Anonymous communicating over interconnected networks

• US 7,590,245 B1
• Filed: 09/10/2008
• Issued: 09/15/2009
• Est. Priority Date: 09/10/2008
• Status: Active Grant

• Current Assignee: Gutman Levitan
• Original Assignee: Gutman Levitan
• Inventors: Levitan, Gutman
• Primary Examiner(s): Shiferaw, Eleni A
• Application Number:
  US12/283,021
• Time in Patent Office: 370 Days
• Field of Search: 380/255, 380/239, 380/264, 380/267, 380/268, 380/269, 380/33, 380/282, 726/2, 726/12, 726/13, 726/14, 726/15, 726/26, 726/30, 713/153, 713/154, 713/160, 713/161, 713/162, 713/168, 709/239, 709/240, 709/241, 709/242, 709/243, 709/244, 725/31
• US Class Current: 380/255
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 63/0414 during transmission, i.e. party's identity is protected against eavesdropping, e.g. by using temporary identifiers, but is known to the other party or parties involved in the communication
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30

Abstract

A method and system for concealing from an outside observer the source and destination of information transmitted over computer network. Two types of data packets are defined: content packets that are carrying application data, i.e. real information, and announcement packets that are carrying data providing delivery of content packets. A flow number is assigned to a flow of packets carrying specific application data from a source host to a destination host and the number is included in the content packet header instead of the source and destination addresses. Applying public/private key encryption to announcement packets, which are delivered according to the standard IP protocol, a network server provides the flow number to the source and destination hosts and each router along the path between them, thereby building an anonymous virtual circuit for delivery of application data.

Claims

1. A system for concealing from an outside observer a source and destination of information transmitted over interconnected networks comprising:

a plurality of hosts connected to the interconnected networks and enabled to send and receive two types of data defined as application data and auxiliary data used for delivery of said application data, wherein said auxiliary data is encapsulated into announcement packets, which are conventional IP packets with source and destination addresses included in a packet header, and said application data is encapsulated into content packets;

wherein a content packet header contains a flow number assigned to a flow application data and does not contain a data source and destination address;

a plurality of conventional IP routers on the interconnected networks for forwarding the announcement packets;

a plurality of flow routers on the interconnected networks for forwarding the content packets; and

a trusted server operative for receiving a request from a source host or a destination host for delivery of specific application data from the source host to the destination host, choosing a path from the source host to the destination host over a sequence of said flow routers, assigning a flow number to a flow of said specific application data to be delivered and sending notifications specifying the flow number to the source host, the destination host and each said flow router along the chosen path;

wherein the request for said specific application data and all said notifications are encapsulated into said announcement packets and forwarded to their destinations by the conventional IP routers, while said specific application data is encapsulated into said content packets with the assigned flow number and forwarded to said destinations by the flow routers;

wherein said specific application data is delivered over a virtual circuit that is both anonymous and congestion-free, because it does not reveal the data source and destination addresses, and the trusted server, which is a potential bottleneck for network traffic, is not a part of the virtual circuit;

wherein the notifications sent by the trusted server to the source and destination hosts are encrypted with individual public keys of the hosts so to conceal association of a particular flow number with a flow source and destination; and

wherein a large flow of said content packets is divided into smaller parts and different flow numbers are assigned to the parts so that the parts would look like flows of different application data, thereby making it harder for an outside observer to trace the path of said application data.

2. The system of claim 1 wherein the notifications sent by the trusted server to the flow routers are encrypted with individual public keys of the flow routers so to make it harder for an outside observer to trace the path of said application data.

3. The system of claim 1 wherein said request for delivery of application data sent to the trusted server from said source host or said destination host is encrypted with an individual public key of the trusted server thereby making it harder for an outside observer to trace the path of said application data.

4. The system of claim 1 wherein the flow number in the packet header is changed by said flow routers, so that a content packet traveling along the chosen path would look as if it belongs to different flows of said application data, thereby making it harder for an outside observer to trace the path of said application data.

5. The system of claim 1 wherein the notifications sent by the trusted server to the source and destination hosts contain, along with a flow number, a single-transmission key for encrypting said application data at the source and decrypting the data at the destination, thereby improving network security.

6. The system of claim 1 wherein the trusted server stores authorization information for monitoring the requests for delivery of said specific application data, thereby improving network security.

7. The system of claim 1 wherein the notifications sent by the trusted server to the flow routers contain, along with a said flow number, a flow priority, thereby providing quality of service through traffic prioritization.