# US 11,451,516 B1 · Device isolation service > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,451,516 B1 - Document ID: US11451516B1 - Status: Granted - Kind: B1 - Application number: 16/364,029 - Filed: 2019-03-25 - Granted: 2022-09-20 - Earliest claimed: 2019-03-25 - Assignees: Amazon Technologies, Inc. - Applicants: Amazon Technologies, Inc. - Inventors: Eknath Venkataramani - Web page: https://patentgrep.com/patent/US11451516B1 ## CPC - H04L 63/0272: {Virtual private networks} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/10: {for controlling access to devices or network resources} - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04W 12/086: using security domains - H04W 12/50: Secure pairing of devices - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Systems and methods are described for implementing a device isolation service. A device isolation service creates and administers per-device virtual networks for individual computing devices, thereby isolating the computing devices from each other and limiting device-to-device communication. The device isolation service may further provide a monitored and access-controlled network that facilitates access to the isolated devices, thereby allowing “administrator” devices to access and administer devices while preventing a compromised device from seeing, probing, or compromising other devices on the network. The device isolation service may group devices by category or function, and may put devices that communicate with each other on the same virtual network while isolating other devices to different virtual networks. ## Claims ### Claim 1 A system comprising: a data store configured to store virtual network assignments; and a network router in communication with the data store, the network router comprising a processor configured with computer-executable instructions to perform operations including: receiving, from a first computing device on a first network, a first request to initiate network communications; in response to receiving the first request from the first computing device, determining, based at least in part on a virtual network assignment criterion, to assign the first computing device to a first virtual network; creating the first virtual network for the first computing device, wherein the first virtual network is created on the first network, and wherein the first computing device is the only device on the first virtual network; assigning the first computing device to the first virtual network; routing network communications with the first computing device via the first virtual network; receiving, from a second computing device on the first network, a second request to initiate network communications; in response to receiving the second request from the second computing device, determining, based on the virtual network assignment criterion, to assign the second computing device to a second virtual network; creating the second virtual network for the second computing device, wherein the second virtual network is created on the first network, and wherein the second computing device is the only device on the second virtual network; assigning the second computing device to the second virtual network; and routing network communications with the second computing device via the second virtual network. ### Claim 2 (depends on 1) The system of claim 1, wherein the first virtual network comprises an Internet Protocol version 4 (“IPv4”) network with a 32-bit subnet mask. ### Claim 3 (depends on 1) The system of claim 1, wherein the operations further include determining that the first computing device has not previously been assigned to a virtual network. ### Claim 4 (depends on 1) The system of claim 1, wherein the operations further include: receiving, from an administrator computing device, a third request to communicate with the first computing device via a second network; determining that the administrator computing device is authorized to access the first computing device; granting the administrator computing device access to the second network; and routing communications between the administrator computing device on the second network and the first computing device on the first virtual network. ### Claim 5 (depends on 4) The system of claim 4, wherein the third request to communicate with the first computing device via the second network comprises a request to access the second network. ### Claim 6 A computer-implemented method comprising: receiving, by a network router, a request from a first computing device on a first network to initiate network communications; identifying, by the network router, a first virtual network based at least in part on applying a virtual network assignment criterion to the request from the first computing device; assigning, by the network router, the first computing device to the first virtual network, wherein the first virtual network isolates the first computing device from at least one other computing device; routing, by the network router, network communications with the first computing device via the first virtual network; receiving, by the network router, a request from a second computing device on the first network to initiate network communications; in response to receiving the request from the second computing device, identifying, by the network router, a second virtual network based at least in part on applying the virtual network assignment criterion to the request from the second computing device; creating, by the network router, the second virtual network; assigning, by the network router, the second computing device to the second virtual network, wherein the second virtual network isolates the second computing device from the first computing device and at least one other computing device; routing, by the network router, network communications with the second computing device via the second virtual network. ### Claim 7 (depends on 6) The computer-implemented method of claim 6 further comprising receiving, by the network router, a request from a third computing device on a second network to access the first computing device; and routing, by the network router, network communications between the third computing device on the second network and the first computing device on the first virtual network. ### Claim 8 (depends on 6) The computer-implemented method of claim 6 further comprising creating the first virtual network in response to the request from the first computing device. ### Claim 9 (depends on 6) The computer-implemented method of claim 6, wherein the first virtual network is an existing virtual network. ### Claim 10 (depends on 6) The computer-implemented method of claim 6, wherein the at least one other computing device is on a third virtual network. ### Claim 11 (depends on 6) The computer-implemented method of claim 6 further comprising: receiving, from a third computing device on the first network, a request to initiate network communications; determining that the third computing device is associated with a category of networked computing devices; determining that the first computing device is associated with the category of networked computing devices; and assigning the third computing device to the first virtual network. ### Claim 12 (depends on 6) The computer-implemented method of claim 6 further comprising analyzing network communications with the first computing device to identify a first pattern. ### Claim 13 (depends on 7) The computer-implemented method of claim 7 further comprising: receiving, by the network router, a request from the third computing device to access the second computing device; and denying the request to access the second computing device. ### Claim 14 (depends on 9) The computer-implemented method of claim 9, wherein the virtual network assignment criterion specifies one or more of a category of the first computing device, a type of the first computing device, network traffic generated by the first computing device, or that the first computing device has not previously been assigned to a virtual network. ### Claim 15 (depends on 11) The computer-implemented method of claim 11, wherein the category of networked computing devices comprises one or more of security devices, virtual assistant devices, lighting devices, content presentation devices, or appliances. ### Claim 16 (depends on 12) The computer-implemented method of claim 12, wherein the first pattern comprises one or more of: network communications with an identified set of servers, bandwidth utilization within an identified range, or periodic network communications. ### Claim 17 (depends on 12) The computer-implemented method of claim 12 further comprising: analyzing further network communications with the first computing device to identify a deviation from the first pattern; and notifying a user of the deviation from the first pattern. ### Claim 18 A non-transitory computer-readable medium including computer-executable instructions that, when executed by a computing device, cause the computing device to perform operations including: receiving a request from a first computing device to initiate network communications; assigning the first computing device to a first virtual network based at least in part on a virtual network assignment criterion; routing network communications with the first computing device via the first virtual network, wherein the first virtual network isolates the first computing device from at least one other computing device; receiving a request from a second computing device to initiate network communications; and routing network communications with the second computing device via a second virtual network, wherein the second virtual network isolates the second computing device from at least one other computing device, and wherein the second virtual network is created in response to the request from the second computing device to initiate network communications. ### Claim 19 (depends on 18) The non-transitory computer-readable medium of claim 18, wherein the operations further include: receiving a request from the second computing device to access the first computing device; and routing network communications between the second computing device on a second network and the first computing device on the first virtual network. ### Claim 20 (depends on 18) The non-transitory computer-readable medium of claim 18, wherein the first virtual network is implemented on a first network. ### Claim 21 (depends on 18) The non-transitory computer-readable medium of claim 18, wherein the second computing device comprises an administrator device associated with the first computing device. ### Claim 22 (depends on 19) The non-transitory computer-readable medium of claim 19, wherein the operations further include: determining that the second computing device no longer satisfies an administrator network access criterion for accessing the first computing device; and in response to the determination, ceasing to route network communications between the second computing device and the first computing device. ### Claim 23 (depends on 20) The non-transitory computer-readable medium of claim 20, wherein the request from the first computing device to initiate network communications comprises joining the first network. ### Claim 24 (depends on 22) The non-transitory computer-readable medium of claim 22, wherein the administrator network access criterion comprises one or more of a time limit, bandwidth limit, network utilization limit, threshold number of devices accessed, threshold amount of idle time, or authorized set of network activities.