Granted Patent B2

US 12,470,521 · App. 17/075,394 · Granted Nov 11, 2025

Inventors: Ethan Wright (Denver, CO); Wystan Schmidt (Denver, CO); Micah Labbee (Aurora, CO)

Assignee: Charter Communications Operating, LLC

H04L63/0272H04L63/0263

Abstract

Claims (82)

1 . A method, comprising:

receiving, by a router computing device, an indication of an association between a client computing device and virtual private network (VPN) configuration data for a VPN, the indication comprising an identifier of the client computing device and the VPN configuration data;

binding, by the router computing device, a VPN client session instantiated by the router computing device to a network interface;

implementing, by the router computing device, a firewall rule to route network traffic to and from the client computing device via the network interface;

establishing, by the router computing device, a connection with the VPN using the VPN client session and the VPN configuration data;

receiving, by the router computing device, network traffic for the client computing device; and

routing, by the router computing device, the network traffic via the network interface.

2 . The method of claim 1 , further comprising:

obtaining, by a server computing device, the VPN configuration data;

associating, by the server computing device, the client computing device with the VPN configuration data; and

transmitting, by the server computing device, the indication of the association between the client computing device and the VPN configuration data to the router computing device.

3 . The method of claim 2 , wherein obtaining the VPN configuration data comprises retrieving, by the server computing device, the VPN configuration data from a VPN configuration database.

4 . The method of claim 2 , wherein obtaining the VPN configuration data comprises receiving, by the server computing device, a first user input from a user, the first user input comprising the VPN configuration data.

5 . The method of claim 2 , wherein associating the client computing device with the VPN configuration data comprises receiving, by the server computing device, a second user input from a user indicating the association of the client computing device with the VPN configuration data.

6 . The method of claim 2 , wherein:

associating the client computing device with the VPN configuration data comprises:

defining, by the server computing device, a client computing device group comprising a plurality of client computing devices including the client computing device; and

associating the client computing device group with the VPN configuration data;

the indication of the association between the client computing device and the VPN configuration data comprises an indication of an association between the client computing device group and the VPN configuration data;

binding the VPN client session for the client computing device to the network interface comprises binding a VPN client session for the client computing device group to the network interface; and

implementing the firewall rule comprises implementing a firewall rule to route network traffic to and from the plurality of client computing devices via the network interface.

7 . The method of claim 6 , wherein defining the client computing device group comprises automatically defining the client computing device group based on one or more common attributes of the plurality of client computing devices.

8 . The method of claim 6 , wherein defining the client computing device group comprises:

receiving, by the server computing device, a third user input identifying the plurality of client computing devices as members of the client computing device group; and

defining the client computing device group based on the third user input.

9 . The method of claim 1 , wherein implementing the firewall rule to route the network traffic to and from the client computing device via the network interface comprises defining a firewall rule specified using one of OpenFlow and iptables.

10 . The method of claim 1 , wherein:

the network traffic comprises outbound network traffic from the client computing device and inbound network traffic from the VPN directed to the client computing device; and

routing the network traffic via the network interface comprises:

routing the outbound network traffic to the VPN; and

routing the inbound network traffic to the client computing device.

11 . The method of claim 1 wherein the router computing device receives the indication from a server computing device.

12 . A router computing device, comprising:

a system memory; and

a processor device communicatively coupled to the system memory and configured to:

receive an indication of an association between a client computing device and virtual private network (VPN) configuration data for a VPN, the indication comprising an identifier of the client computing device and the VPN configuration data;

bind a VPN client session instantiated by the router computing device to a network interface;

implement a firewall rule to route network traffic to and from the client computing device via the network interface;

establish a connection with the VPN using the VPN client session and the VPN configuration data;

receive network traffic for the client computing device; and

route the network traffic via the network interface.

13 . The router computing device of claim 12 , wherein:

the indication of the association between the client computing device and the VPN configuration data comprises an indication of an association between a client computing device group, comprising a plurality of client computing devices including the client computing device, and the VPN configuration data;

the processor device is configured to bind the VPN client session for the client computing device to the network interface by being configured to bind a VPN client session for the client computing device group to the network interface; and

the processor device is configured to implement the firewall rule by being configured to implement a firewall rule to route network traffic to and from the plurality of client computing devices via the network interface.

14 . The router computing device of claim 12 , wherein:

the network traffic comprises outbound network traffic from the client computing device and inbound network traffic from the VPN directed to the client computing device; and

routing the network traffic via the network interface comprises:

routing the outbound network traffic to the VPN; and

routing the inbound network traffic to the client computing device.

15 . A server computing device, comprising:

a system memory; and

a processor device communicatively coupled to the system memory and configured to:

obtain virtual private network (VPN) configuration data for a VPN;

associate a client computing device with the VPN configuration data; and

transmit an indication of an association between the client computing device and the VPN configuration data to a router computing device, the indication comprising an identifier of the client computing device and the VPN configuration data.

16 . The server computing device of claim 15 , wherein the processor device is configured to obtain the VPN configuration data by being configured to retrieve the VPN configuration data from a VPN configuration database.

17 . The server computing device of claim 15 , wherein the processor device is configured to obtain the VPN configuration data by being configured to receive the VPN configuration data from a user.

18 . The server computing device of claim 15 , wherein the processor device is configured to associate the client computing device with the VPN configuration data by being configured to receive a second user input from a user indicating the association of the client computing device with the VPN configuration data.

19 . The server computing device of claim 15 , wherein:

the processor device is configured to associate the client computing device with the VPN configuration data by being configured to:

define a client computing device group comprising a plurality of client computing devices including the client computing device; and

associate the client computing device group with the VPN configuration data; and

the indication of the association between the client computing device and the VPN configuration data comprises an indication of an association between the client computing device group and the VPN configuration data.

20 . The server computing device of claim 19 , wherein the processor device is configured to define the client computing device group by being configured to:

receive a third user input identifying the plurality of client computing devices as members of the client computing device group; and

define the client computing device group based on the third user input.

21 . A non-transitory computer-readable storage medium that includes executable instructions configured to cause a router computing device to:

receive, by the router computing device, an indication of an association between a client computing device and virtual private network (VPN) configuration data for a VPN, the indication comprising an identifier of the client computing device and the VPN configuration data;

bind, by the router computing device, a VPN client session instantiated by the router computing device to a network interface;

implement, by the router computing device, a firewall rule to route network traffic to and from the client computing device via the network interface;

establish, by the router computing device, a connection with the VPN using the VPN client session and the VPN configuration data;

receive, by the router computing device, network traffic for the client computing device; and

route, by the router computing device, the network traffic via the network interface.

22 . A method, comprising:

obtaining, by a server computing device, virtual private network (VPN) configuration data for a VPN;

associating, by the server computing device, a client computing device with the VPN configuration data; and

transmitting, by the server computing device, an indication of an association between the client computing device and the VPN configuration data to a router computing device, the indication comprising an identifier of the client computing device and the VPN configuration data.

23 . A non-transitory computer-readable storage medium that includes executable instructions configured to cause a server computing device to:

obtain, by the server computing device, virtual private network (VPN) configuration data for a VPN;

associate, by the server computing device, a client computing device with the VPN configuration data; and

transmit, by the server computing device, an indication of an association between the client computing device and the VPN configuration data to a router computing device, the indication comprising an identifier of the client computing device and the VPN configuration data.

Assignments (4)

Continuity (1)

References Cited (17)