AGILE NETWORK PROTOCOL FOR SECURE COMMUNICATIONS WITH ASSURED SYSTEM AVAILABILITY

• US 20080034201A1
• Filed: 08/16/2007
• Published: 02/07/2008
• Est. Priority Date: 10/30/1998
• Status: Active Grant

• Current Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Original Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Inventors: Sabio, Vincent, Gligor, Virgil, Short, Robert, Munger, Edmund
• Granted Patent: US 8,874,771 B2
• Time in Patent Office: Days
• US Class Current: 713/153
• CPC Class Codes: H04L 2101/604 Address structures or formats
• CPC Class Codes: H04L 45/20 Hop count for routing purposes, e.g. TTL
• CPC Class Codes: H04L 45/24 Multipath
• CPC Class Codes: H04L 61/2539 Hiding addresses; Keeping addresses anonymous
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5076 Update or notification mechanisms, e.g. DynDNS
• CPC Class Codes: H04L 61/5092 by self-assignment, e.g. picking addresses at random and testing if they are already in use
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0421 Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols
• CPC Class Codes: H04L 9/065 Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3
• CPC Class Codes: H04M 3/42008 Systems for anonymous communication between parties, e.g. by use of disposal contact identifiers

Abstract

A plurality of computer nodes communicates using seemingly random IP source and destination addresses and (optionally) a seemingly random discriminator field. Data packets matching criteria defined by a moving window of valid addresses are accepted for further processing, while those that do not meet the criteria are rejected. In addition to “hopping” of IP addresses and discriminator fields, hardware addresses such as Media Access Control addresses can be hopped. The hopped addresses are generated by random number generators having non-repeating sequence lengths that are easily determined a-priori, which can quickly jump ahead in sequence by an arbitrary number of random steps and which have the property that future random numbers are difficult to guess without knowing the random number generator'"'"'s parameters. Synchronization techniques can be used to re-establish synchronization between sending and receiving nodes.

Claims

1. A method of transmitting data from a first computer to a second computer, the data comprising a plurality of data bytes arranged in a particular order, the method comprising the steps of:

(1) establishing in the first computer and second computer a common algorithm that determines how data will be randomly distributed across a plurality of data packets;

(2) in the first computer, randomly distributing the plurality of data bytes across the plurality of data packets according to the common algorithm;

(3) transmitting the plurality of data packets from the first computer to the second computer; and

(4) in the second computer, extracting the randomly distributed plurality of data bytes from the plurality of data packets and reassembling them into the particular order according to the common algorithm.

2. The method of claim 1, wherein step (3) comprises the step of transmitting each of the plurality of data packets across a different path in a computer network.

3. A system comprising:

a first computer including an algorithm that establishes a random distribution pattern for allocating data across a plurality of data packets, wherein the first computer randomly distributes data bytes from a data source across the plurality of data packets according to the random distribution pattern and transmits the plurality of data packets across a network; and

a second computer coupled to the first computer across the network, wherein the second computer receives the plurality of data packets from the first computer, extracts the randomly distributed data bytes, and reassembles them into their original order according to the algorithm.

4. The system of claim 3, wherein the first computer transmits each of the plurality of data packets across a different path in the network.

5. A method of securely transmitting a data packet between a sending computer and a receiving computer, comprising the steps of:

(1) encrypting the data packet using session key known to the sending computer and the receiving computer, but not known by intermediate computers between the sending computer and the receiving computer;

(2) adding a packet header that identifies the data packet to the data packet encrypted in step (1);

(3) encrypting the combined packet header and encrypted data packet created in step

(2) using a link key known to each of a plurality of intermediate computers arranged between the first computer and the second computer;

(4) adding a cleartext packet header to route the packet encrypted in step (3); and

(5) transmitting the packet created in step (4).

6. The method of claim 5, further comprising the steps of:

(1) at each intermediate computer, decrypting the packet received from a previous computer and decrypting it using the link key;

(2) re-encrypting the packet using a different link key known to a next intermediate computer in the network;

(3) adding a cleartext packet header to route the packet re-encrypted in step (6); and

(4) transmitting the packet created in step (7) to the next intermediate computer.

7. The method of claim 6, further comprising the step of, at the receiving computer, decrypting the packet using the session key.

8. A method of transmitting data over a computer network, comprising the steps of:

at an originating terminal connected to the computer network, receiving a stream of data. and forming first level data pack payloads therefrom;

identifying a network destination address for the stream of data and adding first level headers containing data representing the network destination address to each of the data packets to form a first level packet;

encrypting each of the first level packets to form second level packet payloads;

attaching to the second level packet, payloads headers containing as destination addresses, addresses of at least one intermediate router connecting the originating terminal to the destination to form second level packets;

sending the second level packets to the at least one intermediate router;

at the at least one intermediate router, decrypting at least one of the second level payloads and determining from the first level headers he destination address, forming new packets containing at least the first level packet payloads, and attaching headers thereto containing the destination address, whereby a true destination of the data stream is concealed behind a layer of encryption for at least a portion of its travel over the network.

9. The method of claim 8, wherein the step of attaching includes determining the at least one intermediate router by randomly selecting fro a group of intermediate routers.

10. The method of claim 8, wherein the step of determining from the first level headers the destination address includes converting the data representing the network destination address with the network destination address by means of correlation data stored on the intermediate router.

11. The method of claim 8, further comprising the step of including in one of the first and second layer headers, an indicator of a number of hops to be made by the first level packet before arriving at the network destination, the at least one intermediate router decrementing the indicator of a number of hops and sending the first level packet to another intermediate router responsively to a value of the indicator of a number of hops.

12. A method of routing packets on a packet network, comprising the steps of:

block-encrypting, with a session key, message data to form payloads;

dividing an encrypted block resulting from the block-encrypting into at least two data payloads such that interleaving portions of data resulting from the block-encrypting step are among the at least two data payloads;

encrypting, with a link key, each of the at least two data payloads, together with destination data identifying a final destination for the packets;

combining, with a first payload resulting from the last step of encrypting, a first hop address indicating a first intermediate destination address and transmitting a first packet resulting thereby to the first intermediate destination address;

combining, with a second payload resulting from the last step of encrypting, a second hop address indicating a second intermediate destination address and transmitting a second packet resulting thereby to the second intermediate destination address.

13. The method of claim 12, further comprising the steps of.

combining, in the first packet;

a first hop counter;

at a terminal coinciding with the first intermediate destination address, determining, responsively to the first hop counter, to send t first packet to the final destination address; and

at the terminal coinciding with the first intermediate destination address, decrypting with the link key the first payload to expose the final destination address and sending the first packet to the final destination address, responsively to the step of determining.

14. The method of claim 12, further comprising the steps of:

combining, in the second packet, a second hop counter;

at a terminal coinciding with the second intermediate destination address, determining, responsively to the second hop counter, to send the first packet to the final destination address;

at the terminal coinciding with the second intermediate destination address, decrypting with the link key the second payload to expose the final destination address and sending the second packet to the final destination address, responsively to the last step of determining.