Agile network protocol for secure communications using secure domain names

• US 9,037,713 B2
• Filed: 04/06/2011
• Issued: 05/19/2015
• Est. Priority Date: 10/30/1998
• Status: Expired due to Fees

• Current Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Original Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Inventors: Larson, Victor, Short, Robert Dunham III, Munger, Edmund Colby, Williamson, Michael
• Primary Examiner(s): Lim, Krisna
• Application Number:
  US13/080,680
• Publication Number:
  US 20110185053A1
• Time in Patent Office: 1,504 Days
• Field of Search: 709223-227, 709/229, 709/245
• US Class Current: 709/225
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 2101/30 Types of network names
• CPC Class Codes: H04L 2101/604 Address structures or formats
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/24 Multipath
• CPC Class Codes: H04L 45/28 using route fault recovery
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 61/3015 Name registration, generation or assignment
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5076 Update or notification mechanisms, e.g. DynDNS
• CPC Class Codes: H04L 61/5092 by self-assignment, e.g. picking addresses at random and testing if they are already in use
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0421 : Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
• CPC Class Codes: H04L 63/0428 : wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 : wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0478 : applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/0485 : Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 63/08 : for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 : based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/105 : Multiple levels of security
• CPC Class Codes: H04L 63/1408 : by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 : Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1458 : Denial of Service
• CPC Class Codes: H04L 63/1466 : Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/164 : at the network layer
• CPC Class Codes: H04L 63/168 : above the transport layer
• CPC Class Codes: H04L 67/14 : Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/141 : Setup of application sessions admission control or resource allocation in data switching networks H04L47/70

Abstract

A secure domain name service for a computer network is disclosed that includes a portal connected to a computer network, such as the Internet, and a domain name database connected to the computer network through the portal. The portal authenticates a query for a secure computer network address, and the domain name database stores secure computer network addresses for the computer network. Each secure computer network address is based on a non-standard top-level domain name, such as .scom, .sorg, .snet, .snet, .sedu, .smil and .sint.

Claims

1. A service system for accommodating audio video communications over an encrypted communication link between two registered devices, wherein at least one of the registered devices is provided with an application program for performing audio video communications with the other registered device following establishment of the encrypted communication link therebetween, the system comprising:

a memory storing instructions and a plurality of network addresses of devices of registered users; and

one or more hardware processors that are configured to execute the instructions to;

(a) connect to a communication network;

(b) receive a Domain Name Service (DNS) query, from a first device, to look up a network address associated with a second device;

(c) determine, in response to the DNS query, whether the second device accepts an encrypted communication link connection with the first device; and

(d) establish an encrypted communication link between the first device and the second device based on a determination that the second device accepts an encrypted communication link connection with the first device.

2. The system of claim 1, wherein the first device is a phone provided with the application program.

3. The system of claim 1, wherein the encrypted communication link is a broadband connection.

4. The system of claim 1, wherein the encrypted communication link is a modulated transmission link.

5. The system of claim 1, wherein the encrypted communication link supports at least one of the following:

FTM, TDM and CDMA.

6. The system of claim 1, wherein the encrypted communication link supports TCP/IP protocols.

7. The system of claim 1, wherein the memory further stores a plurality of domain names corresponding to the network addresses of the devices of the registered users.

8. The system of claim 7, wherein the plurality of domain names includes at least one top-level domain name.

9. The system of claim 8, wherein the top-level domain name is a non-standard top-level domain name.

10. The system of claim 9, wherein the non-standard top-level domain name is one of .scom, .sorg, .snet, .sgov, .sedu, .smil and .sint.

11. The system of claim 1, wherein the network addresses correspond to IP addresses of the devices of the registered users.

12. The system of claim 1, wherein the service system is configured to authenticate the DNS query.

13. The system of claim 1, wherein the encrypted communication link is a virtual private network link.

14. The system of claim 1, wherein the DNS query includes a domain name.

15. The system of claim 1, wherein the DNS query includes a domain name associated with the second device, and the encrypted communication link is created when determination is made by a proxy module that the second device is a device for establishing an encrypted communication link based on the domain name corresponding to the second device identified in a DNS lookup table.

16. The system of claim 1, wherein the second device is a secure website.

17. The system of claim 1, wherein the second device is a phone.

18. The system of claim 1, wherein the service system is connectable to a virtual private network through the communication network.

19. The system of claim 18, wherein the virtual private network is based on a network address hopping regime that is used to pseudorandomly change network addresses in packets transmitted between the first device and the second device.

20. The system of claim 18, wherein the virtual private network is based on a comparison of a discriminator field in a header of each data packet to a table of valid discriminator fields maintained for a device.

21. The system of claim 1, wherein the one or more hardware processors are further configured to execute the instructions to provide, in response to the DNS query, the network address corresponding to a domain name from the plurality of domain names and corresponding network addresses.

22. The system of claim 1, wherein the one or more hardware processors are further configured to execute the instructions to (i) provide the network address associated with the second device, and (ii) facilitate the establishment of an encrypted communication link between the first device and the second device.

23. The system of claim 1, wherein the memory further stores a plurality of domain names and corresponding network addresses of the devices of registered users, and the one or more hardware processors are further configured to execute the instructions to provide an indication that the service system supports establishing an encrypted communication link with respect to each of devices of the registered users corresponding to the stored domain names and network addresses.

24. The system of claim 1, wherein the encrypted communication link is capable of supporting a plurality of services.

25. The system of claim 24, wherein the plurality of services comprises a plurality of communication protocols, a plurality of other application programs, multiple sessions, or a combination thereof.

26. The system of claim 25, wherein the plurality of other application programs comprises at least one of the following:

e-mail, a word processing program, and telephony.

27. A method of accommodating audio video communications over an encrypted communication link between two devices, the method comprising:

storing at a service system a plurality of network addresses of registered devices of registered users, each registered device being provided with an application program for performing audio video communications between the registered device and another device following establishment of an encrypted communication link between the two devices;

receiving, by the service system, a Domain Name Service (DNS) query from a first device, to look up a network address associated with a second device;

determining, by the service system, in response to the DNS query, whether the second device accepts an encrypted communication link connection with the first device; and

establishing, by the service system, an encrypted communication link between the first device and the second device based on a determination that the second device accepts an encrypted communication link connection with the first device.

28. The method of claim 27, wherein receiving a DNS query from the first device includes receiving a query from a phone.

29. The method of claim 27, wherein establishing an encrypted communication link includes establishing a broadband connection.

30. The method of claim 27, wherein establishing an encrypted communication link includes establishing a modulated transmission link.

31. The method of claim 27, wherein establishing an encrypted communication link includes establishing the link so as to support at least one of the following:

FTM, TDM and CDMA.

32. The method of claim 27, wherein establishing an encrypted communication link includes establishing the link so as to support TCP/IP protocols.

33. The method of claim 27, wherein storing a plurality of network addresses includes storing a plurality of domain names corresponding to the network addresses of registered devices.

34. The method of claim 33, wherein storing a plurality of domain names includes storing at least one top-level domain name.

35. The method of claim 34, wherein storing at least one top-level domain name includes storing at least one non-standard top-level domain name.

36. The method of claim 35, wherein the non-standard top-level domain name is one of .scom, .sorg, .snet, .sgov, .sedu, .smil and .sint.

37. The method of claim 27, wherein the network addresses correspond to IP addresses of the registered devices.

38. The method of claim 27, wherein the step of determining includes the step of authenticating the DNS query following determination that the network address of the first device is included in the plurality of network addresses of devices of registered users stored on the service system.

39. The method of claim 27, wherein establishing an encrypted communication link includes establishing a virtual private network link.

40. The method of claim 27, wherein the DNS query includes a domain name.

41. The method of claim 27, wherein the service system includes a proxy module that facilitates establishment of the encrypted communication link based on a unique domain name corresponding to a device identified in a DNS lookup table.

42. The method of claim 27, wherein the second device is a secure website.

43. The method of claim 27, wherein the second device is a phone.

44. The method of claim 27, further including connecting the service system to a virtual private network through a communication network.

45. The method of claim 44, wherein connecting the service system to a virtual private network is based on a network address hopping regime that is used to pseudorandomly change network addresses in packets transmitted between devices communicating via the virtual private network.

46. The method of claim 44, wherein connecting the service system to a virtual private network is based on a comparison of a discriminator field in a header of each data packet to a table of valid discriminator fields maintained for a device.

47. The method of claim 27, further including providing, in response to the DNS query, the network address corresponding to a domain name from the plurality of domain names and corresponding network addresses.

48. The method of claim 27, further including (i) providing the network address associated with the second device, and (ii) facilitating the establishment of an encrypted communication link between the first device and the second device.

49. The method of claim 27, wherein storing a plurality of network addresses includes storing a plurality of domain names and corresponding network addresses of devices of registered users, and providing, in response to the DNS query, an indication that the service system supports establishing an encrypted communication link with respect to each of devices of the registered users corresponding to the stored domain names and network addresses.

50. The method of claim 27, wherein the encrypted communication link is capable of supporting a plurality of services.

51. The method of claim 50, wherein the plurality of services comprises a plurality of communication protocols, a plurality of other application programs, multiple sessions, or a combination thereof.

52. The method of claim 51, wherein the plurality of other application programs comprises at least one of the following;

e-mail, a word processing program, and telephony.