, wherein the packet includes an IP address associated with the port forwarding tunnel;
replace the IP address associated with the port forwarding tunnel with the virtual IP address associated with the client host based at least in part on the connection via which the packet is received; and
forward the packet to the application server.

17. A non-transitory computer-readable medium storing code, the code comprising instructions executable by a processor to:
receive, at an application server host and via a port forwarding tunnel, a connection request that includes an indicati

Assignees

• Rubrik Inc

Inventors

• Du Fan
• Luo Jiangbin
• Bansal Pradeep
• Jang Keon

Classifications

• H04L63/0236 Primary

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title

• H04L63/20

  for managing network security; network security policies in general (filtering policies H04L63/0227) · CPC title

• H04L63/0272

  Virtual private networks · CPC title

• H04L63/029 Primary

  Firewall traversal, e.g. tunnelling or, creating pinholes · CPC title