US 12,348,490 B2
Systems and methods for virtual private network authentication
Arvind Sreekumar, Santa Clara, CA (US); Ramakrishnan Kunnath, Santa Clara, CA (US); and Xiaobo Sherry Wei, Santa Clara, CA (US)
Assigned to Aviatrix Systems, Inc., Santa Clara, CA (US)
Filed by Aviatrix Systems, Inc., Santa Clara, CA (US)
Filed on Dec. 29, 2023, as Appl. No. 18/399,698.
Application 18/399,698 is a continuation of application No. 17/307,885, filed on May 4, 2021, granted, now 11,863,530, issued on Jan. 2, 2024.
Claims priority of provisional application 63/022,222, filed on May 8, 2020.
Prior Publication US 2024/0179133 A1, May 30, 2024
This patent is subject to a terminal disclaimer.
Int. Cl. H04L 29/00 (2006.01); H04L 9/40 (2022.01)
CPC H04L 63/0272 (2013.01) [H04L 63/0236 (2013.01); H04L 63/0815 (2013.01); H04L 63/20 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A computerized method, by a controller deployed within a cloud computing network and maintained within a non-transitory storage medium, for establishing a secure channel between a virtual private network (VPN) client processing on a network device for a user and a network gateway, the computerized method comprising:
receiving, by the controller, a resource request from the VPN client;
determining, by the controller, if a valid logon session has been established for the VPN client;
responsive to a determination that a valid logon session has not been established for the VPN client, transmitting, by the controller, an authentication request to an identity provider;
responsive to the VPN client being validated via the identity provider, receiving, by the controller, an assertion from the identity provider that the VPN client has been validated, wherein the assertion comprises a status tag including an authentication result, a subject tag that identifies the user, and an attribute tag including at least one profile association of the user;
extracting, by the controller, from the assertion the at least one profile association of the user;
generating, by the controller, a one-time token that is stored by the controller in a database;
transmitting, by the controller, the one-time token and the at least one profile association to the VPN client; and
responsive to a validation of the one-time token, establishing the secure channel between the VPN client and the network device.