Method for establishing encrypted channel

• US 8,943,201 B2
• Filed: 10/31/2011
• Issued: 01/27/2015
• Est. Priority Date: 10/30/1998
• Status: Expired due to Fees

• Current Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Original Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Inventors: Larson, Victor, Short, Robert Dunham, Munger, Edmund Colby, Williamson, Michael
• Primary Examiner(s): Lim, Krisna
• Application Number:
  US13/285,962
• Publication Number:
  US 20120042086A1
• Time in Patent Office: 1,184 Days
• Field of Search: 709225-229, 709/245
• US Class Current: 709/225
• CPC Class Codes: H04L 2101/604 Address structures or formats
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/24 Multipath
• CPC Class Codes: H04L 45/28 using route fault recovery
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 61/45 Network directories; Name-to-address mapping
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5076 Update or notification mechanisms, e.g. DynDNS
• CPC Class Codes: H04L 61/5092 by self-assignment, e.g. picking addresses at random and testing if they are already in use
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0414 during transmission, i.e. party's identity is protected against eavesdropping, e.g. by using temporary identifiers, but is known to the other party or parties involved in the communication
• CPC Class Codes: H04L 63/0421 Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1491 : using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 63/18 : using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215

Abstract

A technique is disclosed for establishing a secure communication link between a first computer and a second computer over a computer network. Initially, a secure communication mode of communication is enabled at a first computer without a user entering any cryptographic information for establishing the secure communication mode of communication. Then, a secure communication link is established between the first computer and a second computer over a computer network based on the enabled secure communication mode of communication. The secure communication link is a virtual private network communication link over the computer network in which one or more data values that vary according to a pseudo-random sequence are inserted into each data packet.

Claims

1. A method for accessing a secure computer network address, comprising:

receiving a secure domain name;

sending a query message to a secure domain name service, the query message requesting from the secure domain name service a secure computer network address corresponding to the secure domain name;

receiving, in response to the query message, the secure computer network address corresponding to the secure domain name and one or more resources provided by the secure domain name service for secure communication;

establishing an encrypted channel based on the one or more resources provided by the secure domain name service;

sending an access request message to the secure computer network address using the encrypted channel; and

communicating at least one of video data or audio data via the encrypted channel;

wherein the secure domain name service receives and evaluates the query message to determine whether the target computer is configured for communicating over the encrypted channel, and further resolves the query into the secure computer network address.

2. The method of claim 1, further including supporting at least one of a plurality of communication protocols, a plurality of application programs, multiple sessions, or any combination thereof over the encrypted channel.

3. The method of claim 2, wherein the plurality of application programs includes at least one of video conferencing, e-mail, word processing program, telephony, or any combination thereof.

4. The method of claim 1, wherein the secure computer network address includes a security feature.

5. The method of claim 1, wherein the secure computer network address is encrypted.

6. The method of claim 5, further including decrypting the encrypted secure computer network address.

7. The method of claim 1, wherein the secure computer network address is an Internet Protocol (IP) address belonging to a network device.

8. The method of claim 1, wherein the secure computer network address is a network address belonging to a network device.

9. The method of claim 1, further including receiving the secure computer network address is received in an encrypted response message.

10. The method of claim 9, further including decrypting the encrypted response message.

11. The method of claim 1, wherein the secure computer network address is an Internet Protocol (IP) address associated with the secure domain name.

12. The method of claim 1, further including automatically establishing the encrypted channel using the secure computer network address.

13. The method of claim 1, further including receiving the secure network address through tunneling within a secure communication link.

14. The method of claim 1, further including receiving the secure network address from at least one tunneled packet.

15. The method of claim 1, wherein the encrypted channel is an authenticated link.

16. The method of claim 1, wherein the encrypted channel is established between a user'"'"'s computer and a target computer associated with the secure computer network address.

17. A non-transitory machine-readable medium having software instructions for accessing a secure computer network address stored thereon that when executed cause a system to:

receive a secure domain name;

send a query message to a secure domain name service, the query message requesting from the secure domain name service a secure computer network address corresponding to the secure domain name;

receive, in response to the query message, the secure computer network address corresponding to the secure domain name and resources provided by the secure domain name service for secure communication;

establish an encrypted channel based on the resources provided by the secure domain name service;

send an access request message to the secure computer network address using the encrypted channel; and

communicate at least one of video data or audio data via the encrypted channel;

wherein the secure domain name service receives and evaluates the query to determine whether the target computer is configured for communicating over the encrypted channel, and further resolves the query into the secure computer network address.

18. The machine-readable medium of claim 17, wherein the encrypted channel is arranged to support at least one of a plurality of communication protocols, a plurality of application programs, multiple sessions, or any combination thereof over.

19. The machine-readable medium of claim 18, wherein the plurality of application programs includes at least one of video conferencing, e-mail, word processing program, telephony, or any combination thereof.

20. The machine-readable medium of claim 17, wherein the secure computer network address includes a security feature.

21. The machine-readable medium of claim 17, wherein the secure computer network address is encrypted.

22. The machine-readable medium of claim 21, wherein the encrypted secure computer network address is decrypted.

23. The machine-readable medium of claim 17, wherein the secure computer network address is an Internet Protocol (IP) address belonging to a network device.

24. The machine-readable medium of claim 17, wherein the secure computer network address is a network address belonging to a network device.

25. The machine-readable medium of claim 17, wherein the secure computer network address is received in an encrypted response message.

26. The machine-readable medium of claim 25, wherein the encrypted response message is decrypted.

27. The machine-readable medium of claim 17, wherein the secure computer network address is an Internet Protocol (IP) address associated with the secure domain name.

28. The machine-readable medium of claim 17, wherein the encrypted channel link is automatically established using the secure computer network address.

29. The machine-readable medium of claim 17, wherein the secure network address is received through a tunnel.

30. The machine-readable medium of claim 17, wherein the secure network address is received from at least one tunneled packet.

31. The machine-readable medium of claim 17, wherein the encrypted channel is an authenticated link.