# US 9,438,596 B2 · Systems and methods for secured global LAN > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 9,438,596 B2 - Document ID: US9438596B2 - Status: Granted - Kind: B2 - Application number: 13/938,145 - Filed: 2013-07-09 - Published: 2015-01-01 - Granted: 2016-09-06 - Earliest claimed: 2013-07-01 - Assignees: Holonet Security, Inc. - Applicants: StratuSee Technologies, Inc. - Inventors: Feng Zou - Web page: https://patentgrep.com/patent/US9438596B2 ## CPC - H04L 63/10: {for controlling access to devices or network resources} - H04L 61/4535: using an address exchange platform which sets up a session between two nodes, e.g. rendezvous servers, session initiation protocols [SIP] registrars or H.323 gatekeepers - H04L 63/0272: {Virtual private networks} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 61/2514: between local and global IP addresses - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract This invention relates to a method and a network device for establishing a Virtual Private Network (VPN) among Local Area Networks (LANs). The method uses a cloud controller that has a static IP address to control a plurality of network devices. The method comprises receiving, at the cloud controller, messages indicative of dynamic public network addresses associated with the first and second network devices; pre-assigning, at the cloud controller, the first and second network devices to an account maintained by the cloud controller; and sending an authorization message to the dynamic public network addresses associated with the first and second network devices to authorize the first and second network devices to establish a virtual network comprising two private networks to which the first and second network devices belong. ## Claims ### Claim 1 A method for a cloud controller to control a plurality of network devices, comprising: receiving, at the cloud controller from a first network device, a message indicative of a public network address associated with the first network device, wherein the cloud controller is associated with a public network address, and the public network address associated with the cloud controller was preloaded in the first network device when the first network device was manufactured; receiving, at the cloud controller from a second network device, a message indicative of a public network address associated with the second network device; pre-assigning, at the cloud controller, the first and second network devices to an account maintained by the cloud controller; receiving, at the cloud controller from the first network device, a request message to establish a virtual network between the first network device and the second network device, wherein the request message does not include any identification of the second network device, as the cloud controller identifies the first network device and the second network device as devices assigned to the common account; sending an authorization message to the public network addresses associated with the first and second network devices to authorize the first and second network devices to establish a virtual network comprising two private networks to which the first and second network devices belong, wherein the authorization message includes a pre-shared key generated by the cloud controller based on a series number of the first network device and a series number of the second network device; periodically synchronizing, between the cloud controller and the second network device, to update status of the public network address associated with the second network device; receiving a status change, from the second network device to the cloud controller, that the second network device obtains a private network address from a router's dynamic host configuration protocol (DHCP) service; and tracing back packets transmitted from the second network device to identify a mapping relationship between the public network address prior to the status change and the private network address after the status change for the second network device, and storing the mapping relationship in a database of the cloud controller. ### Claim 2 (depends on 1) The method of claim 1, wherein at least one of the public network addresses associated with the first and second network devices includes a dynamic IP address. ### Claim 3 (depends on 1) The method of claim 1, wherein the public network addresses associated with the first and second network devices include communication ports and dynamic public IP addresses that are assigned to the first and second network devices, or assigned to routers of the private networks to which the first and second network devices belong. ### Claim 4 (depends on 3) The method of claim 3, wherein the public network addresses associated with the first and second network devices include dynamic public IP addresses that are assigned to routers of the private networks to which the first and second network devices belong, and the first and second network devices are assigned with private IP addresses of the private networks. ### Claim 5 (depends on 1) The method of claim 1, further comprising: updating a database maintained by the cloud controller, wherein the database includes the public network addresses currently associated with the first and second network devices. ### Claim 6 (depends on 5) The method of claim 5, wherein the database further includes information of the first and second network devices being pre-assigned to the account. ### Claim 7 (depends on 1) The method of claim 1, further comprising: receiving, at the cloud controller, an instruction to pre-assign the first and second network devices to the account maintained by the cloud controller; wherein the instruction is from a computing device separated from the first and second network devices. ### Claim 8 (depends on 1) The method of claim 1, further comprising: providing a remote user interface for pre-assigning a network device identified by a serial number to an account; wherein all network devices pre-assigned to the account are configured to form a virtual network among the private networks to which these network devices belong when these network devices are operating online. ### Claim 9 (depends on 1) The method of claim 1, wherein the pre-shared key is unique for a pair of the first and second network devices. ### Claim 10 (depends on 1) The method of claim 1, wherein the virtual network is a Virtual Private Network (VPN) and the private networks are Local Area Networks (LANs). ### Claim 11 A network device comprising: a processor; a networking interface configured to communicate with a cloud controller and at least one peer device; and a storage component preloaded with a public network address associated with the cloud controller and an identifier of the network device, wherein the public address associated with the cloud controller was preloaded in the storage component of the network device when the network device was manufactured; the storage component further storing instructions which, when executed by the processor, cause the network device to perform a process including: identifying the network device to the cloud controller by sending a registration message including the identifier of the network device to the public network address associated with the cloud controller; requesting the private network connection with a peer device to the cloud controller, wherein the request message does not include any identification of the peer device, as the cloud controller identifies the network device and the peer device as devices assigned to a common client account; receiving, from the cloud controller, an authorization message including a public network address associated with the peer device, wherein the authorization message includes a pre-shared key generated by the cloud controller based on the identifier of the network device and an identifier of the peer device; directly connecting to the peer device based on the authorization message to establish a virtual network among a private network to which the network device belongs and a private network to which the peer device belongs; determining, based on assignment records of the cloud controller, that the peer device is originally assigned to a previous account and therefore the peer device is a second-hand device; and updating, at the cloud controller, the assignment records of the cloud controller so that the second network device is assigned to the account instead of the previous account periodically synchronizing, between the cloud controller and the peer device, to update status of the public network address associated with the peer device; receiving a status change, from the peer device to the cloud controller, that the peer device obtains a private network address from a router's dynamic host configuration protocol (DHCP) service; and tracing back packets transmitted from the peer device to identify a mapping relationship between the public network address prior to the status change and the private network address after the status change for the peer device, and storing the mapping relationship in a database of the cloud controller. ### Claim 12 (depends on 11) The network device of claim 11, wherein the public network addresses associated with the peer network device includes a dynamic IP address. ### Claim 13 (depends on 11) The network device of claim 11, wherein the registration message further includes a dynamic IP network address that are assigned to the network device, or assigned to a router of the private networks to which that the network device belongs. ### Claim 14 (depends on 11) The network device of claim 11, wherein the network device and the peer device are pre-assigned to an account maintained by the cloud controller and the peer device is identified by the cloud controller based on the account. ### Claim 15 (depends on 11) The network device of claim 11, wherein the directly connecting comprises: transmitting, from the network device to the public network address associated with the peer device, a request to establish the virtual network; wherein the pre-shared key authenticates the request and is provided by the cloud controller to the network device and the peer device before the request being transmitted. ### Claim 16 (depends on 11) The network device of claim 11, wherein the receiving comprises: receiving, from the cloud controller, an authorization message including public network addresses associated with multiple peer devices; and wherein the directly connecting comprises: directly connecting to the peer devices based on the authorization message to establish the virtual network among the private networks to which the network device and the peer devices belong. ### Claim 17 A method for establishing a virtual network among a plurality of private networks, comprising: transmitting a registration message from a network device to a cloud controller that is associated with a public network address, wherein the public network address associated with the cloud controller was preloaded in the network device when the network device was manufactured, the registration message including a dynamic public network address associated with the network device; sending, from the network device to the cloud controller, a request message to establish a virtual network between the network device and a peer device, wherein the request message does not include any identification of the peer device, as the cloud controller identifies the network device and the peer device as devices assigned to a common client account; receiving, at the network device from the cloud controller, an authorization message including a public network address associated with the peer device, wherein the authorization message includes a pre-shared key generated by the cloud controller based on a series number of the network device and a series number of the peer device; and directly connecting to the peer device based on the authorization message to establish the virtual network among a private network to which the network device belongs and a private network to which the peer device belongs; wherein the virtual network is a Virtual Private Network (VPN) and wherein the pre-shared key is unique for a pair of the network device and the peer device; periodically synchronizing, between the cloud controller and the peer device, to update status of the public network address associated with the peer device; receiving a status change, from the peer device to the cloud controller, that the peer device obtains a private network address from a router's dynamic host configuration protocol (DHCP) service; and tracing back packets transmitted from the peer device to identify a mapping relationship between the public network address prior to the status change and the private network address after the status change for the peer device, and storing the mapping relationship in a database of the cloud controller. ### Claim 18 (depends on 17) The method of claim 17, wherein the network device and the peer device are pre-assigned to an account maintained by the cloud controller. ### Claim 19 (depends on 17) The method of claim 17, wherein the peer device is identified by the cloud controller based on an account to which the network device is pre-assigned. ### Claim 20 (depends on 17) The method of claim 17, further comprising: periodically transmitting, from the network device to the cloud controller, a heartbeat message to update the public network address associated with the network device. ### Claim 21 (depends on 17) The method of claim 17, wherein the public network address associated with the network device is a dynamic public IP address currently assigned to the network device or a dynamic public IP address currently assigned to a router of the private network to which the network device belongs to. ### Claim 22 (depends on 1) The method of claim 1, wherein the virtual network is a Virtual Private Network (VPN) and wherein the pre-shared key is unique for a pair of the first network device and the second network device. ### Claim 23 (depends on 17) The method of claim 17, wherein the cloud controller is Software-Defined Networking (SDN) service running on a cloud computing platform. ### Claim 24 (depends on 1) The method of claim 1, further comprising: determining, by the cloud controller, that the second network device is originally assigned to a previous account and therefore the second network device is a second-hand device; and updating, at the cloud controller, assignment records to assign the second network device to the account instead of the previous account.