# US 12,003,487 B2 · Authentication procedure in a virtual private network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,003,487 B2 - Document ID: US12003487B2 - Status: Granted - Kind: B2 - Application number: 17/536,089 - Filed: 2021-11-28 - Published: 2023-06-01 - Granted: 2024-06-04 - Earliest claimed: 2021-11-28 - Assignees: Uab 360 It - Applicants: Uab 360 It - Inventors: Karolis Pabijanskas; And{hacek over (z)}ej Val{hacek over (c)}ik; Ramūnas Keliuotis - Web page: https://patentgrep.com/patent/US12003487B2 ## CPC - H04L 63/0272: {Virtual private networks} - H04L 9/0869: {involving random numbers or seeds} - H04L 9/32: including means for verifying the identity or authority of a user of the system {or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials} - H04L 9/3242: {involving keyed hash functions, e.g. message authentication codes [MACs], CBC-MAC or HMAC} - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04L 63/0435: {wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06)} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/123: {received data contents, e.g. message integrity} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method including configuring a first server to determine an encrypted authentication packet, the configuring including, configuring the first server to determine a crypted code field to indicate a type associated with the encryption authentication packet and that at least a portion of the encryption authentication packet is encrypted, and configuring the first server to determine a crypted payload based at least in part on encrypting an initial authentication packet. The method may also include configuring the first server to transmit, to a second server, the encrypted authentication packet to enable the first server and the second server to conduct an authentication process. Various other aspects are contemplated. ## Claims ### Claim 1 A method, comprising: configuring a first server in a virtual private network (VPN) environment to provide VPN services to a user device and to determine an encrypted authentication packet based at least in part on utilizing an encryption key, a nonce, and an encryption algorithm, the configuring the first server to determine the encrypted authentication packet including, configuring the first server to determine a crypted code field to indicate a type, from among a plurality of types, associated with the encrypted authentication packet and that at least a portion of the encrypted authentication packet is encrypted, and configuring the first server to determine a crypted payload based at least in part on encrypting an entire initial authentication packet, which includes a payload field containing authentication information associated with the user device requesting the VPN services from the first server; configuring the first server to transmit, to a second server, the encrypted authentication packet to enable the first server and the second server to conduct an authentication process to authenticate the user device; and configuring the first server to receive, from the second server, a response indicating successful authentication of the user device, unsuccessful authentication of the user device, or a request for additional information from the first server. ### Claim 2 (depends on 1) The method of claim 1, wherein configuring the first server to determine the encrypted authentication packet includes configuring the first server to determine a data length field indicating a length associated with the encrypted authentication packet, the length to be utilized by the second server to determine the crypted payload. ### Claim 3 (depends on 1) The method of claim 1, wherein configuring the first server to determine the encrypted authentication packet includes configuring the first server to determine an authentication tag field including information to enable the second server to determine whether the encrypted authentication packet is tampered. ### Claim 4 (depends on 1) The method of claim 1, wherein configuring the first server to determine the encrypted authentication packet includes configuring the first server to determine a nonce field indicating the nonce utilized to encrypt the initial authentication packet. ### Claim 5 (depends on 1) The method of claim 1, wherein configuring the first server to determine the encrypted authentication packet includes configuring the first server to place a reserved field within the encrypted authentication packet to determine placement of a data length field within the encrypted authentication packet. ### Claim 6 (depends on 1) The method of claim 1, wherein configuring the first server to determine the crypted payload includes configuring the first server to encrypt the initial authentication packet based at least in part on utilizing a symmetric encryption key and the nonce. ### Claim 7 (depends on 1) The method of claim 1, wherein the initial authentication packet includes an authenticator field including information associated with validating a response to be received from the second server. ### Claim 8 A device, comprising: a memory; and a processor communicatively coupled to the memory, the memory and the processor being configured to: configure the first server in a virtual private network (VPN) environment to provide VPN services to a user device and to determine an encrypted authentication packet based at least in part on utilizing an encryption key, a nonce, and an encryption algorithm, wherein, to configure the first server to determine the encrypted authentication packet, the memory and the processor are configured to, configure the first server to determine a crypted code field to indicate a type, from among a plurality of types, associated with the encrypted authentication packet and that at least a portion of the encrypted authentication packet is encrypted, and configure the first server to determine a crypted payload based at least in part on encrypting an entire initial authentication packet, which includes a payload field containing authentication information associated with the user device requesting the VPN services from the first server; configure the first server to transmit, to a second server, the encrypted authentication packet to enable the first server and the second server to conduct an authentication process to authenticate the user device; and configure the first server to receive, from the second server, a response indicating successful authentication of the user device, unsuccessful authentication of the user device, or a request for additional information from the first server. ### Claim 9 (depends on 8) The device of claim 8, wherein, to configure the first server to determine the encrypted authentication packet, the memory and the processor are configured to configure the first server to determine a data length field indicating a length associated with the encrypted authentication packet, the length to be utilized by the second server to determine the crypted payload. ### Claim 10 (depends on 8) The device of claim 8, wherein, to configure the first server to determine the encrypted authentication packet, the memory and the processor are configured to configure the first server to determine an authentication tag field including information to enable the second server to determine whether the encrypted authentication packet is tampered. ### Claim 11 (depends on 8) The device of claim 8, wherein, to configure the first server to determine the encrypted authentication packet, the memory and the processor are configured to configure the first server to determine a nonce field indicating the nonce utilized to encrypt the initial authentication packet. ### Claim 12 (depends on 8) The device of claim 8, wherein, to configure the first server to determine the encrypted authentication packet, the memory and the processor are configured to configure the first server to place a reserved field within the encrypted authentication packet to determine placement of a data length field within the encrypted authentication packet. ### Claim 13 (depends on 8) The device of claim 8, wherein, to configure the first server to determine the crypted payload, the memory and the processor are configured to configure the first server to encrypt the initial authentication packet based at least in part on utilizing a symmetric encryption key and the nonce. ### Claim 14 (depends on 8) The device of claim 8, wherein the initial authentication packet includes an authenticator field including information associated with validating a response to be received from the second server. ### Claim 15 A non-transitory computer-readable medium configured to store instructions, which when executed by a processor associated with a device, configure the processor to: configure a first server in a virtual private network (VPN) environment to provide VPN services to a user device and to determine an encrypted authentication packet based at least in part on utilizing an encryption key, a nonce, and an encryption algorithm, wherein, to configure the first server to determine the encrypted authentication packet, the processor is configured to, configure the first server to determine a crypted code field to indicate a type, from among a plurality of types, associated with the encrypted authentication packet and that at least a portion of the encrypted authentication packet is encrypted, and configure the first server to determine a crypted payload based at least in part on encrypting an entire initial authentication packet, which includes a payload field containing authentication information associated with the user device requesting the VPN services from the first server; configure the first server to transmit, to a second server, the encrypted authentication packet to enable the first server and the second server to conduct an authentication process to authenticate the user device; and configure the first server to receive, from the second server, a response indicating successful authentication of the user device, unsuccessful authentication of the user device, or a request for additional information from the first server. ### Claim 16 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein, to configure the first server to determine the encrypted authentication packet, the processor is configured to configure the first server to determine a data length field indicating a length associated with the encrypted authentication packet, the length to be utilized by the second server to determine the crypted payload. ### Claim 17 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein, to configure the first server to determine the encrypted authentication packet, the processor is configured to configure the first server to determine an authentication tag field including information to enable the second server to determine whether the encrypted authentication packet is tampered. ### Claim 18 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein, to configure the first server to determine the encrypted authentication packet, the processor is configured to configure the first server to determine a nonce field indicating the nonce utilized to encrypt the initial authentication packet. ### Claim 19 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein, to configure the first server to determine the encrypted authentication packet, the processor is configured to configure the first server to place a reserved field within the encrypted authentication packet to determine placement of a data length field within the encrypted authentication packet. ### Claim 20 (depends on 15) The non-transitory computer-readable medium of claim 15, wherein, to configure the first server to determine the crypted payload, the processor is configured to configure the first server to encrypt the initial authentication packet based at least in part on utilizing a symmetric encryption key and the nonce.