# US 10,313,494 B2 · Methods and systems for identifying data sessions at a VPN gateway > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,313,494 B2 - Document ID: US10313494B2 - Status: Granted - Kind: B2 - Application number: 15/613,412 - Filed: 2017-06-05 - Published: 2017-09-21 - Granted: 2019-06-04 - Earliest claimed: 2014-10-24 - Assignees: Pismo Labs Technology Limited - Applicants: Pismo Labs Technology Limited - Inventors: Ying Kwan; Ho Cheung Lam; Wan Chun Leung; Kit Wai Chau - Web page: https://patentgrep.com/patent/US10313494B2 ## CPC - H04L 69/22: Parsing or analysis of headers - H04L 12/413: with random access, e.g. carrier-sense multiple-access with collision detection [CSMA-CD] - H04L 12/417: with deterministic access, e.g. token passing - H04L 12/4625: {Single bridge functionality, e.g. connection of two networks over a single bridge} - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 12/64: Hybrid switching systems - H04L 12/6418: {Hybrid transport} - H04L 43/028: by filtering - H04L 43/045: for graphical visualisation of monitoring data - H04L 43/106: using time related information in packets, e.g. by adding timestamps - H04L 43/18: Protocol analysers - H04L 47/2483: involving identification of individual flows - H04L 61/2514: between local and global IP addresses - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/0272: {Virtual private networks} - H04L 61/2592: using tunnelling or encapsulation - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Methods and systems for transmitting data packets from a host to a destination via a virtual private network (VPN) connection at a VPN gateway. VPN gateway receives encapsulated packets via the VPN connection. The encapsulated packets encapsulate the data packets originated from the host. VPN gateway decapsulates the encapsulated packets to retrieve the data packets. VPN gateway determines whether the data packets originated from an IoT device based on IP address of the host. When the host is the IoT device, VPN gateway performs deep packet inspection (DPI) on the data packets. VPN gateway determines whether the data packets are allowed to be transmitted to the destination. When the data packets are allowed to be transmitted to the destination, VPN gateway transmits the data packets to the destination. ## Claims ### Claim 1 A method for transmitting data packets from a host to a destination via a virtual private network (VPN) connection at a first VPN gateway, the method comprising: A) receiving encapsulated packets via the VPN connection, wherein the encapsulated packets encapsulate the data packets originated from the host; B) decapsulating the encapsulated packets to retrieve the data packets; C) determining whether the data packets originated from an IoT device based on a control message received from a second VPN gateway; D) when the host is the IoT device: i) performing deep packet inspection (DPI) on the data packets; ii) determining whether the data packets are allowed to be transmitted to the destination; iii) transmitting the data packets when the data packets are allowed to be transmitted to the destination; iv) storing the data packets for further processing when the data packets are not allowed to be transmitted to the destination; E) when the host is not an IoT device: i) performing deep packet inspection (DPI) on the data packets for collecting information on the data packets to update a DPI database; and ii) transmitting the data packets to the destination. ### Claim 2 (depends on 1) The method according to claim 1, wherein the host is the IoT device and further comprising: determining whether an address of the destination is on a whitelist; and when the address of the destination is on the whitelist: performing step D)i). ### Claim 3 (depends on 1) The method according to claim 1, wherein the first VPN gateway is a VPN hub, wherein the VPN hub establishes one or more VPN connections with one or more other VPN gateways respectively, wherein the one or more other VPN gateways include the second VPN gateway. ### Claim 4 (depends on 1) The method according to claim 1, further comprising: after step D)i): identifying one or more data sessions the data packets belong to; updating a DPI database based on the one or more data sessions; displaying information corresponding to the one or more data sessions at a user interface, wherein the information comprises one or more of the following: correlation between IP addresses, protocols of encapsulating packets, host identity, VPN gateway identity, applications name, websites identity, and statistical information related to data sessions, wherein the information is retrieved from the DPI database; and performing step D)ii). ### Claim 5 (depends on 4) The method according to claim 4, wherein the step of updating includes adding a new record in the DPI database if one or more data sessions are identified the first time. ### Claim 6 (depends on 5) The method according to claim 5, wherein the information is categorized according to a plurality of categories. ### Claim 7 (depends on 6) The method according to claim 6, wherein the information includes correlation among items in the plurality of categories. ### Claim 8 (depends on 7) The method according to claim 7, wherein the user interface is shown on a display, wherein the display is not coupled to the VPN gateway. ### Claim 9 A method for transmitting data packets from a host to a destination via a virtual private network (VPN) connection at a first VPN gateway, the method comprising: E) receiving encapsulated packets via the VPN connection, wherein the encapsulated packets encapsulate the data packets originated from the host; F) decapsulating the encapsulated packets to retrieve the data packets; G) determining whether the data packets originated from an IoT device based on a control message received from a second VPN gateway; H) wherein when the host is the IoT device: i) determining whether an address of the destination is on a whitelist; ii) transmitting the data packets when the address of the destination is on the whitelist; iii) storing the data packets for further processing when the address of the destination is not on the whitelist; and I) when the host is not an IoT device: i) transmitting the data packets to the destination. ### Claim 10 (depends on 2, 9) The method according to claim 2 or claim 9, wherein the whitelist is stored in one of, the VPN gateway or a remote server. ### Claim 11 A first VPN gateway for transmitting data packets transmitted from a host to a destination via a VPN connection, comprising: at least one network interface; at least one processing unit; at least one main memory; and at least one computer readable storage medium comprising program instructions executable by the at least one processing unit for: A) receiving encapsulated packets via the VPN connection, wherein the encapsulated packets encapsulate the data packets originated from the host; B) decapsulating the encapsulated packets to retrieve the data packets; C) determining whether the data packets originated from an IoT device based on a control message received from a second VPN gateway; D) when the host is the IoT device: i) performing deep packet inspection (DPI) on the data packets; ii) determining whether the data packets are allowed to be transmitted to the destination; iii) transmitting the data packets when the data packets are allowed to be transmitted to the destination; iv) storing the data packets for further processing when the data packets are not allowed to be transmitted to the destination; E) when the host is not an IoT device: i) performing deep packet inspection (DPI) on the data packets for collecting information on the data packets to update a DPI database; and ii) transmitting the data packets to the destination. ### Claim 12 (depends on 11) The first VPN gateway of claim 11, wherein the at least one computer readable storage medium further comprises program instructions executable by the at least one processing unit to perform the operation of, when the host is the IoT device, determining whether an address of the destination is on a whitelist and when the address of the destination is on the whitelist: performing step D)i). ### Claim 13 (depends on 11) The first VPN gateway of claim 11, wherein the first VPN gateway is a VPN hub, wherein the VPN hub establishes one or more VPN connections with one or more other VPN gateways respectively, wherein the one or more other VPN gateways includes the second VPN gateways. ### Claim 14 (depends on 11) The first VPN gateway of claim 11, wherein the at least one computer readable storage medium further comprises program instructions executable by the at least one processing unit to perform, after step D)i), the operation of: identifying one or more data sessions the data packets belong to; updating a DPI database based on the one or more data sessions; displaying information corresponding to the one or more data sessions at a user interface, wherein the information comprises one or more of the following: correlation between IP addresses, protocols of encapsulating packets, host identity, VPN gateway identity, applications name, websites identity, and statistical information related to data sessions, wherein the information is retrieved from the DPI database; and performing step D)ii). ### Claim 15 (depends on 14) The first VPN gateway of claim 14, wherein the step of updating includes adding a new record in the DPI database if one or more data sessions are identified for the first time. ### Claim 16 (depends on 15) The first VPN gateway of claim 15, wherein the information is categorized according to a plurality of categories. ### Claim 17 (depends on 16) The first VPN gateway of claim 16, wherein the information includes correlation among items in the plurality of categories. ### Claim 18 (depends on 17) The first VPN gateway of claim 17, wherein the user interface is shown on a display, wherein the display is not coupled to the first VPN gateway. ### Claim 19 A first VPN gateway for transmitting data packets transmitted from a host to a destination via a VPN connection, comprising: at least one network interface; at least one processing unit; at least one main memory; and at least one computer readable storage medium comprising program instructions executable by the at least one processing unit for: E) receiving encapsulated packets via the VPN connection, wherein the encapsulated packets encapsulate the data packets originated from the host; F) decapsulating the encapsulated packets to retrieve the data packets; G) determining whether the data packets originated from an IoT device based on a control message received from a second VPN gateway; H) wherein when the host is the IoT device: i) determining whether an address of the destination is on a whitelist; ii) transmitting the data packets when the address of the destination is on the whitelist; iii) storing the data packets for further processing when the address of the destination is not on the whitelist, and I) when the host is not an IoT device: i) transmitting the data packets to the destination. ### Claim 20 (depends on 12, 19) The first VPN gateway of claim 12 or claim 19, wherein the whitelist is stored in one of, the first VPN gateway or a remote server.