US 11,451,516 B1Granted

Device isolation service

AssigneeAmazon Technologies, Inc.

InventorEknath Venkataramani

Life of this patent

Estimating the term…

Loading patent…

Abstract

Systems and methods are described for implementing a device isolation service. A device isolation service creates and administers per-device virtual networks for individual computing devices, thereby isolating the computing devices from each other and limiting device-to-device communication. The device isolation service may further provide a monitored and access-controlled network that facilitates access to the isolated devices, thereby allowing “administrator” devices to access and administer devices while preventing a compromised device from seeing, probing, or compromising other devices on the network. The device isolation service may group devices by category or function, and may put devices that communicate with each other on the same virtual network while isolating other devices to different virtual networks.

Claims24

Dependent claims

A system comprising:

a data store configured to store virtual network assignments;
and
a network router in communication with the data store, the network router comprising a processor configured with computer-executable instructions to perform operations including:
receiving, from a first computing device on a first network, a first request to initiate network communications;
in response to receiving the first request from the first computing device, determining, based at least in part on a virtual network assignment criterion, to assign the first computing device to a first virtual network;
creating the first virtual network for the first computing device, wherein the first virtual network is created on the first network, and wherein the first computing device is the only device on the first virtual network;
assigning the first computing device to the first virtual network;
routing network communications with the first computing device via the first virtual network;
receiving, from a second computing device on the first network, a second request to initiate network communications;
in response to receiving the second request from the second computing device, determining, based on the virtual network assignment criterion, to assign the second computing device to a second virtual network;
creating the second virtual network for the second computing device, wherein the second virtual network is created on the first network, and wherein the second computing device is the only device on the second virtual network;
assigning the second computing device to the second virtual network;
and
routing network communications with the second computing device via the second virtual network.

11 more elements

A computer-implemented method comprising:

receiving, by a network router, a request from a first computing device on a first network to initiate network communications;
identifying, by the network router, a first virtual network based at least in part on applying a virtual network assignment criterion to the request from the first computing device;
assigning, by the network router, the first computing device to the first virtual network, wherein the first virtual network isolates the first computing device from at least one other computing device;
routing, by the network router, network communications with the first computing device via the first virtual network;
receiving, by the network router, a request from a second computing device on the first network to initiate network communications;
in response to receiving the request from the second computing device, identifying, by the network router, a second virtual network based at least in part on applying the virtual network assignment criterion to the request from the second computing device;
creating, by the network router, the second virtual network;
assigning, by the network router, the second computing device to the second virtual network, wherein the second virtual network isolates the second computing device from the first computing device and at least one other computing device;
routing, by the network router, network communications with the second computing device via the second virtual network.

6 more elements

Dependencies are inferred from the claim text.

Facts

Application: 16/364,029Filed 25 Mar 2019
Granted: 20 Sep 2022
Term ends: Not estimatedThe source records don’t support an estimate.

Classification10 codes

H04L 63/0272
For separating internal from external traffic, e.g. firewalls: virtual private networks
H04L 63/0227
For separating internal from external traffic, e.g. firewalls: filtering policies
H04L 63/0236
Filtering policies: filtering by address, protocol, port number or service, e.g. IP-address or URL
H04L 63/10
Network architectures or network communication protocols for network security: for controlling access to devices or network resources

Family

No related US applications are recorded in the indexed filing history.

Timeline

Citations

Open elsewhere

Building an agent or pulling many patents? Use the API or MCP server instead of scraping pages. Get an API key