# US 11,910,193 B2 · Methods and systems for segmenting computing devices in a network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 11,910,193 B2 - Document ID: US11910193B2 - Status: Granted - Kind: B2 - Application number: 17/888,535 - Filed: 2022-08-16 - Published: 2022-12-08 - Granted: 2024-02-20 - Earliest claimed: 2020-02-04 - Assignees: BlackBerry Limited - Applicants: BlackBerry Limited - Inventors: James Randolph Winter Lepp; Stephen McCann; Michael Peter Montemurro - Web page: https://patentgrep.com/patent/US11910193B2 ## CPC - H04L 63/065: {for group communications (cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833)} - H04W 12/084: using delegated authorisation, e.g. open authorisation [OAuth] protocol - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04W 12/069: using certificates or pre-shared keys - H04W 12/55: involving three or more devices, e.g. group pairing - H04W 12/76: Group identity - H04W 76/11: Allocation or use of connection identifiers - H04L 2209/80: Wireless - H04L 2209/84: Vehicles - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Methods and systems of segmenting computing devices in a wireless network having an access point broadcasting in a single domain are described. In an exemplary method, a request to join the wireless network is received from a computing device. The request is associated with an identifier. When the identifier is not associated with a virtual network within the wireless network, a virtual network is configured within the wireless network and the identifier is associated thereto and the computing device is assigned thereto. When the identifier is associated with an existing virtual network within the wireless network, the computing device is assigned to the existing virtual network. ## Claims ### Claim 1 A method of segmenting computing devices in a wireless network having an access point broadcasting in a single broadcast domain, the method comprising: receiving, from a first computing device, a request to join the wireless network, the request associated with an identifier; determining that the identifier is not associated with an existing virtual network within the wireless network; responsive to determining that the identifier is not associated with the existing virtual network within the wireless network, configuring a virtual network within the wireless network and associating the identifier thereto; creating an address resolution protocol table associated with the virtual network; and assigning the first computing device to the virtual network by adding an address of the first computing device to the address resolution protocol table associated with the virtual network. ### Claim 2 (depends on 1) The method of claim 1, wherein the address of the first computing device includes at least one of an internet protocol address or a medium access control address, and wherein the identifier is at least one of a username, a password, a group name, a group password, a digital certificate, a hardware token, a subscriber identification module, a public key and an attribute associated with a certificate. ### Claim 3 (depends on 1) The method of claim 1, further comprising: receiving, from a second computing device, a request to join the wireless network, the request associated with the identifier; and assigning the second computing device to the virtual network by adding an address of the second computing device to the address resolution protocol table associated with the virtual network. ### Claim 4 (depends on 1) The method of claim 1, further comprising: determining that the first computing device has left the wireless network; and removing the first computing device from the virtual network by removing the address of the first computing device from the address resolution protocol table associated with the virtual network. ### Claim 5 (depends on 1) The method of claim 1, further comprising: determining that the first computing device is the last computing device of the virtual network to leave the wireless network; and deleting the virtual network. ### Claim 6 (depends on 1) The method of claim 1, wherein all computing devices within the virtual network have at least one of unrestricted communication with one another and unlimited access to one another. ### Claim 7 (depends on 1) The method of claim 1 wherein each virtual network within the wireless network comprises a broadcast domain enforcement layer such that a computing device assigned to the virtual network can access only other computing devices assigned to the same virtual network. ### Claim 8 (depends on 1) The method of claim 1, wherein each virtual network within the wireless network comprises an internet protocol broadcast domain enforcement layer such that when an internet protocol packet is received and includes an address outside the virtual network, the internet protocol packet is transmitted to the address outside the virtual network. ### Claim 9 (depends on 1) The method of claim 1, wherein each virtual network within the wireless network comprises at least one of a network level service and a firewall layer, wherein the at least one of the network level service and the firewall layer are configured to be recognized and accessed by the assigned computing device as another computing device assigned to the virtual network. ### Claim 10 A server associated with a wireless network, the server comprising: a processor; a memory; and processor-executable instructions that, when executed by the processor, cause the processor to: receive, from a first computing device, a request to join the wireless network, the request associated with an identifier; determine that the identifier is not associated with an existing virtual network within the wireless network; responsive to determining that the identifier is not associated with the existing virtual network within the wireless network, configure a virtual network within the wireless network and associate the identifier thereto; create an address resolution protocol table associated with the virtual network; and assign the first computing device to the virtual network by adding an address of the first computing device to the address resolution protocol table associated with the virtual network. ### Claim 11 (depends on 10) The server of claim 10, wherein the address of the first computing device includes at least one of an internet protocol address or a medium access control address, and wherein the identifier is at least one of a username, a password, a group name, a group password, a digital certificate, a hardware token, a subscriber identification module, a public key and an attribute associated with a certificate. ### Claim 12 (depends on 10) The server of claim 10, wherein the processor-executable instructions, when executed by the processor, further cause the processor to: receive, from a second computing device, a request to join the wireless network, the request associated with the identifier; and assign the second computing device to the virtual network by adding an address of the second computing device to the address resolution protocol table associated with the virtual network. ### Claim 13 (depends on 10) The server of claim 10, wherein the processor-executable instructions, when executed by the processor, further cause the processor to: determine that the first computing device has left the wireless network; and remove the first computing device from the virtual network by removing the address of the first computing device from the address resolution protocol table associated with the virtual network. ### Claim 14 (depends on 10) The server of claim 10, wherein the processor-executable instructions, when executed by the processor, further cause the processor to: determine that the first computing device is the last computing device of the virtual network to leave the wireless network; and delete the virtual network. ### Claim 15 (depends on 10) The server of claim 10, wherein computing devices within the virtual network have at least one of unrestricted communication with one another and unlimited access to one another. ### Claim 16 (depends on 10) The server of claim 10, wherein each virtual network within the wireless network comprises a broadcast domain enforcement layer such that a computing device assigned to the virtual network can access only other computing devices assigned to the same virtual network. ### Claim 17 (depends on 10) The server of claim 10, wherein each virtual network within the wireless network comprises an internet protocol broadcast domain enforcement layer such that when an internet protocol packet is received and includes an address outside the virtual network, the internet protocol packet is transmitted to the address outside the virtual network. ### Claim 18 A non-transitory computer readable medium having stored thereon processor-executable instructions that, when executed by the processor, cause the processor to: receive, from a first computing device, a request to join the wireless network, the request associated with an identifier; determine that the identifier is not associated with an existing virtual network within the wireless network; responsive to determining that the identifier is not associated with the existing virtual network within the wireless network, configure a virtual network within the wireless network and associate the identifier thereto; create an address resolution protocol table associated with the virtual network; and assign the first computing device to the virtual network by adding an address of the first computing device to the address resolution protocol table associated with the virtual network.