Method for establishing secure communication link between computers of virtual private network

• US 8,051,181 B2
• Filed: 02/27/2007
• Issued: 11/01/2011
• Est. Priority Date: 10/30/1998
• Status: Expired due to Fees

• Current Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Original Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Inventors: Larson, Victor, Munger, Edmund Colby, Short, Robert Dunham III, Williamson, Michael
• Primary Examiner(s): Lim; Krisna
• Application Number:
  US11/679,416
• Publication Number:
  US 20080005792A1
• Time in Patent Office: 1,708 Days
• Field of Search: 709225-229, 709/245
• US Class Current: 709/227
• CPC Class Codes: H04L 2101/604 Address structures or formats
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/24 Multipath
• CPC Class Codes: H04L 45/28 using route fault recovery
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 61/45 Network directories; Name-to-address mapping
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5076 Update or notification mechanisms, e.g. DynDNS
• CPC Class Codes: H04L 61/5092 by self-assignment, e.g. picking addresses at random and testing if they are already in use
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0414 during transmission, i.e. party's identity is protected against eavesdropping, e.g. by using temporary identifiers, but is known to the other party or parties involved in the communication
• CPC Class Codes: H04L 63/0421 Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1491 : using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 63/18 : using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215

Abstract

A technique is disclosed for establishing a secure communication link between a first computer and a second computer over a computer network. Initially, a secure communication mode of communication is enabled at a first computer without a user entering any cryptographic information for establishing the secure communication mode of communication. Then, a secure communication link is established between the first computer and a second computer over a computer network based on the enabled secure communication mode of communication. The secure communication link is a virtual private network communication link over the computer network in which one or more data values that vary according to a pseudo-random sequence are inserted into each data packet.

Claims

1. A non-transitory machine-readable medium comprising instructions for a method of communicating with a first device associated with a secure name and an unsecured name, the method comprising:

receiving, at a network address corresponding to the secure name associated with the first device, a message from a second device of the desired to securely communicate with the first device; and

sending a message over a secure communication link from the first device to the second device.

2. A method of using a first device to communicate with a second device having a secure name, the method comprising:

from the first device, sending a message to a secure name service, the message requesting a network address associated with the secure name of the second device;

at the first device, receiving a message containing the network address associated with the secure name of the second device; and

from the first device, sending a message to the network address associated with the secure name of the second device using a secure communication link.

3. The method according to claim 2, wherein the secure name of the second device is a secure domain name.

4. The method according to claim 2, wherein the secure name indicates security.

5. The method according to claim 2, wherein receiving the message containing the network address associated with the secure name of the second device includes receiving the message in encrypted form.

6. The method according to claim 5, further including decrypting the message.

7. The method according to claim 2, wherein the second device is capable of supporting a secure communication link as well as a non-secure communication link, the method further including establishing a non-secure communication link with the second device when needed.

8. The method according to claim 2, wherein receiving a message containing the network address associated with the secure name of the device includes receiving the network address as an IP address associated with the secure name of the device.

9. The method according to claim 2, further including automatically initiating the secure communication link after it is enabled.

10. The method according to claim 2, wherein receiving a message containing the network address associated with the secure name of the device includes receiving the message at the first device through tunneling within the secure communication link.

11. The method according to claim 2, wherein receiving a message containing the network address associated with the secure name of the device includes receiving the message in the form of at least one tunneled packet.

12. The method according to claim 2, wherein the receiving and sending of messages includes receiving and sending the messages in accordance with any one of a plurality of communication protocols.

13. The method according to claim 2, wherein the receiving and sending of messages through the secure communication link includes multiple sessions.

14. The method according to claim 2, further including supporting a plurality of services over the secure communication link.

15. The method according to claim 14, wherein the plurality of services comprises a plurality of communication protocols, a plurality of application programs, multiple sessions, or a combination thereof.

16. The method according to claim 15, wherein the plurality of application programs comprises video conferencing, e-mail, a word processing program, telephony or a combination thereof.

17. The method according to claim 15, wherein the plurality of services comprises audio, video or a combination thereof.

18. The method according to claim 2, wherein the secure communication link is an authenticated link.

19. The method according to claim 2, wherein the first device is a computer, and the steps are performed on the computer.

20. The method according to claim 2, wherein the first device is a client computer connected to a communication network, and the method is performed by the client computer on the communication network.

21. The method according to claim 2, further including providing an unsecured name associated with the device.

22. The method according to claim 2, wherein the secure name is registered prior to the step of sending a message to a secure name service.

23. The method according to claim 2, wherein the secure name of the second device is a secure, non-standard domain name.

24. A method of using a first device to securely communicate with a second device over a communication network, the method comprising:

at the first device requesting and obtaining registration of a secure name for the first device, the secure name being associated with a network address;

receiving at the network address associated with the secure name of the first device a message from a second device of the desire to securely communicate with the first device; and

sending a message securely from the first device to the second device.

25. The method according to claim 24, wherein requesting and obtaining registration of a secure name for the first device comprises using the first device to obtain a registration of the secure name for the first device, and wherein sending a message securely comprises sending the message from the first device to the second device using a secure communication link.

26. A method of using a first device to communicate with a second device over a communication network, the method comprising:

from the first device requesting and obtaining registration of an unsecured name associated with the first device;

from the first device requesting and obtaining registration of a secure name associated with the first device, wherein a unique network address corresponds to the secure name associated with the first device;

receiving at the unique network address associated with the secure name a message from a second device requesting the desire to securely communicate with the first device; and

from the first device sending a message securely from the first device to the second device.

27. The method according to claim 26,

wherein requesting and obtaining registration of an unsecured name associated with the first device comprises using the first device to obtain a registration of the unsecured name associated with the first device, and

wherein requesting and obtaining registration of a secure name associated with the first device comprises using the first device to obtain a registration of the secure name associated with the first device.

28. A non-transitory machine-readable medium comprising instructions for:

sending a message to a secure name service, the message requesting a network address associated with a secure name of a device;

receiving a message containing the network address associated with the secure name of the device; and

sending a message to the network address associated with the secure name of the device using a secure communication link.

29. A non-transitory machine-readable medium comprising instructions for a method of communicating with a device having a secure name, the method comprising:

receiving at a network address associated with a secure name of a first device a message from a second device requesting the desired to securely communicate with the first device, wherein the secure name of the first device is registered; and

sending a message securely from the first device to the second device.