Patent Application
20220329569
The present invention relates generally to networking and more particularly to the use of private cloud networks.
In the Internet connected environment, the Smart Device Clients including smart phone, tablet, eBook reader, notebook, PC and various smart gadgets are ubiquitous and omnipresent. Other than connectivity, one of the values of the Smart Device Clients is to be able to connect at any time and any place to acquire services from one or many serving parties or servers. The services include audio, video contents, live or archived information, and execution of applications, social media, messaging, email, storage, backup, calendar, contact, synchronization, sharing, remote desktop, Internet of Things (IoT) and others. Other services include real-time private and secure video, audio, text and application communication between at least two Smart Device Clients. There are different types of servers that serve these various requests from the Smart Device Clients. In general, these types of servers can be categorized to fall into two groups: a public cloud and a private cloud. Servers in the public cloud, implied by the name “public”, provide services that tend to be free with limited functionality or fee-based with more sophisticated services and interact with the public. Examples of the public cloud server include data center, social media services and storage/content provider through the Internet. On the other hand, servers in the private cloud tend to address the private need. The services provided are more private and personal as opposed to those offered by the public cloud.
One example of the application of the private cloud server (PCS) is a private cloud storage server (PCSS). The PCSS sits within the local area network (LAN) managed by the user. It provides on-line and backup storage for the user either within the LAN or in the wide area network (WAN). The user is able to use a Smart Device Client to access information within the PCSS at anytime from anywhere. The PCSS and the associated Smart Device Client therefore form an example of the PCS and a Client architecture.
Conventionally, there are many storage server solutions, including network attached storage (NAS), Windows/Mac/Linux server, and direct attached storage (DAS) to fulfill the PCSS requirement. But the challenge for the Smart Device Clients in the field has been how to avoid the cumbersome setup to penetrate the firewall behind the router on the LAN to access the PCSS in a home or office environment. There are at least four kinds of solutions to this challenge.
One solution is to assign a fixed Internet Protocol (IP) address and open certain ports for the router in front of the PCSS, such that the Smart Device Client is able to locate the PCSS from outside the LAN and to authenticate itself, penetrate the firewall and establish a secure communication channel with the PCSS.
A second solution applies when a fixed IP address is not available. The user configures the LAN router of the PCSS and opens certain ports to map to the PCSS. The router is therefore able to be located by the intended Smart Device Client through a dynamic domain name service (DDNS) service on the WAN. The Smart Device Client can authenticate itself, penetrate the firewall and establish a secure communication channel with the PCSS.
A third solution is to rely on another routing server in the WAN to conduct the virtual private network (VPN) communication between the Smart Device Client and the PCSS. The VPN communication allows the Smart Device Client to locate the PCSS, authenticate itself, penetrate the firewall and establish a secure communication channel with the PCSS.
A fourth solution is to rely on another routing server in the WAN to conduct the remote desktop protocol (RDP) or virtual network computing (VNC) communication between the Smart Device Client and the PCSS. The RDP/VNC communication allows the Smart Device Client to locate the PCSS, authenticate itself, penetrate the firewall and establish a secure communication channel with the PCSS. Other solutions can be mix-and match of the above-mentioned solutions.
In a first scenario, a fixed IP address is required and the router needs to be set up and configured. The down side is that a fixed IP involves more cost and is usually not available in the home and small business environment. The router set up and configuration can be very complicated and are not user friendly with most consumers.
In a second scenario, a DDNS service is required and the router needs yet more complex set up. Again, the DDNS set up involves additional cost and complexity into the system. The router set up and configuration can be very complicated and is not user friendly with most consumers.
In a third and fourth scenarios, an outside routing server or service needs to be established, while a router set up is not necessary. The outside routing server or service controls and handles login/authentication between the Smart Device Client and the server. The private cloud becomes less private and less secure through the public cloud-based server or service. If for any reason the server or service is down, the communication and availability of the PCSS will be jeopardized.
All of these scenarios require technical expertise that may be suitable for conventional corporate environment, but these scenarios are not suitable for consumer oriented Smart Device Client centric deployment.
In most conventional systems, an outside or public cloud-based routing server is used by the Smart Device Client during access to a Private Cloud Service. Using an outside server creates a number of concerns to the Smart Device Client owner.
First, the sense of trust is always in question, because the outside or public cloud-based routing server is a middleman during all communication transactions between the Smart Device Client and the Private Cloud Service. It may hold all user account info, password and their corresponding IP addresses of the Smart Device Client and the Private Cloud Service. The routing server is able to sniff any communication in-between and render it insecure.
Second, being an outside and public cloud-based routing server, the business model of the owner of server may not always be in-line or in-sync with the Smart Device Client owner. If the routing server is out of service due to any business reason, there is no remedy or option of replacement to restore the service. The routing server potentially poses a tremendous business risk to the user as the vital link in the communication can be broken without recourse.
Conventionally, in the case of communication between two Smart Device Clients, both parties need to sign into a public cloud-based server in order to conduct real-time video, audio, text or application communication. The privacy and security are easily compromised due to the fact that the communication has to go through a public cloud-based server, as outlined above.
In addition, the IoT devices which are the building blocks of the smart appliances at home, have been plagued by the fragmentation of various standards from Matter, Apple HomeKit, Google Nest, Amazon Alexa, and many others. Due to the interoperability, compatibility, as well as the privacy and security issues of the IoT devices, the adoption rate of the smart appliances at home has been below expectation.
Accordingly, what is needed is a system and method that addresses the above identified issues. The previous invention, with a private cloud VPN server (PCVS) and a private matter gateway (PMG) in a private metaverse (PM) environment, addresses such a need.
Further, as Internet evolves into Web 3.0, Metaverse started to emerge in order to provide the use-case scenario for a specific group of users to access a set of specific contents in a private and secure manner. Such a use-case scenario in the public cloud Metaverse, mimics the previous invention of private metaverse in a broader scale. The similarities are that instead of a PCVS, it is replaced with a Metaverse VPN Server (MVVS), while a PMG is replaced with a Metaverse App Gateway (MVAG). The differences are that the MVAG is deployed by the metaverse provider in its own metaverse app environment, instead of in the case of the PMG, which is deployed by the user in the private LAN. Also, the MVAG contents, which are metaverse application specific, such as archived contents, live streaming events, and domain specific contents, differ from those of the PMG which are tune more towards IoT devices or network services on the user private LAN. The present invention intends to address such a need.
A method for use with a public cloud network is disclosed. The method includes setting up at least one public cloud portal (PCP), at least one virtual machine server (VMS), at least one PCP Admin Device, at least one metaverse virtual private network (VPN) server (MVVS), at least one VPN tunnel, and at least one MVVS smart device client on the side of the MVVS to provide cloud-based web services, and at least one metaverse application (MA) which includes at least one private router, at least one private local area network (LAN), at least one metaverse app gateway (MVAG), at least one MVAG Admin Device, at least one metaverse network service (MVNS), and at least one MVAG smart device client on the side of the MVAG private LAN in a client server relationship. The MVVS smart device client, such as a smart phone, tablet, notebook, or Tesla dashboard operates in the public cloud, while a MVAG smart device client, such as a notebook (NB), Internet of Things (IoT) device, network attached storage (NAS), set-top-box (STB), smart appliance, archived content server, live streaming event content, or media server, resides on the private and secure LAN. The present invention is based on a decentralized peer-to-peer (P2P) communication architecture to provide to the users with access convenience as well as privacy and security at the same time. The at least one PCP and the at least one VMS which includes MVVS, usually reside in a hyperscale data center located on a public cloud network, while the at least one MA along with MVAG and the at least one MVAG smart device client or network service reside in the metaverse provider's application environments. The metaverse VPN server relays communication between the MVVS smart device client on the side of the MVVS and the MVAG. The MVVS will call back the MVAG on demand based on the MVVS smart device client request. The at least one VPN tunnels are enabled and established between the MVVS and MVAG. The at least one VPN tunnels are enabled and established between the MVVS and MVVS smart device client. The two VPN tunnels are channeled into one single VPN tunnel between the MVVS smart device client and the MVAG through the MVVS. All communication from this point onwards between the MVVS smart device client and the MVAG through the MVVS is secure and private. All MVAG smart device clients along with the network services on the private LAN of the MA are available for access in the LAN mode for future VPN connection from the MVVS smart device clients. From this point on, the MVAG and the MVVS are in standby mode waiting for future access from the MVVS smart device clients in the public cloud from Internet.
The at least one PCP is initially accessed by the at least one MVVS client to log in and acquire the connection credentials including the MVVS server passcode, the VMS domain name, the MVVS VPN client profile file, and the MVVS VPN client passcode. The MVVS VPN client profile file and the MVVS VPN client passcode can then be sent to any authorized MVVS client for future access. With these two credentials, the authorized MVVS client can then connect through the PCP to the targeted VMS and in turn to the corresponding MVVS. Once connected, the first VPN tunnel between the MVVS client and the MVVS is enabled. The at least one MVAG in the private LAN of the MA, will enable a third VPN tunnel on demand with the at least one MVVS in the public cloud as soon as (or if) the proper credentials are established. The at least one MVVS in the public cloud will in turn call back the at least one MVAG in the private LAN to enable a first VPN tunnel. The at least one MVAG in the private LAN of the MA, will in turn establish a first VPN tunnel with the at least one MVVS in the public cloud as soon as (or if) the first VPN tunnel is enabled by MVVS. A second VPN channel is also enabled by the MVVS for the at least one MVVS smart device client. The at least one MVVS smart device client starts request for connection to the at least one MVVS through the MVVS VPN client profile to establish a third VPN tunnel on demand, in case that the at least one MVVS smart device client intends to access to any MVAG smart device client or a MVNS on the private LAN of the MA. The at least one MVVS in the public cloud will in turn call back the at least one MVAG in the private LAN of the MA, to establish a third VPN tunnel on demand, and relay communication between the MVVS smart device client from the Internet and the MVAG residing on the private LAN of the MA. The second VPN tunnel on demand and the third VPN tunnel on demand are channeled into one single VPN tunnel between the MVVS smart device client and the MVAG through the MVVS. From this point onwards, all communication between the MVVS smart device client and the MVAG through the MVVS is secure and private. All MVAG smart device clients along with the network services on the private LAN of the MA are available for access in the LAN mode for future VPN connection from the MVVS smart device clients. Both the MVAG and the MVVS are in standby mode waiting for future access from the MVVS smart device clients in the public cloud from Internet.
In summary, the present invention sets up at least one MVVS in a client server relationship with at least one MVAG. The at least one MVVS and the at least one MVAG privately and securely communicates with each other through the public cloud network. It sets up the at least one MVVS smart device client in a client server relationship with the at least one MVVS. It sets up at least one MVAG smart device client and at least one MVAG MVNS in a client server relationship with the at least one MVAG. It sets up at least one MVVS smart device client in a client server relationship with the at least one MVAG. The at least one MVVS smart device client and the at least one MVAG communicates with each other through the public cloud network. The at least one MVVS smart device client and the at least one MVAG smart device client privately and securely communicates with each other through the public cloud network. The at least one MVVS smart device client and the at least one MVAG MVNS privately and securely communicates with each other through the public cloud network.
The VPN tunnels are based on the industry standard that guarantee privacy and security, as well as future proof interoperability and compatibility in communication. All MVAG clients, including IoT devices, along with the network services on the private LAN are thus available for access in the LAN mode, from the MVVS client thought VPN connection in a private and secure manner. Unlike the prior art, which is dependent on the cloud mode access of the clients or the IoT devices on the private LAN through a cloud-based relay server, the present invention relies solely on the LAN mode access through the VPN channels. The access content itself is never and cannot be monitored or recorded due to the strength of the industry recognized VPN tunnel, The present invention is therefore much more private and secure in access communication compared with those of offered by most other prior art. The network connection is based on the Internet protocol. The solution is therefore platform agnostic and simultaneously compatible with all existing fragmented IoT device platforms, be it Matter, Apple HomeKit, Google Nest, or Amazon Alexa, as long as the IoT devices are LAN discoverable and networkable. For further consideration of security, the connection credentials including the MVVS server passcode, the VMS domain name, the MVVS VPN client profile file, and the MVVS VPN client passcode, can all be revoked and re-issued per the request of the admin account of the MVVS clients from the cloud through Internet.
The present invention requires the future MVAG clients, i.e., the IoT devices, to operate in LAN mode, instead of in cloud mode, in order to achieve absolute privacy and security for the users. By doing so, the IoT devices no longer need to provide their own cloud-based relay server. The consequential benefits to the users are:
a. Breaking up the monopoly in app and IoT device access from mobile operating system (OS) providers like Apple and Google;
b. Access convenience from anywhere in the world through Internet;
c. True access privacy and security;
d. Interoperability and compatibility with Matter, Apple HomeKit, Google Nest, and Amazon Alexa, at the same time;
e. Lowering the entry barrier in IoT device manufacturing, as no more cloud-based relay server is required from the IoT manufacturers;
f. Re-instilling confidence in consumers to spur future IoT device sales;
g. Opening up new vertical app for IoT markets in secure chat, audio, and video and others; and
h. Future proof implementation, based on the industry Internet protocol in network and communication access.
For the purpose of accessing one MVAG smart device client, or IoT device at home from another MVVS smart device client anywhere in the world, the present invention maintains the benefits of access convenience, ease of deployment, great privacy and security, full compatibility/interoperability, and high performance.
These and other objectives of the present invention will no doubt become obvious to those of ordinary skill in the art after reading the following detailed description of the preferred embodiment that is illustrated in the various figures and drawings.
The present invention relates generally to networking and more particularly to the use of private cloud networks. The following description is presented to enable one of ordinary skill in the art to make and use the invention and is provided in the context of a patent application and its requirements. Various modifications to the embodiments and the generic principles and features described herein will be readily apparent to those skilled in the art. Thus, the present invention is not intended to be limited to the embodiments shown, but is to be accorded the widest scope consistent with the principles and features described herein.
The term “Client” is interchangeable with “Smart Device Client” throughout discussion in the context. The term “router” is in general interchangeable with “gateway”, “access point” and/or “NAT” (network address translation) in the discussion.
A system and method in accordance with the present invention addresses the following challenges in a consumer-oriented environment for a Smart Device Client in a wide area network (WAN) to be able to obtain services from a Private Cloud Storage Server (PCSS) or any Private Cloud Server (PCS):
1. Access the PCS at anytime from anywhere.
2. Access the PCS behind the firewall with fixed or dynamic Internet Protocol (IP) address.
3. Require no public cloud-based routing server in the WAN.
4. Require no additional router setup in a local area network (LAN).
5. Authenticate with the PCS.
6. Establish a secure communication channel with the PCS.
If such challenges can be met and resolved, the deployment of the PCS or service will increase exponentially, due to plug and play simplicity and availability. The technical and business concern will also be removed by not utilizing a public cloud-based routing server. The PCS being utilized for storage, remote desktop service and Internet of Things (IoT) becomes very affordable and ubiquitous in the private cloud infrastructure.
In the private cloud environment, if there are more than one PCSs or services co-existing at the same time, it is advantageous to separate out the functions of PCS into two functional blocks including a Private Cloud Routing Service (PRS) and a Metaverse network service (MVNS). The MVNS is designed to be managed and accessed on the private network environment, be it wired or wireless, by the Smart Device Client. Examples of a MVNS include application program server to provide remote desktop protocol (RDP), VNC, office tools, media player, and other user specific applications. The MVNS may also function as a storage server that contains multiple terabytes of storage serving the private cloud. Functions of the PRS of the multiple Private Matter Gateways (MVAGs) can then be aggregated together into just one MVAG. The MVAG can generally be referred to as a Private Cloud Router.
A system and method in accordance with the present invention addresses the following challenges in the consumer-oriented environment for utilizing the Smart Device Client in the WAN to be able to manage and access the MVNS from a MVAG:
1. Access the MVAG at anytime from anywhere.
2. Access the MVAG behind the firewall with fixed or dynamic IP address.
3. Require no outside or public cloud-based routing server in the WAN.
4. Require no additional router setup in the LAN.
5. Authenticate with the MVAG.
6. Establish a secure communication channel with the MVNS to manage and access.
If the MVAG can fulfill the above-mentioned challenges, heterogeneous PCSs from different manufacturers and vendors can then be broken down into simpler MVNSs and remove the complexity of private cloud setup, configuration and access.
The purpose of a system and method in accordance with the invention is to provide a MVAG, the MVNS and Client architecture without utilizing a routing server. The system and method in accordance with the present invention addresses the above identified challenges that to allow a Client to be able to access the MVNS from anywhere at anytime. The system and method also access the MVNS behind a firewall with fixed or dynamic IP, requires no additional router setup and no public cloud-based routing server in the WAN, to authenticate with the MVAG, and to establish a secure communication channel directly with the MVNS.
As shown in
The Smart Device Clients are denoted in the Cloud Network Infrastructure as 101, 106, 107, 109, 110, and 111. Any one of the Smart Device Clients above is interchangeable in the context and discussion. The focus on this discussion is the Smart Device Client 109, as the representative in this context.
Physically, there are three scenarios that a Smart Device Client 101, 107 or 109 can connect to the PCS 108. First, a Smart Device Client 107 determines whether the target is in the locally accessible LAN 104 and decides to connect to the PCS 108 directly. Second, the Smart Device Client 101 determines the target is not in the locally accessible LAN 104 and decides to connect through the WAN to the public cloud 100. The WAN locates the Router_P 102 and the LAN 104, and then connects to the PCS 108. Third, the Smart Device Client 109 determines the target is not in the locally accessible LAN 105 and decides to passes through the LAN 105, the Router_S 103, and connects to the public cloud 100 in the WAN.
The Smart Device Client 109 then locates the Router_P 102, the LAN 104, and connects to the PCS 108. The first and the second scenario are two special cases and derivatives of the third scenario. Therefore, it is beneficial to focus on the third scenario that is broader in scope and complexity.
As shown in
In Phase one: acquiring the connection credentials from the PCP Admin Device: To start with, a PCP Admin Device 377, which is itself a MVVS device client 301, logins to a PCP Device Utility (not shown) of a PCP 330 to acquire MVVS Device Client Credentials 379 and MVVS server Credentials 380. The MVVS Device Client Credentials 379 include a MVVS client Profile 383 and a MVVS client Login 382. The MVVS server Credentials 380 include a Domain MVVS 375 and a Passcode_MVVS 376. Both of the MVVS Device Client Credentials 379 and the MVVS server Credentials 380 are stored in a PCP Device Client Utility 378. The MVVS server Credentials 380 are later sent through email to a MVAG Admin Device 373 for connection to a MVAG 308. The MVVS Device Client Credentials 379 are later sent through email to a MVVS Device Client 321 for connection to a MVVS 316.
In Phase two, pairing and registration with the MVVS from the MVAG: The MVAG Admin Device 373 uses the utility MVAG_Device Utility 374 to initialize and provision the MVAG 308 from MVAG Admin Device 373. As shown in
In Phase three, establishing the initial VPN tunnels between the MVVS and the MVAG: After the MVVS 316 pairing and registration with the MVVS 316 from the MVAG 308, the MVAG_VPN Utility 372 connects to a MVVS_VPN Utility 3720 and enables a third VPN channel between the MVAG_VPN Utility 372 and the MVVS_VPN Utility 3720. The MVVS_VPN Utility 3720 then calls back to a MA 370, which contains at least one MVAG (e.g., the MVAG 308), which in turn contains the MVAG_VPN Utility 372 to enable a first VPN channel between the MVVS_VPN Utility 3720 and the MVAG_VPN Utility 372. The MVVS_VPN Utility 3720 can establish a third VPN tunnel on demand between the MVVS_VPN Utility 3720 and the MVAG_VPN Utility 372. The MVVS_VPN Utility 3720 can also establish a third VPN tunnel on demand between the MVVS_VPN Utility 3720 and the MVAG_VPN Utility 372, pending the completion in establishing a second VPN tunnel on demand between the MVVS smart device client 309, 310, 311 or 321, and the MVVS 316. Afterwards, the MVAG_VPN Utility 372 can establish a first VPN tunnel between the MVAG_VPN Utility 372 and the MVVS_VPN Utility 3720. The MVVS_VPN Utility 3720 also enables a second VPN channel between the MVVS_VPN Utility 3720 and any MVVS Device Client 301, 309, 310, 311, or 321, from the cloud in the Internet. The MVVS 316 is then ready for further action on demand from any MVVS Device Client 301, 309, 310, 311, or 321. The MVVS_VPN Utility 3720 communicates with the MVVS Device Utility 3710, internally inside the MVVS 316. The MVVS Device Utility 3710 stays in a loop waiting on demand for the future MVVS smart device client request.
In Phase four, connecting to the MVAG on demand between the MVVS smart device client and the MVAG through the MVVS: The MVVS_VPN Utility 3720 communicates with the MVVS_Device Utility 3710, internally inside the MVVS 316. The MVVS_Device Utility 3720 stays in a loop waiting on demand for the MVVS smart device client request. The MVVS Device Client 321 first registers to the MVVS_Device Utility 3710, with the MVVS client credentials, including the MVVS client Profile and MVVS client Login. The MVVS Device Utility 3710 passes the MVVS client credentials and the connection request internally inside MVVS 316, to the MVVS_VPN Utility 3720. After registration, the MVVS Device Client 321 connects to the MVVS_VPN Utility 3720 and establishes a second VPN tunnel on demand between MVVS Device Client 321 and MVVS_VPN Utility 3720. The MVVS_VPN Utility 3720 then establishes a third VPN tunnel on demand between the MVVS_VPN Utility 3720 and the MA 370, which contains at least one MVAG (e.g., the MVAG 308), which in turn contains the MVAG_VPN Utility 372. The second VPN tunnel on demand and the third VPN tunnel on demand are channeled into a single VPN between MVVS_Device Client 321 and MVAG_VPN Utility 372, which resides in the MVAG 308.
In Phase five, running the vertical P2P private and secure MVVS smart device client applications between the at least one MVVS smart device client and the at least one MVAG smart device client, the at least one MVAG network service, or yet another MVVS smart device client: The MVVS smart device client 301, 311 and 321, through the communication path 322, 324 and 323 respectively are able to locate the MVAG 308 with the mechanism disclosed in
In Phase five, the at least one MVAG smart device client and a MVVS smart device client application form a client server relationship. The MVVS smart device client application includes an application Utility on a public cloud network. The functionality of the at least one MVAG smart device client is defined by a class code sent to a MVVS smart device client application. The vendor-specific software modules or applications are loaded by the MVVS smart device client application to support the corresponding MVAG smart device client from different manufacturers. The device classes include audio, video, human interface device, IP Camera, Smart Lock, Smart Lightbulb, remote control, thermostat, printer, mass storage, Bluetooth, application specific, vendor specific, and others.
As shown in
If the MVVS smart device client 311 or 321 wants to join a communication session as a guest, the program installed on the guest MVVS smart device client first locates and logs-in to the PCP 330 through the communication path 324 or 323 respectively. After the MVVS 316 locating the MVAG 308, it joins the VLAN 340 under the server. The MVVS smart device client 311 or 321 commits to join the communication as a client. The program waits for a communication invitation. Once it receives a communication invitation, the MVVS smart device client 311 or 321 may join a communication session as a guest. The program then starts scanning for recognizable host. Upon identifying the host, the program goes through the communication log-in authentication prompted by the host. Once authenticated, the MVVS smart device client 311 or 321 can join the communication session. The MVVS smart device client 311 or 321 starts private and secure communication as a guest with the host MVVS smart device client 301. The private and secure communication includes video, audio, text or application. The application can be a program, utility, operation or transaction that is recognizable by both host and guest.
In another embodiment of the present invention, the MVVS smart device client can establish a private and secure communication with any service that is reachable on the physical LAN LAN1350 or the VLAN 340 and the VLAN 3400, under the MVAG and the Metaverse VPN server. As shown in
A number of entities are introduced to allow for the secure communication path 325 including but not limited to: Administrator, Admin Device, MVAG Utility, MVVS Utility, MVAG smart device client, MVVS smart device client. These entities are defined herein below. Utility is a utility running in the MVAG. Admin Device is a device that administrator uses to configure the MVAG. MVAG smart device client is a device that an Invitee uses to communicate with the MVAG. Invitee is a physical party invited by the Admin to access the MVAG service and resources. Invitee Device is a MVAG smart device client that the Invitee uses to communicate with the MVAG.
A number of terms are introduced including Passcode_MVVS, Domain MVVS Client, MVVS Client Profile, and MVVS Client Login. These terms are defined hereinbelow. Passcode_MVVS is a passcode generated by the PCP for the corresponding MVVS 316. Domain MVVS is the domain address generated by the PCP Passcode_MVVS and Domain MVVS together form the MVVS server credentials. MVVS Client Profile is the VPN profile file for the MVVS smart device client to connect to the corresponding MVVS 316. MVVS Client_Login is the VPN login password for the MVVS smart device client to connect to the corresponding MVVS 316. MVVS Client Profile and MVVS Client Login together form the MVVS client credentials.
Other terms not associated with the MVAG are: MA and Virtual LAN subnet. They are defined herein below. The MA is a private network subsystem which includes a network router, a private LAN, a MVAG, at least one MVNS, and at least one MVAG smart device client. The virtual LAN subnet is the subnet setting of the MVAG VPN (virtual private network). It is configurable and changeable to specify the private subnet for security purpose.
The device client 301 is itself a MVVS smart device client. It contains an application utility, the PCP Device Client Utility 378, which in turn contains the MVVS Device Client Credentials 379 and the MVVS server Credentials 380. The MVVS Device Client Credentials 379 contains the MVVS client Profile and the MVVS client Login. The MVVS server Credentials 380 contains the Domain MVVS and the Passcode_MVVS.
The typical MVVS smart device client 321 contains a MVVS_Device_Client Utility 381 which in turn contains the MVVS client Profile 383 and the MVVS client Login 382. The MVVS client Profile 383 is used to connect to the corresponding MVVS 316. The MVVS client Login 382 is used to login to the corresponding MVVS 316. The MVVS 316 contains the MVVS_Device Utility 3710 and the MVVS_VPN Utility 3720. The MVVS_Device Utility 3710 is used to communicate with the MVAG Admin Device 373. The MVVS VPN Utility 3720 is able to communicate with the MVAG 308 through the at least one VPN tunnel. The MVVS 316 acts as a middleman to relay communication between the MVVS smart device clients 321, 301, 311 and the MVAG 308. It will call back the MVAG 308 on demand based on the MVVS smart device client request.
The MVAG Admin Device 820, after receiving the MVVS server Credentials, first initializes and provisions the MVAG 828 with the server credentials through the MVAG_Device Utility 821, as described in circle 2, 800. The MVAG_Device Utility 821 then passes the info internally inside the MVAG 828, to a MVAG_VPN Utility 822. It then registers to the MVVS_VPN Utility 823 with the MVVS server credentials info that includes the Domain MVVS and Passcode_MVVS through the TCP/UDP protocols, as in circle 4, 801. The MVVS_VPN Utility 823 then calls back to a MA 852, which contains at least one MVAG (e.g., the MVAG 828), which in turn contains the MVAG_VPN Utility 822 to enable a first VPN channel between the MVVS_VPN Utility 823 and the MVAG_VPN Utility 822, as in circle 3, 805. Afterwards, the MVAG_VPN Utility 822 establishes a first VPN tunnel between the MVAG_VPN Utility 822 and the MVVS_VPN Utility 823, as in circle 5, 813. After registration, the MVAG_VPN Utility 822 connects to the MVVS_VPN Utility 823 and enables a third VPN tunnel on demand between the MVAG_VPN Utility 822 and the MVVS_VPN Utility 823. The MVVS_VPN Utility 823 can establish a third VPN tunnel on demand between the MVVS_VPN Utility 823 and the MVAG_VPN Utility 822, as in circle 6, 807. The MVVS_VPN Utility 823 can also establish a third VPN tunnel on demand between the MVVS_VPN Utility 823 and the MVAG_VPN Utility 822, pending the completion in establishing a second VPN tunnel on demand, as in circle 10, 806. The MVVS_VPN Utility 823 also enables a second VPN channel between the MVVS_VPN Utility 823 and any MVVS Device Client (e.g., the MVVS Device Client1825 or a MVVS Device Client3853), as in circle 9, 845 or 846, from the cloud in the Internet. The MVVS 827 is then ready for further action on demand from any MVVS_Device Client (e.g., the MVVS Device Client1825) from the cloud in the Internet. The MVVS_VPN Utility 823 communicates with a MVVS_Device Utility 824, internally inside the MVVS 827. The MVVS_Device Utility 824 stays in a loop waiting on demand for the MVVS smart device client request, as circle 7, 802. The MVVS Device Client1825 first registers to the MVVS_Device Utility 824, with the MVVS client credentials, including the MVVS client Profile and the MVVS client Login, as in circle 8, 804 or 814. The MVVS_Device Utility 824 passes the MVVS client credentials and the connection request internally inside the MVVS 827, to the MVVS_VPN Utility 823. After registration, the MVVS Device Client1825 connects to the MVVS_VPN Utility 823 and establishes a second VPN tunnel on demand between the MVVS Device Client1825 and the MVVS_VPN Utility 823, as in circle 10, 806 or 816. The MVVS_VPN Utility 823 then establishes a third VPN tunnel on demand between the MVVS_VPN Utility 823 and the MA 852, which contains at least one MVAG (e.g., the MVAG 828), which in turn contains the MVAG_VPN Utility 822, as in circle 6, 807. The second VPN tunnel on demand as in circle 10, 806 and the third VPN tunnel on demand as in circle 6, 807 are channeled into a single VPN between the MVVS_Device Client1825 and the MVAG_VPN Utility 822 and in turn connecting to the MVAG Device Client2826, as in circle 11, 811, or a MVAG Network Service 836 as in circle 11, 831, or yet another MVVS Device Client (e.g., the MVVS Device Client3853) as in circle 10, 816, assuming another MVVS Device Client (e.g., the MVVS Device Client3853) has also successfully connected to the MVVS_VPN Utility 823. The MVVS Device Client1825 and the MVVS Device Client3853 therefore form a P2P private and secure communication channel between them, which is the foundation for further secure chat applications in text, audio, and video, including crypto currency transaction.
Compared with the prior art in
The MVAG Admin Device 920, after receiving the MVVS server Credentials, first initializes and provisions the MVAG 928 with the server credentials through a MVAG_Device Utility 921, as described in circle 2, 900. The MVAG_Device Utility 921 then passes the info internally inside the MVAG 928, to a MVAG_VPN Utility 922. It then registers to the MVVS_VPN Utility 923 with the MVVS server credentials info that includes the Domain MVVS and Passcode_MVVS through the TCP/UDP protocols, as in circle 4, 901. After registration, the MVAG_VPN Utility 922 connects to the MVVS_VPN Utility 923 and enables a third VPN channel between the MVAG_VPN Utility 922 and the MVVS_VPN Utility 923. The MVVS_VPN Utility 923 then calls back to a MA 952, which contains at least one MVAG (e.g., the MVAG 928), which in turn contains the MVAG_VPN Utility 922 to enable a first VPN channel between the MVVS_VPN Utility 923 and the MVAG_VPN Utility 922, as in circle 3, 905. The MVVS_VPN Utility 923 can establish a third VPN tunnel on demand between the MVVS_VPN Utility 923 and the MVAG_VPN Utility 922, as in circle 6, 907. The MVVS_VPN Utility 923 can also establish a third VPN tunnel on demand between the MVVS_VPN Utility 923 and the MVAG_VPN Utility 922, pending the completion in establishing a second VPN tunnel on demand, as in circle 10, 906. Afterwards, the MVAG_VPN Utility 922 establishes a first VPN tunnel between the MVAG_VPN Utility 922 and the MVVS_VPN Utility 923, as in circle 5, 913. The MVVS_VPN Utility 923 also enables a second VPN channel between the MVVS_VPN Utility 923 and any MVVS Device Client (e.g., the MVVS Device Client1925), as in circle 9, 945, from the cloud in the Internet. The MVVS 927 is then ready for further action on demand from any MVVS Device Client (e.g., the MVVS Device Client1925) from the cloud in the Internet. The MVVS_VPN Utility 923 communicates with the MVVS_Device Utility 924, internally inside the MVVS 927. The MVVS Device Utility 924 stays in a loop waiting on demand for the MVVS smart device client request, as circle 7, 902. The MVVS Device Client1925 first registers to the MVVS_Device Utility 924, with the MVVS client credentials, including the MVVS client Profile and MVVS client Login, as in circle 8, 904 or 914. The MVVS_Device Utility 924 passes the MVVS client credentials and the connection request internally inside the MVVS 927, to the MVVS_VPN Utility 923. After registration, the MVVS Device Client1925 connects to the MVVS_VPN Utility 923 and establishes a second VPN tunnel on demand between the MVVS Device Client1924 and the MVVS_VPN Utility 923, as in circle 10, 906 or 916. The MVVS_VPN Utility 923 then establishes a third VPN tunnel on demand between the MVVS_VPN Utility 923 and the MA 952, which contains at least one MVAG (e.g., the MVAG 928), which in turn contains the MVAG_VPN Utility 922, as in circle 6, 907. The second VPN tunnel on demand as in circle 10, 906 and the third VPN tunnel on demand as in circle 6, 907 are channeled into a single VPN between the MVVS_Device Client1925 and the MVAG_VPN Utility 922 and in turn connecting to the MVAG Device Client2926, as in circle 11, 911, or a MVAG Network Service (not shown) as in circle 11, 911.
In the meantime, the PCP_Device Utility starts accepting command from PCP Admin Device to register to the PCP, via step 1010. The MVVS server Credentials and the MVVS client credentials are either generated or retrieved by the PCP_Device Utility, via step 1011. Both credentials are then sent back to the PCP Admin Device, via step 1040.
The MVVS server Credentials (Domain_MVVS, Passcode_MVVS) are the accepted, via step 1110, and stored as the identity for MVAG, via step 1111. Then the MVAG is registered to a MVVS as a corresponding client, via step 1112.
Compared with the third embodiment, the first embodiment has the benefits of a true connection on demand mechanism between the MVVS Device Client and the MVVS VPN Utility via the second VPN tunnel on demand; and between the MVVS VPN Utility and the MVAG_VPN Utility, and ultimately to the MVAG device clients, via the third VPN tunnel on demand. On the surface, it appears to be more secure than the third embodiment. But due to the commonality of applying the second VPN tunnel on demand, both in the first embodiment and the third embodiment, the final single VPN channel in both embodiments are as secure from the nature of the VPN connection mechanism. The first embodiment can offer a true on demand VPN connection due to its complexity in applying a third VPN tunnel on demand, which is to combine with the second VPN tunnel on demand to channel into a single VPN channel between the MVVS Device Client and the MVAG_VPN Utility, and ultimately to the MVAG device clients. Its architecture is more complex by utilizing three VPN tunnels, instead of two VPN tunnels in the third embodiment. The first embodiment does not require the third VPN tunnel to be on all the time, or to have to keep it alive all the time. It is therefore consuming less energy in the nature of the on-demand connection mechanism. It may appear that by doing so, it is more secure from the on-demand nature of the third VPN tunnel. But the fact is that the connection mechanism from the second VPN tunnel on demand has more than addressed the security concern in the ultimate single VPN channel between the MVVS Device Client and the MVAG_VPN Utility. In terms of connection simplicity, efficiency, and security, the third embodiment is therefore a preferred embodiment.
The MVAG Admin Device 1420, after receiving the MVVS server Credentials, first initializes and provisions the MVAG 1428 with the server credentials through a MVAG_Device Utility 1421, as described in circle 2, 1400. The MVAG_Device Utility 1421 then passes the info internally inside the MVAG 1428, to a MVAG_VPN Utility 1422. It then registers to the MVVS_VPN Utility 1423 with the MVVS server credentials info that includes the Domain MVVS and Passcode_MVVS through the TCP/UDP protocols, as in circle 4, 1401. The MVVS_VPN Utility 1423 then calls back to a MA 1452, which contains at least one MVAG (e.g., the MVAG 1428), which in turn contains the MVAG_VPN Utility 1422 to enable a first VPN channel between the MVVS_VPN Utility 1423 and the MVAG_VPN Utility 1422, as in circle 3, 1405. Afterwards, the MVAG_VPN Utility 1422 establishes a first VPN tunnel between the MVAG_VPN Utility 1422 and the MVVS_VPN Utility 1423, as in circle 5, 1413. The MVVS_VPN Utility 1423 also enables a second VPN channel between the MVVS_VPN Utility 1423 and any MVVS Device Client (e.g., the MVVS Device Client11425 or a CVS Device Client31453), as in circle 9, 1445 or 1446, from the cloud in the Internet. The MVVS 1427 is then ready for further action on demand from any MVVS Device Client (e.g., the MVVS Device Client11425) from the cloud in the Internet. The MVVS_VPN Utility 1423 communicates with the MVVS_Device Utility 1424, internally inside the MVVS 1427. The MVVS_Device Utility 1424 stays in a loop waiting on demand for the MVVS smart device client request, as circle 7, 1402. The MVVS Device Client11425 first registers to the MVVS_Device Utility 1424, with the MVVS client credentials, including the MVVS client Profile and MVVS client Login, as in circle 8, 1404 or 1414. The MVVS_Device Utility 1424 passes the MVVS client credentials and the connection request internally inside the MVVS 1427, to the MVVS_VPN Utility 1423. After registration, the MVVS Device Client11425 connects to the MVVS_VPN Utility 1423 and establishes a second VPN tunnel on demand between the MVVS Device Client11425 and the MVVS_VPN Utility 1423, as in circle 10, 1406 or 1416. The second VPN tunnel on demand as in circle 10, 1406 and the first VPN tunnel as in circle 5, 1413 are channeled into a single VPN between the MVVS Device Client11425 and the MVAG_VPN Utility 1422 and in turn connecting to a MVAG Device Client21426, as in circle 11, 1411, or a MVAG Network Service 1436 as in circle 11, 1431, or yet another MVVS Device Client (e.g., the MVVS Device Client31453) as in circle 10, 1416, assuming another MVVS Device Client (e.g., the MVVS Device Client31453) has also successfully connected to the MVVS_VPN Utility 1423. The MVVS Device Client11425 and the MVVS Device Client31453 therefore form a P2P private and secure communication channel between them, which is the foundation for further secure chat applications in text, audio, and video, including crypto currency transaction.
Compared with the prior art in
The MVAG Admin Device 1520, after receiving the MVVS server Credentials, first initializes and provisions the MVAG 1528 with the server credentials through the MVAG_Device Utility 1521, as described in circle 2, 1500. The MVAG_Device Utility 1521 then passes the info internally inside the MVAG 1528, to a MVAG_VPN Utility 1522. It then registers to the MVVS_VPN Utility 1523 with the MVVS server credentials info that includes the Domain MVVS and Passcode_MVVS through the TCP/UDP protocols, as in circle 4, 1501. After registration, the MVVS_VPN Utility 1523 then calls back to a MA 1552, which contains at least one MVAG (e.g., the MVAG 1528), which in turn contains the MVAG_VPN Utility 1522 to enable a first VPN channel between the MVVS_VPN Utility 1523 and the MVAG_VPN Utility 1522, as in circle 3, 1505. The MVVS_VPN Utility 1523 can also establish a second VPN tunnel on demand between the MVVS_VPN Utility 1523 and the MVAG_VPN Utility 1522, pending the completion in establishing a second VPN tunnel on demand, as in circle 10, 1506. Afterwards, the MVAG_VPN Utility 1522 establishes a first VPN tunnel between the MVAG_VPN Utility 1522 and the MVVS_VPN Utility 1523, as in circle 5, 1513. The MVVS_VPN Utility 1523 also enables a second VPN channel between the MVVS_VPN Utility 1523 and any MVVS Device Client (e.g., the MVVS Device Client11525), as in circle 9, 1545, from the cloud in the Internet. The MVVS 1527 is then ready for further action on demand from any MVVS Device Client (e.g., the MVVS Device Client11525) from the cloud in the Internet. The MVVS_VPN Utility 1523 communicates with the MVVS_Device Utility 1524, internally inside the MVVS 1527. The MVVS_Device Utility stays in a loop waiting on demand for the MVVS smart device client request, as circle 7, 1502. The MVVS Device Client11525 first registers to the MVVS_Device Utility 1524, with the MVVS client credentials, including the MVVS client Profile and MVVS client Login, as in circle 8, 1504. The MVVS_Device Utility 1524 passes the MVVS client credentials and the connection request internally inside the MVVS 1527, to the MVVS_VPN Utility 1523. After registration, the MVVS Device Client11525 connects to the MVVS_VPN Utility 1523 and establishes a second VPN tunnel on demand between the MVVS Device Client11525 and the MVVS_VPN Utility 1523, as in circle 10, 1506. The second VPN tunnel on demand as in circle 10, 1506 and the first VPN tunnel as in circle 5, 1513 are channeled into a single VPN between the MVVS_Device Client11525 and the MVAG_VPN Utility 1522 and in turn connecting to the MVAG Device Client21526, as in circle 11, 1511, or a MVAG Network Service (not shown) as in circle 11, 1511.
Compared with the first embodiment, the third embodiment has the benefits of a simpler architecture by utilizing only two VPN tunnels, instead of three VPN tunnels from the first embodiment. But the third embodiment requires the first VPN tunnel to be on all the time, or at least to have to keep alive all the time. It may appear that by doing so, it is less secure from the always-on nature of the first VPN tunnel. But the fact is that the connection mechanism from the second VPN tunnel on demand has more than addressed the security concern in the ultimate single VPN channel between MVVS Device Client and MVAG_VPN Utility. In terms of connection simplicity, efficiency, and security, the third embodiment is therefore a preferred embodiment.
Most of the content providers, such as Netflix, HBO, Amazon, Pandora, and others, enforce a mechanism called geo-blocking to enforce their exclusive digital territorial rights. In contrast, geo-home is a mechanism for allowing access to the online content at home, while geo-portal is a mechanism for allowing access to the online content at the portal. Although the legality of the enforcement of geo-blocking is controversial and is interpreted differently from regions to regions, some of the international travelers employ VPN relay services to circumvent IP-based geo-blocks, in order to access home or foreign based online content that are not available from outside the country they are in. The downside of this practice, other than legality, is that it involves additional subscription to the VPN service and the limited selections by choosing either geo-home or geo-portal. The present invention provides a mechanism for the metaverse provider to dynamically configure MVVS on demand to flexibly offer to the users on the choices among geo-blocking, geo-portal, or geo-home in accessing the on-line content, in addition to the original features in allowing the private and secure access to the MVAG device clients and network services in the private LAN from anywhere in the cloud through Internet.
Although the present invention has been described in accordance with the embodiments shown, one of ordinary skill in the art will readily recognize that there could be variations to the embodiments and those variations would be within the spirit and scope of the present invention. Accordingly, many modifications may be made by one of ordinary skill in the art without departing from the spirit and scope of the appended claims.
Those skilled in the art will readily observe that numerous modifications and alterations of the device and method may be made while retaining the teachings of the invention. Accordingly, the above disclosure should be construed as limited only by the metes and bounds of the appended claims.
This application is a continuation-in-part of U.S. application Ser. No. 17/736,103, filed May 4, 2022; which is a continuation-in-part of U.S. patent application Ser. No. 17/229,156, filed Apr. 13, 2021; which is a continuation-in-part of U.S. application Ser. No. 17/174,841, filed Feb. 12, 2021; which is a continuation-in-part of U.S. application Ser. No. 16/807,481, filed Mar. 3, 2020; which is a continuation-in-part of U.S. application Ser. No. 14/741,145 filed Jun. 16, 2015, entitled “PRIVATE CLOUD ROUTING SERVER CONNECTION MECHANISM FOR USE IN A PRIVATE COMMUNICATION ARCHITECTURE”, which is a continuation-in-part of U.S. patent application Ser. No. 14/663,244, filed Mar. 19, 2015, entitled “PRIVATE AND SECURE COMMUNICATION ARCHITECTURE WITHOUT UTILIZING A PUBLIC CLOUD-BASED ROUTING SERVER”, which is a continuation-in-part of U.S. patent application Ser. No. 14/526,393, filed Oct. 28, 2014, entitled “PRIVATE AND SECURE COMMUNICATION ARCHITECTURE WITHOUT UTILIZING A PUBLIC CLOUD-BASED ROUTING SERVER”, which is a continuation-in-part of U.S. patent application Ser. No. 14/450,104, filed Aug. 1, 2014, entitled “PRIVATE CLOUD ROUTING SERVER, PRIVATE NETWORK SERVICE AND SMART DEVICE CLIENT ARCHITECTURE WITHOUT UTILIZING A PUBLIC CLOUD-BASED ROUTING SERVER,” which is a continuation-in-part of U.S. patent application Ser. No. 13/229,285, filed Sep. 9, 2011, entitled “PRIVATE CLOUD SERVER AND CLIENT ARCHITECTURE WITHOUT UTILIZING A ROUTING SERVER,” all of which are incorporated herein by reference in their entireties.
| Number | Date | Country | |
|---|---|---|---|
| Parent | 17736103 | May 2022 | US |
| Child | 17849741 | US | |
| Parent | 17229156 | Apr 2021 | US |
| Child | 17736103 | US | |
| Parent | 17174841 | Feb 2021 | US |
| Child | 17229156 | US | |
| Parent | 16807481 | Mar 2020 | US |
| Child | 17174841 | US | |
| Parent | 14741145 | Jun 2015 | US |
| Child | 16807481 | US | |
| Parent | 14663244 | Mar 2015 | US |
| Child | 14741145 | US | |
| Parent | 14526393 | Oct 2014 | US |
| Child | 14663244 | US | |
| Parent | 14450104 | Aug 2014 | US |
| Child | 14526393 | US | |
| Parent | 13229285 | Sep 2011 | US |
| Child | 14450104 | US |
