Method for establishing connection between devices

• US 10,187,387 B2
• Filed: 08/06/2016
• Issued: 01/22/2019
• Est. Priority Date: 10/30/1998
• Status: Expired due to Fees

• Current Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Original Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Inventors: Larson, Victor, Short, III, Robert Dunham, Munger, Edmund Colby, Williamson, Michael
• Primary Examiner(s): Lim, Krisna
• Application Number:
  US15/230,396
• Publication Number:
  US 20160344733A1
• Time in Patent Office: 899 Days
• CPC Class Codes: H04L 2101/604 Address structures or formats
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/24 Multipath
• CPC Class Codes: H04L 45/28 using route fault recovery
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 61/45 Network directories; Name-to-address mapping
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5076 Update or notification mechanisms, e.g. DynDNS
• CPC Class Codes: H04L 61/5092 by self-assignment, e.g. picking addresses at random and testing if they are already in use
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0414 during transmission, i.e. party's identity is protected against eavesdropping, e.g. by using temporary identifiers, but is known to the other party or parties involved in the communication
• CPC Class Codes: H04L 63/0421 Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1491 : using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 63/18 : using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215

Abstract

A method performed by a first network device for communicating over a network, the method includes receiving, at the first network device, a request to connect to a second network device. The method includes, based on the request to connect, determining whether the first network device is set to an encrypted communication mode. The method further includes, based on a determination that the first network device is set to the encrypted communication mode, sending, to a first name service, a first name associated with the second network device and for which the first name service supports establishing an encrypted connection to the second network device. The method further includes receiving, at the first network device, a resource for the encrypted connection to the second network device, wherein the resource indicates a quality of service level for the encrypted connection determined by the first name service, and communicating with the second network device over the network via the encrypted connection using the received resource indicating the determined service level for the encrypted connection.

Claims

1. A method performed by a first network device for communicating over a network, the method comprising:

receiving, at the first network device, a request to connect to a second network device;

based on the request to connect, determining whether the first network device is set to an encrypted communication mode;

based on a determination that the first network device is set to the encrypted communication mode;

sending, to a first name service, a first name associated with the second network device and for which the first name service supports establishing an encrypted connection to the second network device;

receiving, at the first network device, a resource for the encrypted connection to the second network device, wherein;

the first name service determines a quality of service level for the encrypted communication link based on the first name and on a user associated with the first network device,

the first name service selects the resource based on the determined quality of service level for the encrypted connection, the resource including one or more network addresses for accessing the second network device, and

the quality of service level corresponds to a priority with which the first network device accesses the second network device; and

communicating with the second network device over the network via the encrypted connection using the received resource indicating the determined service level for the encrypted connection.

2. The method of claim 1, further comprising, in response to sending the first name to the first name service, receiving, at the first network device, a network address associated with the second network device.

3. The method of claim 1, wherein the first name service determines the quality of service level based on the first name.

4. The method of claim 1, wherein the first name service determines the quality of service level for the encrypted connection based on information associated with the first network device.

5. The method of claim 1, wherein the first name service determines the quality of service level based on a subscription.

6. The method of claim 5, wherein the subscription is associated with the first network device or the user of the first network device.

7. The method of claim 1, wherein the set of one or more network addresses includes pseudorandom network addresses.

8. The method of claim 1, wherein the resource is used for authenticating communications between the first network device and the second network device to the determined quality of service level.

9. The method of claim 1, wherein the encrypted connection is a secure communication link.

10. The method of claim 1, wherein the encrypted connection is a communication link between the first and second network devices in a virtual private network.

11. The method of claim 1, wherein the encrypted connection passes through one or more intermediate devices on the network, the intermediate devices providing anonymity of at least one of the first network device and the second network device by translating one or more addresses in packets transmitted over the encrypted connection.

12. The method of claim 1, further comprising executing an application program on the first network device, wherein the encrypted communication mode is provided by the application program.

13. The method of claim 12, wherein the application program comprises at least one of a video, audio, messaging, chat, telephony, or web browser application.

14. The method of claim 13, wherein the application program comprises a user interface allowing the user to set the first network device to the encrypted communication mode, and the method further comprises receiving, via the user interface, a selection of the encrypted communication mode.

15. The method of claim 1, further comprising:

based on a determination that the first network device is set to the encrypted communication mode, determining whether an encrypted communication software module is installed on the first network device; and

if the module is not installed;

accessing a network address for downloading the module;

downloading the module; and

installing the module on the first network device.

16. The method of claim 1, wherein the second connection is not encrypted.

17. The method of claim 1, further comprising, based on a determination that the first network device is set to a second communication mode, sending, to a second name service, a second name associated with the second network device.

18. The method of claim 1, wherein the first and second network devices are mobile devices.

19. A first network device configured to communicate over a network, the first network device comprising:

a memory storing instructions; and

one or more processors configured to execute the instructions to;

allow the first network device to be set to an encrypted communication mode;

receive a request to connect to a second network device;

based on the request to connect, determine whether the first network device is set to the encrypted communication mode;

based on a determination that first network device is set to the encrypted communication mode;

send, to a first name service, a first name associated with the second network device and for which the first name service supports establishing an encrypted connection to the second network device;

receive, at the first network device, a resource for the encrypted connection to the second network device, wherein;

the first name service determines a quality of service level for the encrypted communication link based on the first name and on a user associated with the first network device,

the first name service selects the resource based on the determined quality of service level for the encrypted connection, the resource including one or more network addresses for accessing the second network device, and

the quality of service level corresponds to a priority with which the first network device accesses the second network device; and

communicate with the second network device over the network via the encrypted connection using the received resource indicating the determined quality of service level for the encrypted connection.

20. The first network device of claim 19, wherein the one or more processors are further configured to execute the instructions to, in response to sending the first name to the first name service, receive a network address associated with the second network device.

21. The first network device of claim 19, wherein the first name service determines the quality of service level based on the first name.

22. The first network device of claim 19, wherein the first name service determines the quality of service level for the encrypted connection based on information associated with the first network device.

23. The first network device of claim 19, wherein the first name service determines the quality of service level based on a subscription.

24. The first network device of claim 23, wherein the subscription is associated with the first network device or the user of the first network device.

25. The first network device of claim 19, wherein the set of one or more network addresses includes pseudorandom network addresses.

26. The first network device of claim 19, wherein the resource is used for authenticating communications between the first network device and the second network device to the determined quality of service level.

27. The first network device of claim 19, wherein the encrypted connection is a secure communication link.

28. The first network device of claim 19, wherein the encrypted connection is a communication link between the first and second network devices in a virtual private network.

29. The first network device of claim 19, wherein the encrypted connection passes through one or more intermediate devices on the network, the intermediate devices providing anonymity of at least one of the first network device and the second network device by translating one or more addresses in packets transmitted over the encrypted connection.

30. The first network device of claim 19, wherein the one or more processors are further configured to execute the instructions to, execute an application program on the first network device, wherein the encrypted communication mode is provided by the application program.

31. The first network device of claim 30, wherein the application program comprises at least one of a video, audio, messaging, chat, telephony, or web browser application.

32. The first network device of claim 30, wherein the application program comprises a user interface allowing the user to set the first network device to the encrypted communication mode, and the one or more processors are further configured to execute the instructions to receive, via the user interface, a selection of the encrypted communication mode.

33. The first network device of claim 19, wherein the one or more processors are further configured to execute the instructions to:

based on a determination that the first network device is set to the encrypted communication mode, determine whether an encrypted communication software module is installed on the first network device; and

if the module is not installed;

access a network address for downloading the module;

download the module; and

install the module on the first network device.

34. The first network device of claim 19, wherein the second connection is not encrypted.

35. The first network device of claim 19, wherein the one or more processors are further configured to execute the instructions to send, based on a determination that the first network device is set to a second communication mode, to a second name service, a second name associated with the second network device.

36. The first network device of claim 19, wherein the first and second network devices are mobile devices.