# US 11,909,591 B2 · Dynamic user private networks of a shared virtual network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,909,591 B2 - Document ID: US11909591B2 - Status: Granted - Kind: B2 - Application number: 18/322,236 - Filed: 2023-05-23 - Published: 2023-09-21 - Granted: 2024-02-20 - Earliest claimed: 2020-09-25 - Assignees: Cisco Technology, Inc. - Applicants: Cisco Technology, Inc. - Inventors: Shyamsundar N. Maniyar; Sanjay Kumar Hooda; Shree N. Murthy; Sonal Prem Kumar Chhabria; Akshay Dorwat - Web page: https://patentgrep.com/patent/US11909591B2 ## CPC - H04L 41/0813: characterised by the conditions triggering a change of settings - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 41/0897: by horizontal or vertical scaling of resources, or by migrating entities, e.g. virtual resources or entities - H04L 67/306: User profiles - H04L 45/64: using an overlay routing layer - H04L 2212/00: Encapsulation of packets - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In one embodiment, dynamic user private networks are virtually segmented within a shared virtual network. A network control system maintains the dynamic logical segmentation of the shared virtual network. User entities (e.g., user devices and/or services) are communicatively coupled to respective personal virtual networks via endpoints of access devices. Each of these endpoints is associated with a corresponding user private network. Responsive in real-time to automated processing of a received electronic particular user request, the network control system automatically modifies the dynamic logical segmentation of the shared virtual network to move a particular user entity on the shared virtual network to newly being on the first dynamic user private network without being disconnected from the shared virtual network. One embodiment uses different user private network identifiers (UPN-IDs) associated with endpoints and received packets to identify their respective user private network. ## Claims ### Claim 1 A method, comprising: maintaining, by a network control system, a private virtual network that has controlled access based on a respective group of entity tuples that define one or more of a respective user entity that is authorized to access the private virtual network and one or more respective access device that is authorized to access the private virtual network; and responsive in real-time to automated processing of a received electronic user request, automatically modifying, by the network control system, a dynamic logical segmentation associated with the private virtual network to change a user entity from being on a shared virtual network but not on a dynamic user private network to being on the dynamic user private network without being disconnected from the shared virtual network by adding an entity tuple associated with the received electronic user request to a group of entity tuples associated with the dynamic user private network. ### Claim 2 (depends on 1) The method of claim 1, wherein dynamic user private network is part of a plurality of dynamic user private networks comprising a first dynamic user private network, with a plurality of user accounts associated with the shared virtual network, and with the plurality of user accounts comprising a first user account and wherein: the first user account is an owner of the first dynamic user private network; the plurality of user accounts comprises a second user account owning a second dynamic user private network of the plurality of dynamic user private networks; and the user entity was on the second dynamic user private network when the automatically modifying of the dynamic logical segmentation was initiated. ### Claim 3 (depends on 2) The method of claim 2, wherein the user entity is owned by the second user account; and wherein the automatically modifying of the dynamic logical segmentation does not move one or more other second entities owned by the second user account and currently being on the second dynamic user private network to being on the first dynamic user private network. ### Claim 4 (depends on 2) The method of claim 2, wherein the received electronic user request is sent from a first initiating user entity on the shared virtual network and owned by the first user account. ### Claim 5 (depends on 4) The method of claim 4, wherein the first initiating user entity receives a second received request identifying a request for the user entity to be placed on the first dynamic user private network, and wherein the received electronic user request is sent by the first initiating user entity in response to the second received request. ### Claim 6 (depends on 4) The method of claim 4, wherein the first initiating user entity receives a second received request identifying a request for the user entity to be placed on the first dynamic user private network and wherein the received electronic user request is sent by the first initiating user entity in response to the second received request and user input on the first initiating user entity authorizing the request for the user entity to be placed on the first dynamic user private network. ### Claim 7 (depends on 2) The method of claim 2, wherein the received electronic user request is sent from a second initiating user entity on the shared virtual network and owned by the second user account. ### Claim 8 (depends on 2) The method of claim 2, wherein the received electronic user request indicates a request for the user entity to be placed on the first dynamic user private network. ### Claim 9 (depends on 2) The method of claim 2, wherein each of the plurality of dynamic user private networks is owned by a different user account of the plurality of user accounts. ### Claim 10 (depends on 2) The method of claim 2, wherein each of the plurality of dynamic user private networks is associated with a unique User Private Network Identifier (UPN-ID); and wherein the shared virtual network associates each packet received from an entity on one of the plurality of dynamic user private networks with a corresponding unique UPN-ID. ### Claim 11 (depends on 10) The method of claim 10, comprising: sending, by the user entity communicatively coupled to the first dynamic user private network via a first network access device of a plurality of network nodes, a first plurality of packets to a second user entity communicatively coupled to the first dynamic user private network via a second network access device of the plurality of network nodes; and for each first original packet of the first plurality of packets received and after having identified that the second user entity is associated with the first dynamic user private network, the first network access device encapsulating the first original packet in an encapsulating packet comprising the corresponding unique UPN-ID corresponding to the first dynamic user private network and then sending the encapsulating packet towards the second network access device. ### Claim 12 (depends on 10) The method of claim 10, wherein associating each packet comprises encapsulating the packet in an encapsulating packet comprising the corresponding unique UPN-ID. ### Claim 13 (depends on 12) The method of claim 12, comprising: sending, by the user entity communicatively coupled to the first dynamic user private network via a first network access device of a plurality of network nodes, a first plurality of packets to a second user entity communicatively coupled to the first dynamic user private network via a second network access device of the plurality of network nodes; for each first original packet of the first plurality of packets received, encapsulating, via the first network access device, the first original packet in an encapsulating packet comprising the corresponding unique UPN-ID corresponding to the first dynamic user private network and then sending the encapsulating packet towards the second network access device; and egress processing based on the corresponding unique UPN-ID corresponding to the first dynamic user private network by the second network access device for each received packet of the first plurality of packets, wherein the egress processing comprises: dropping the received packet in response to the received packet not including the corresponding unique UPN-ID corresponding to the first dynamic user private network, and decapsulating an original packet from the received packet and forwarding the original packet to the second user entity responsive to the received packet comprising the corresponding unique UPN-ID corresponding to the first dynamic user private network. ### Claim 14 (depends on 13) The method of claim 13, further comprising, prior to the encapsulating of the first original packet, identifying, by the first network access device, that the second user entity is associated with the corresponding unique UPN-ID corresponding to the first dynamic user private network. ### Claim 15 (depends on 2) The method of claim 2, comprising: sending, by the user entity communicatively coupled to the first dynamic user private network via a first network access device of a plurality of network nodes, a first plurality of packets to a second user entity communicatively coupled to the first dynamic user private network via a second network access device of the plurality of network nodes; and for each first original packet of the first plurality of packets received and after having identified that the second user entity is associated with the first dynamic user private network, sending, by the first network access device, the first original packet, natively or in an encapsulating packet, towards the second network access device. ### Claim 16 A method, comprising: maintaining, by a network control system, a private virtual network that has controlled access based on a respective group of entity tuples that define one or more of a respective user entity that is authorized to access the private virtual network and one or more respective access device that is authorized to access the private virtual network, and with communication between a plurality of entities via a shared virtual network, without traversing a gateway device, constrained according to a dynamic logical segmentation; and responsive in real-time to automated processing of a received electronic user request, automatically modifying, via the network control system, the dynamic logical segmentation to associate a corresponding one of the plurality of entities to a corresponding one of a plurality of dynamic user private networks without disconnecting the corresponding one of the plurality of entities from the shared virtual network by adding an entity tuple associated with the received electronic user request to a first group of entity tuples associated with the corresponding one of the plurality of dynamic user private networks. ### Claim 17 (depends on 16) The method of claim 16, wherein each of the plurality of dynamic user private networks are associated with a different one of a plurality of user accounts of the shared virtual network; and wherein the received electronic user request is authorized via a corresponding one of the plurality of entities associated with a user account associated with the corresponding one of the plurality of dynamic user private networks. ### Claim 18 A system, comprising: one or more processors; and a computer-readable storage medium storing instructions which, when executed by the one or more processors, causes the one or more processors to perform operations comprising: maintaining a private virtual network that has controlled access based on a respective group of entity tuples that define one or more of a respective user entity that is authorized to access the private virtual network and one or more respective access device that is authorized to access the private virtual network; and responsive in real-time to automated processing of a received electronic user request, automatically modifying a dynamic logical segmentation associated with the private virtual network to change a user entity from being on a shared virtual network but not on a dynamic user private network to being on the dynamic user private network without being disconnected from the shared virtual network by adding an entity tuple associated with the received electronic user request to a group of entity tuples associated with the dynamic user private network. ### Claim 19 (depends on 18) The system of claim 18, wherein the automatically modifying of the dynamic logical segmentation of the shared virtual network comprises changing a logical or physical access points from being associated with a packet to a different dynamic user private network of a plurality of dynamic user private networks for one or more of a received electronic dynamic user private network modification request. ### Claim 20 (depends on 19) The system of claim 19, wherein computer-readable storage medium stores additional instructions which, when executed by the one or more processors, causes the one or more processors to perform operations comprising: performing dynamic user private network egress packet filtering of each packet of a plurality of packets based on a matching of: a packet marking User Private Network Identifier (UPN-ID) associated with the logical or physical access points on which the packet was received from a sending user entity; and an egress UPN-ID associated with the logical or physical access points from which the packet is to be communicated to a receiving user entity, wherein the packet marking UPN-ID is added to the packet or included in an encapsulating packet encapsulating the packet.