Dynamic user private networks of a shared virtual network

A method, comprising:

• maintaining, by a network control system, a dynamic logical segmentation of a shared virtual network overlaying a physical network comprising a plurality of network nodes, with the dynamic logical segmentation comprising a plurality of dynamic user private networks, with a plurality of user entities communicatively coupled to respective private virtual networks of the plurality of dynamic user private networks via access devices of the plurality of network nodes in which each respective private virtual network has controlled access based on a respective group of entity tuples that define one or more of a respective user entity that is authorized to access the respective private virtual network and one or more respective access device that is authorized to access the respective private virtual network, and with communication between the plurality of entities via the shared virtual network, without traversing a gateway device, constrained according to the dynamic logical segmentation;
• and
• responsive in real-time to automated processing of a received electronic user request, automatically modifying, via the network control system the dynamic logical segmentation to associate a corresponding one of the plurality of entities to a corresponding one of the plurality of dynamic user private networks without disconnecting the corresponding one of the plurality of entities from the shared virtual network by adding an entity tuple associated with the received electronic user request to a first group of entity tuples associated with the corresponding one of the plurality of dynamic user private networks, and with both of the corresponding one of the plurality of entities and the corresponding one of the plurality of dynamic user private networks being identified in the received electronic user request.

A network, comprising:

• a plurality of physical network nodes providing a shared virtual network, with the plurality of provider network nodes using filtering of packet traffic according to logical segmentation of the shared virtual network to provide a plurality of dynamic user private networks within the shared virtual network that prevents packets being communicated, not via a gateway device, between user entities associated with different dynamic user private networks of the plurality of dynamic user private networks, with each of the plurality of dynamic user private networks associated with a different user account of a plurality of user accounts of the shared virtual network and in which each respective dynamic user private network of the plurality of dynamic user private networks has controlled access based on a respective group of entity tuples that define one or more of a respective user entity that is authorized to access the respective dynamic user private network and one or more respective access device that is authorized to access the respective dynamic user private network, with each of the plurality of dynamic user private networks associated with one or more logical or physical access points as defined by the group of entity tuples, and with the plurality of dynamic user private networks communicatively coupling entities via the logical or physical access points on respective user private networks of the plurality of dynamic user private networks;
• and
• a network control system, responsive in real-time to automated processing of received electronic dynamic user private network modification requests received from corresponding user accounts of the plurality of user accounts, performing automated modification of the dynamic logical segmentation of the shared virtual network defining which logical or physical access points of the shared virtual network belong to which of the plurality of dynamic user private networks by adding an entity tuple associated with a user private network modification request to a first group of entity tuples associated with a first dynamic user private network of the plurality of dynamic user private networks and associated with the user private network modification request.