# US 12,113,775 B2 · Pre-shared key based virtual private network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,113,775 B2 - Document ID: US12113775B2 - Status: Granted - Kind: B2 - Application number: 18/059,137 - Filed: 2022-11-28 - Published: 2024-05-30 - Granted: 2024-10-08 - Earliest claimed: 2022-11-28 - Assignees: Hewlett Packard Enterprise Development LP - Applicants: Hewlett Packard Enterprise Development LP - Inventors: Sreenatha Balaganoor; Raghunandan Prabhakar; Amit Agrawal - Web page: https://patentgrep.com/patent/US12113775B2 ## CPC - H04L 63/0272: {Virtual private networks} - H04L 9/0838: {Key agreement, i.e. key establishment technique in which a shared key is derived by parties as a function of information contributed by, or associated with, each of these (network architectures or network communication protocols for key exchange in a packet data network H04L63/061)} - H04L 9/3073: {involving pairings, e.g. identity based encryption [IBE], bilinear mappings or bilinear pairings, e.g. Weil or Tate pairing} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract Some examples relate to a pre-shared key based virtual private network. In an example, a VPN server generates a unique pre-shared key (PSK) corresponding to an identity of a VPN client. The VPN server creates a mapping between the identity and the unique PSK of the VPN client, and stores it in a database. The VPN server shares the unique PSK with the VPN client. In response to receiving an IKE packet comprising an encrypted identity of the VPN client, the VPN server decrypts the encrypted identity of the VPN client from the IKE packet to determine the identity of the VPN client associated with the IKE packet. The VPN server retrieves the unique PSK corresponding to the identity of the VPN client associated with the IKE packet from the mapping stored in the database. The VPN server establishes a VPN connection with the VPN client. ## Claims ### Claim 1 A method comprising: receiving, by a virtual private network (VPN) server, a login request from a VPN client; obtaining, by the VPN server, an identity of the VPN client from the login request; generating, by the VPN server, a unique pre-shared key (PSK) corresponding to the identity of the VPN client; creating, by the VPN server, a mapping between the identity and the unique PSK of the VPN client; storing, by the VPN server, the mapping in a database; sending, by the VPN server, the unique PSK to the VPN client; receiving, by the VPN server, an Internet Key Exchange (IKE) packet comprising an encrypted identity of the VPN client; decrypting, by the VPN server, the encrypted identity of the VPN client from the IKE packet to determine the identity of the VPN client associated with the IKE packet; retrieving, by the VPN server, the unique PSK corresponding to the identity of the VPN client associated with the IKE packet from the mapping in the database; and in response to retrieving the unique pre-shared key (PSK) corresponding to the identity of the VPN client, establishing, by the VPN server, a VPN connection with the VPN client. ### Claim 2 (depends on 1) The method of claim 1, further comprising: generating, by the VPN server, a public-private key pair; and sending, by the VPN server, a public key from the public-private key pair to the VPN client, wherein the encrypted identity of the VPN client is generated through the public key. ### Claim 3 (depends on 2) The method of claim 2, further comprising sending, by the VPN server, the public-private key pair to a new VPN client. ### Claim 4 (depends on 2) The method of claim 2, wherein sending the unique PSK to the VPN client comprises: generating, by the VPN server, a connection profile of the VPN client comprising the unique PSK of the VPN client, the identity of the VPN client and the public key; and sending, by the VPN server, the connection profile to the VPN client. ### Claim 5 (depends on 1) The method of claim 1, wherein establishing the VPN connection comprises creating an Internet Protocol Security (IPsec) tunnel between the VPN client and the VPN server. ### Claim 6 (depends on 1) The method of claim 1, further comprising: associating, by the VPN server, a timestamp with the mapping in the database, in response to retrieving the unique pre-shared key (PSK) corresponding to the identity of the VPN client. ### Claim 7 (depends on 6) The method of claim 6, further comprising: in response to determining, by the VPN server, that the timestamp in the mapping is past a pre-defined period, deleting the mapping from the database. ### Claim 8 (depends on 6) The method of claim 6, further comprising updating the timestamp in the mapping each time the unique PSK corresponding to the identity of the VPN client is retrieved from the database. ### Claim 9 (depends on 1) The method of claim 1, wherein a serial number of the VPN server is appended to the unique PSK. ### Claim 10 A VPN server comprising: a processor; and a non-transitory storage medium storing instructions that, when executed by the processor, cause the processor to: receive a login request from a VPN client; obtain an identity of the VPN client from the login request; generate a unique pre-shared key (PSK) corresponding to the identity of the VPN client; create a mapping between the identity and the unique PSK of the VPN client; store the mapping in a database; send the unique PSK to the VPN client; receive an Internet Key Exchange (IKE) packet comprising an encrypted identity of the VPN client along with a timestamp; decrypt the encrypted identity of the VPN client from the IKE packet to determine the identity of the VPN client associated with the IKE packet; retrieve the unique PSK corresponding to the identity of the VPN client associated with the IKE packet from the mapping in the database; and establish a VPN connection with the VPN client, in response to retrieving the unique pre-shared key (PSK) corresponding to the identity of the VPN client. ### Claim 11 (depends on 10) The VPN server of claim 10, wherein a MAC address of the VPN server is appended to the unique PSK. ### Claim 12 (depends on 10) The VPN server of claim 10, wherein a timestamp is associated with the mapping in the database. ### Claim 13 (depends on 10) The VPN server of claim 10, wherein the identity of the VPN client comprises a media access control (MAC) address of the VPN client. ### Claim 14 (depends on 10) The VPN server of claim 10, wherein the unique PSK is of 256 bytes. ### Claim 15 A non-transitory machine-readable storage medium comprising instructions that upon execution cause a VPN server to: receive a login request from a first VPN client; obtain an identity of the first VPN client from the login request; generate, based on jitter entropy, a first unique pre-shared key (PSK) corresponding to the identity of the first VPN client; create a mapping between the identity and the first unique PSK of the first VPN client; store the mapping between the identity and the first unique PSK of the first VPN client in a database; send the first unique PSK to the first VPN client; receive a first Internet Key Exchange (IKE) packet comprising an encrypted identity of the first VPN client; decrypt the encrypted identity of the first VPN client from the first IKE packet to determine the identity of the first VPN client associated with the first IKE packet; retrieve the first unique PSK corresponding to the identity of the first VPN client associated with the first IKE packet from the mapping in the database; and establish a VPN connection with the first VPN client, in response to retrieving the first unique PSK corresponding to the identity of the first VPN client. ### Claim 16 (depends on 15) The non-transitory machine-readable storage medium of claim 15, further comprising instructions that upon execution cause the VPN server to: receive a login request from a second VPN client; obtain an identity of the second VPN client from the login request of the second VPN client; generate, based on jitter entropy, a second unique PSK corresponding to the identity of the second VPN client; create a mapping between the identity of the second VPN client and the second unique PSK; store the mapping between the identity of the second VPN client and the second unique PSK in the database; send the second unique PSK to the second VPN client; receive a second IKE packet comprising an encrypted identity of the second VPN client, from the second VPN client; decrypt the encrypted identity of the second VPN client from the second IKE packet to determine the identity of the second VPN client associated with the second IKE packet; retrieve the second unique PSK corresponding to the identity of the second VPN client associated with the second IKE packet, from the mapping in the database; and establish a VPN connection with the second VPN client, in response to retrieving the second unique PSK corresponding to the identity of the second VPN client. ### Claim 17 (depends on 15) The non-transitory machine-readable storage medium of claim 15, wherein one of a serial number of the VPN server or a MAC address of the VPN server is appended to the first unique PSK. ### Claim 18 (depends on 15) The non-transitory machine-readable storage medium of claim 15, wherein the first unique PSK is sent to the first VPN client over a Transport Layer Security (TLS) connection. ### Claim 19 (depends on 15) The non-transitory machine-readable storage medium of claim 15, wherein the identity of the first VPN client comprises a user name provided through the first VPN client. ### Claim 20 (depends on 15) The non-transitory machine-readable storage medium of claim 15, wherein the identity of the first VPN client comprises a string of characters assigned to the first VPN client.