Back to results
US 12,712,860 B2Granted
Centralized management of private networks
AssigneeTailscale Inc.
InventorsDavid F. Carney, Avery Pennarun, David J. Crawshaw
Life of this patent
Estimating the term…
Abstract
Described herein are systems, methods, and software to manage private networks for computing elements. In one example, a computing element may obtain credential information associated with a user and generate a public-private key pair for the computing element. The computing element may further communicate the public key from the pair with metadata to a coordination service to register the computing element at the coordination service. Once registered, the computing element may receive communication information associated with one or more other computing elements that permit the computing element to communicate with the other computing elements.
Claims17
A method of operating a coordination service on one or more computing elements, the method comprising:
- for each computing element of a plurality of computing elements of a private network:
- receiving a public key from said computing element for encrypting private network traffic to said computing element;
- identifying a private internet protocol (IP) address for said computing element on the private network;
- and
- identifying a public IP address for said computing element;
- and
- in response to determining a first computing element of the plurality of computing elements is permitted to access the private network:
- distributing, to the first computing element, the public keys, the private IP addresses, and the public IP addresses associated with other computing elements comprising those of the plurality of computing elements other than the first computing element, wherein the first computing element creates an encapsulation of a packet directed to a destination private IP address, of the private IP addresses, assigned to a second computing element of the plurality of computing elements by encrypting the packet using a destination public key, of the public keys, associated with the second computing element, and transmit the encapsulation to a destination public IP address assigned to the second computing element;
- and
- distributing, to the other computing elements, the private IP address and the public IP address identified for the first computing element and the public key received from the first computing element.
7 more elements
A computing apparatus comprising:
- a storage system comprising computer readable storage media;
- a processing system operatively coupled to the storage system;
- and
- program instructions stored on the storage system to provide a coordination service for a private network that, when executed by the processing system, direct the computing apparatus to:
- for each computing element of a plurality of computing elements of the private network:
- receive a public key from said computing element for encrypting private network traffic to said computing element;
- identify a private internet protocol (IP) address for said computing element on the private network;
- and
- identify a public IP address for said computing element;
- and
- in response to determining a first computing element of the plurality of computing elements is permitted to access the private network:
- distribute, to the first computing element, the public keys, the private IP addresses, and the public IP addresses associated with other computing elements comprising those of the plurality of computing elements other than the first computing element, wherein the first computing element creates an encapsulation of a packet directed to a destination private IP address, of the private IP addresses, assigned to a second computing element of the plurality of computing elements by encrypting the packet using a destination public key, of the public keys, associated with the second computing element, and transmit the encapsulation to a destination public IP address assigned to the second computing element;
- and
- distribute, to the other computing elements, the private IP address and the public IP address identified for the first computing element and the public key received from the first computing element.
11 more elements
A system comprising:
- a plurality of computing devices;
- a coordination service executing across one or more computers and configured to:
- for each computing device of plurality of computing devices of a private network:
- receive a public key from said computing device for encrypting private network traffic to said computing device;
- identify a private internet protocol (IP) address for said computing device on the private network;
- and
- identify a public IP address for said computing device;
- and
- in response to determining a first computing device of the plurality of computing devices is permitted to access the private network:
- distribute, to the first computing device, the public keys, the private IP addresses, and the public IP addresses associated with other computing devices comprising those of the plurality of computing devices other than the first computing device;
- and
- distribute, to the other computing devices, the private IP address and the public IP address identified for the first computing device and the public key received from the first computing device;
- and
- the first computing device configured to:
- create an encapsulation of a packet directed to a destination private IP address, of the private IP addresses, assigned to a second computing device of the plurality of computing devices by encrypting the packet using a destination public key, of the public keys, associated with the second computing device;
- and
- transmit the encapsulation to a destination public IP address assigned to the second computing device.
14 more elements
Dependencies are inferred from the claim text.