# US 2021/0243604 A1 · Methods and systems for segmenting computing devices in a network > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0243604 A1 - Document ID: US20210243604A1 - Status: Published application - Kind: A1 - Application number: 16/781,305 - Filed: 2020-02-04 - Published: 2021-08-05 - Earliest claimed: 2020-02-04 - Assignees: BlackBerry Limited - Applicants: BlackBerry Limited - Inventors: James Randolph Winter LEPP; Stephen McCANN; Michael Peter MONTEMURRO - Web page: https://patentgrep.com/patent/US20210243604A1 ## CPC - H04L 63/065: {for group communications (cryptographic mechanisms or cryptographic arrangements for key management involving conference or group key H04L9/0833)} - H04W 12/084: using delegated authorisation, e.g. open authorisation [OAuth] protocol - H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy - H04L 9/3226: {using a predetermined code, e.g. password, passphrase or PIN (network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083)} - H04L 9/3234: {involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token (network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853)} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04W 12/069: using certificates or pre-shared keys - H04W 12/55: involving three or more devices, e.g. group pairing - H04W 12/76: Group identity - H04W 76/11: Allocation or use of connection identifiers - H04L 2209/80: Wireless - H04L 2209/84: Vehicles - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract Methods and systems of segmenting computing devices in a wireless network having an access point broadcasting in a single domain are described. In an exemplary method, a request to join the wireless network is received from a computing device. The request is associated with an identifier. When the identifier is not associated with a virtual network within the wireless network, a virtual network is configured within the wireless network and the identifier is associated thereto and the computing device is assigned thereto. When the identifier is associated with an existing virtual network within the wireless network, the computing device is assigned to the existing virtual network. ## Claims ### Claim 1 A method of segmenting computing devices in a wireless network having an access point broadcasting in a single broadcast domain, the method comprising: receiving, from a computing device, a request to join the wireless network, the request associated with an identifier; when the identifier is not associated with a virtual network within the wireless network: configuring a virtual network within the wireless network and associating the identifier thereto; and assigning the computing device to the configured virtual network; and when the identifier is associated with an existing virtual network within the wireless network: assigning the computing device to the existing virtual network. ### Claim 2 (depends on 1) The method of claim 1, further comprising: when the assigned computing device leaves the wireless network, removing the assigned computing device from the virtual network. ### Claim 3 (depends on 2) The method of claim 2, further comprising: when the assigned computing device leaving the wireless network is the last computing device within the virtual network, deleting the virtual network. ### Claim 4 (depends on 1) The method of claim 1, wherein computing devices within the virtual network have at least one of unrestricted communication with one another and unlimited access to one another. ### Claim 5 (depends on 1) The method of claim 1, wherein the identifier is at least one of a username, a password, a group name, a group password, a digital certificate, a hardware token, a subscriber identification module, a public key and an attribute associated with a certificate. ### Claim 6 (depends on 1) The method of claim 1, comprising providing a network level service to the virtual network via at least one of an instance of the network level service configured within the virtual network and tunneled access to the network level service. ### Claim 7 (depends on 6) The method of claim 6, wherein the network level service is one of e-mail, instant messaging, media streaming, voice communication, application program data, vehicle-related data, traffic and road conditions, and emergency information. ### Claim 8 (depends on 1) The method of claim 1 wherein each virtual network within the wireless network comprises a broadcast domain enforcement layer such that a computing device assigned to the virtual network can access only other computing devices assigned to the same virtual network. ### Claim 9 (depends on 1) The method of claim 1, wherein each virtual network within the wireless network comprises an internet protocol broadcast domain enforcement layer such that when an internet protocol packet is received and includes an address outside the virtual network, the internet protocol packet is transmitted to the address outside the virtual network. ### Claim 10 (depends on 1) The method of claim 1, wherein each virtual network within the wireless network comprises at least one of a network level service and a firewall layer, wherein the at least one of the network level service and the firewall layer are configured to be recognized and accessed by the assigned computing device as another computing device assigned to the virtual network. ### Claim 11 A server associated with a wireless network having an access point broadcasting in a single broadcast domain, the server comprising: a processor; a memory; and processor-executable instructions that, when executed by the processor, cause the processor to: receive, from a computing device, a request to join the wireless network, the request associated with an identifier, when the identifier is not associated with a virtual network within the wireless network: configure a virtual network within the wireless network and associate the identifier thereto; and assign the computing device to the configured virtual network; and when the identifier is associated with an existing virtual network within the wireless network: assign the computing device to the existing virtual network. ### Claim 12 (depends on 11) The server of claim 11, wherein the processor-executable instructions, when executed by the processor, further cause the processor to: when the assigned computing device leaves the wireless network, remove the assigned computing device from the virtual network. ### Claim 13 (depends on 12) The server of claim 12, wherein the processor-executable instructions, when executed by the processor, further cause the processor to: when the assigned computing device leaving the wireless network is the last computing device within the virtual network, delete the virtual network. ### Claim 14 (depends on 11) The server of claim 11, wherein computing devices within the virtual network have at least one of unrestricted communication with one another and unlimited access to one another. ### Claim 15 (depends on 11) The server of claim 11, wherein the identifier is at least one of a username, a password, a group name, a group password, a digital certificate, a hardware token, a subscriber identification module, a public key and an attribute associated with a certificate. ### Claim 16 (depends on 11) The server of claim 11, wherein the processor-executable instructions, when executed by the processor, further cause the processor to: provide a network level service to the virtual network via at least one of an instance of the network level service configured within the virtual network and tunneled access to the network level service. ### Claim 17 (depends on 11) The server of claim 11, wherein each virtual network within the wireless network comprises a broadcast domain enforcement layer such that a computing device assigned to the virtual network can access only other computing devices assigned to the same virtual network. ### Claim 18 (depends on 11) The server of claim 11, wherein each virtual network within the wireless network comprises an internet protocol broadcast domain enforcement layer such that when an internet protocol packet is received and includes an address outside the virtual network, the internet protocol packet is transmitted to the address outside the virtual network. ### Claim 19 (depends on 11) The server of claim 11, wherein each virtual network within the wireless network comprises at least one of a network level service and a firewall layer, wherein the at least one of the network level service and the firewall layer are configured to be recognized and accessed by the assigned computing device as another computing device assigned to the virtual network. ### Claim 20 A non-transitory computer readable medium having stored thereon processor-executable instructions that, when executed by the processor, cause the processor to: receive, from a computing device, a request to join a wireless network having an access point broadcasting in a single broadcast domain, the request associated with an identifier, when the identifier is not associated with a virtual network within the wireless network: configure a virtual network within the wireless network and associate the identifier thereto; and assign the computing device to the configured virtual network; and when the identifier is associated with an existing virtual network within the wireless network: assign the computing device to the existing virtual network.