Method for establishing secure communication link between computers of virtual private network

• US 7,987,274 B2
• Filed: 08/16/2007
• Issued: 07/26/2011
• Est. Priority Date: 10/30/1998
• Status: Expired due to Fees

• Current Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Original Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Inventors: Larson, Victor, Short, III, Robert Dunham, Munger, Edmund Colby, Williamson, Michael
• Primary Examiner(s): Lim, Krisna
• Application Number:
  US11/839,987
• Publication Number:
  US 20080216168A1
• Time in Patent Office: 1,440 Days
• Field of Search: 709225-229, 709/245, 726/15
• US Class Current: 709/227
• CPC Class Codes: H04L 2101/604 Address structures or formats
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/24 Multipath
• CPC Class Codes: H04L 45/28 using route fault recovery
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 61/45 Network directories; Name-to-address mapping
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5076 Update or notification mechanisms, e.g. DynDNS
• CPC Class Codes: H04L 61/5092 by self-assignment, e.g. picking addresses at random and testing if they are already in use
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0414 during transmission, i.e. party's identity is protected against eavesdropping, e.g. by using temporary identifiers, but is known to the other party or parties involved in the communication
• CPC Class Codes: H04L 63/0421 Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1491 : using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 63/18 : using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215

Abstract

A technique is disclosed for establishing a secure communication link between a first computer and a second computer over a computer network. Initially, a secure communication mode of communication is enabled at a first computer without a user entering any cryptographic information for establishing the secure communication mode of communication. Then, a secure communication link is established between the first computer and a second computer over a computer network based on the enabled secure communication mode of communication. The secure communication link is a virtual private network communication link over the computer network in which one or more data values that vary according to a pseudo-random sequence are inserted into each data packet.

Claims

1. A method of accessing a secure network address, comprising:

sending a query message from a first network device to a secure domain service, the query message requesting from the secure domain service a secure network address for a second network device;

receiving at the first network device a response message from the secure domain name service containing the secure network address for the second network device; and

sending an access request message from the first network device to the secure network address using a virtual private network communication link.

2. The method according to claim 1, further including supporting a plurality of services over the virtual private network communication link.

3. The method according to claim 2, wherein the plurality of services comprises a plurality of communication protocols, a plurality of application programs, multiple sessions, or any combination thereof.

4. The method according to claim 3, wherein the plurality of application programs comprises video conferencing, e-mail, a word processing program, telephony or any combination thereof.

5. The method according to claim 2, wherein the plurality of services comprises audio, video, or any combination thereof.

6. The method according to claim 1, wherein the secure network address includes a security feature.

7. The method according to claim 1, wherein the secure network address is encrypted.

8. The method according to claim 7, further including decrypting the encrypted secure network address.

9. The method according to claim 1, further including supporting a unsecure communication link between the first and second network device.

10. The method according to claim 1, wherein the secure network address is an IP address belonging to the second network device.

11. The method according to claim 1, further including automatically initiating the virtual private network communication link after the access request message is received at the second network device.

12. The method according to claim 1, further including using tunneling over the virtual private network communication link.

13. The method according to claim 1, further including using tunnel packeting over the virtual private network communication link.

14. The method according to claim 1, wherein the secure communication link is an authenticated link.

15. The method according to claim 1, further including performing the method of claim 1 with a client computer connected to a communication network.

16. The method according to claim 1, wherein the second network device has an unsecure name.

17. The method according to claim 1, wherein the secure network address is registered with the secure domain service prior to the step of sending a query message to a secure domain service.

18. The method according to claim 1, further including performing the method of claim 1 with a mobile device connected to a communication network through a cellular network.