US 12,445,407 B2
Anonymizing client-side addresses
Pascal Thubert, Roquefort les Pins (FR); Eric A Voit, Bethesda, MD (US); and Eric Levy-Abegnoli, Valbonne (FR)
Assigned to Cisco Technology, Inc., San Jose, CA (US)
Filed by Cisco Technology, Inc., San Jose, CA (US)
Filed on Aug. 24, 2023, as Appl. No. 18/237,578.
Prior Publication US 2025/0071083 A1, Feb. 27, 2025
Int. Cl. G06F 15/16 (2006.01); H04L 9/40 (2022.01); H04L 61/2503 (2022.01); H04L 61/4511 (2022.01)
CPC H04L 61/2503 (2013.01) [H04L 61/4511 (2022.05); H04L 63/0421 (2013.01)] 20 Claims
OG exemplary drawing
 
11. A method performed at least partly by a computing system that anonymizes Internet Protocol (IP) addresses of client devices using prefix address translation (PAT) IP addresses, the method comprising:
generating a PAT Virtual IP (VIP) address based at least in part on an IP address of a client device;
mapping the IP address of the client device to the PAT VIP address;
storing a first association between a client identifier (ID) of the client device and the PAT VIP address;
receiving a first packet having a destination address that is an IP address of an endpoint;
determining that a destination address of the first packet is a VIP address associated with the endpoint;
determining that a source device is the client device to which the VIP address associated with the endpoint was provided;
performing PAT by changing a source address of the first packet from the IP address of the client device to the PAT VIP address;
sending the first packet to a next hop associated with the IP address of the endpoint in response to determining that the source device is the client device to which the VIP address associated with the endpoint was provided;
receiving a second packet from the endpoint;
determining that a destination address of the second packet is the PAT VIP address;
based at least in part on the mapping of the PAT VIP address to the IP address of the client device, performing PAT by changing the destination address of the second packet from the PAT VIP address to the IP address of the client device; and
sending the second packet to the client device.