Agile network protocol for secure communications with assured system availability

• US 20060123134A1
• Filed: 12/13/2005
• Published: 06/08/2006
• Est. Priority Date: 10/30/1998
• Status: Active Grant

• Current Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Original Assignee: Science Applications International Corporation
• Inventors: Munger, Edmund Colby, Schmidt, Douglas Charles, Gligor, Virgil D., Short, Robert Dunham III, Sabio, Vincent J.
• Granted Patent: US 7,996,539 B2
• Time in Patent Office: Days
• US Class Current: 709/245
• CPC Class Codes: H04L 2101/604 Address structures or formats
• CPC Class Codes: H04L 45/20 Hop count for routing purposes, e.g. TTL
• CPC Class Codes: H04L 45/24 Multipath
• CPC Class Codes: H04L 61/2539 Hiding addresses; Keeping addresses anonymous
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5076 Update or notification mechanisms, e.g. DynDNS
• CPC Class Codes: H04L 61/5092 by self-assignment, e.g. picking addresses at random and testing if they are already in use
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0421 Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols
• CPC Class Codes: H04L 9/065 Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3
• CPC Class Codes: H04M 3/42008 Systems for anonymous communication between parties, e.g. by use of disposal contact identifiers

Abstract

A plurality of computer nodes communicates using seemingly random IP source and destination addresses and (optionally) a seemingly random discriminator field. Data packets matching criteria defined by a moving window of valid addresses are accepted for further processing, while those that do not meet the criteria are rejected. In addition to “hopping” of IP addresses and discriminator fields, hardware addresses such as Media Access Control addresses can be hopped. The hopped addresses are generated by random number generators having non-repeating sequence lengths that are easily determined a-priori, which can quickly jump ahead in sequence by an arbitrary number of random steps and which have the property that future random numbers are difficult to guess without knowing the random number generator'"'"'s parameters. Synchronization techniques can be used to re-establish synchronization between sending and receiving nodes.

Claims

1. A method of communicating between a first node and a second node coupled via a network, comprising the steps of:

(1) in the first node, using a first algorithm to select from among a first plurality of different network addresses each of which is mapped in the network to the first node, and using each selected network address in a header of a packet that is transmitted over the network to the second node; and

(2) in the second node, using a second algorithm to select from among a second plurality of network addresses each of which is mapped in the network to the second node, and using each selected network address in a header of a packet that is transmitted over the network to the first node.

2. The method of claim 1, wherein the network comprises an Internet Protocol (IP) network, and wherein each network address comprises an Internet Protocol (IP) source or destination address.

3. The method of claim 2, wherein:

step (1) comprises the step of using each selected IP address as the destination address of the second node; and

step (2) comprises the step of using each selected IP address as the destination address of the first node.

4. The method of claim 2, wherein:

step (1) comprises the step of using each selected IP address as the source address of the first node; and

step (2) comprises the step of using each selected IP address as the source address of the second node.

5. The method of claim 1, further comprising the steps of:

(3) in the first node, evaluating a header of received packets to determine whether it contains a network address that conforms to the second algorithm;

(4) in the first node, upon determining that the header contains a network address that conforms to the second algorithm, accepting the packet for processing; and

(5) in the first node, upon determining that the header does not contain a network address that conforms to the second algorithm, rejecting the packet for processing.

6. The method of claim 1, wherein the first and second algorithms select each network address on a quasi-random basis.

7. The method of claim 1, wherein the first and second algorithms select a different network address for each outgoing packet.

13. The method of claim 2, further comprising the step of discarding received IP packets containing an IP address that was previously received.

8. A method of communicating between first and second nodes in a network, comprising the steps of:

(1) in the first node, storing a transmit netblock comprising a plurality of pairs of source and destination IP addresses that will be used for communicating with the second node, and an algorithm for selecting pairs of source and destination IP addresses from among the plurality of pairs of source and destination IP addresses;

(2) in the first node, generating a plurality of IP packets each comprising one of the selected pairs or source and destination IP addresses; and

(3) in the first node, transmitting each IP packet generated in step (2) to the second node.

9. The method of claim 8, wherein the algorithm selects a different pair of source and destination addresses for each IP packet transmitting in step (3).

10. The method of claim 8, further comprising the step of receiving the transmit netblock and the algorithm from the second node.

11. The method of claim 8, further comprising the step of receiving a plurality of IP packets from the second node and, for each received IP packet:

determining whether the received IP packet contains a valid source and destination IP address, wherein the validity of each address is determined with reference to a second algorithm;

upon determining that the received IP packet contains a valid source and destination IP address, accepting the IP packet for further processing; and

upon determining that the received IP packet does not contain a valid source and destination IP address, rejecting the IP packet.

12. The method of claim 11, wherein the second algorithm determines whether each address is valid by generating a range of predictions encompassing a plurality of possible transmitted source and destination addresses, and comparing each address to the range of predictions.