System and method for establishing an encrypted communication link based on IP address lookup requests

• US 9,077,695 B2
• Filed: 05/28/2013
• Issued: 07/07/2015
• Est. Priority Date: 10/30/1998
• Status: Expired due to Fees

• Current Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Original Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Inventors: Larson, Victor, Short, Robert Dunham III, Munger, Edmund Colby, Williamson, Michael
• Primary Examiner(s): Gee, Jason K.
• Assistant Examiner(s): BUCKNOR, OLANREWAJU J
• Application Number:
  US13/903,788
• Publication Number:
  US 20130263220A1
• Time in Patent Office: 770 Days
• Field of Search: None
• US Class Current: 1/1
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 2101/30 Types of network names
• CPC Class Codes: H04L 2101/604 Address structures or formats
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/24 Multipath
• CPC Class Codes: H04L 45/28 using route fault recovery
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 61/3015 Name registration, generation or assignment
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5076 Update or notification mechanisms, e.g. DynDNS
• CPC Class Codes: H04L 61/5092 by self-assignment, e.g. picking addresses at random and testing if they are already in use
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0421 : Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
• CPC Class Codes: H04L 63/0428 : wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 : wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0478 : applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/0485 : Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 63/08 : for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 : based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/105 : Multiple levels of security
• CPC Class Codes: H04L 63/1408 : by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 : Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1458 : Denial of Service
• CPC Class Codes: H04L 63/1466 : Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/164 : at the network layer
• CPC Class Codes: H04L 63/168 : above the transport layer
• CPC Class Codes: H04L 67/14 : Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/141 : Setup of application sessions admission control or resource allocation in data switching networks H04L47/70

Abstract

A network device stores an application program for a secure communications service and has processor configured to execute the application program. The execution causes the processor to send a request to look up an internet protocol (IP) address of a second network device based on an identifier associated with the second network device, to receive, following a determination by a name service that the second network device is available for the secure communications service, the determination by the name service being based on the identifier in the request: (1) an indication that the second network device is available for the secure communications service, (2) the requested IP address of the second network device, and (3) provisioning information for an encrypted communication link. The execution further enables the processor to connect to the second network device and to communicate data with the second network via the encrypted communication link. The network device is a device at which a user uses the secure communications service to access the encrypted communication link.

Claims

1. A network device, comprising:

a storage device storing an application program for a secure communications service; and

at least one processor configured to execute the application program for the secure communications service so as to enable the network device to;

send a request to look up an internet protocol (IP) address of a second network device based on an identifier associated with the second network device;

receive, following a determination by a name service that the second network device is available for the secure communications service, the determination by the name service being based on the identifier in the request;

(1) an indication that the second network device is available for the secure communications service, (2) the requested IP address of the second network device, and (3) provisioning information for an encrypted communication link;

connect to the second network device, using the received IP address of the second network device and the provisioning information for the encrypted communication link; and

communicate data with the second network device using the secure communications service over an electronic network via the encrypted communication link,

the network device being a device at which a user uses the secure communications service to access the encrypted communication link.

2. The network device of claim 1, wherein:

the secure communications service includes an audio-video conferencing service; and

the at least one processor is configured to execute the secure communications service application program so as to allow the network device to communicate encrypted audio-video data over the encrypted communication link using the audio-video conferencing service.

3. The network device of claim 1, wherein the secure communications service includes a messaging service.

4. The network device of claim 3, wherein the messaging service includes an e-mail service.

5. The network device of claim 1, wherein the secure communications service includes a telephony service.

6. The system of claim 5, wherein the telephony service uses modulation.

7. The network device of claim 6, wherein the modulation is based on one of frequency-division multiplexing (FDM), time-division multiplexing (TDM), or code division multiple access (CDMA).

8. The network device of claim 1, wherein the network device is a mobile device.

9. The network device of claim 1, wherein the identifier associated with the second network device is a domain name.

10. The network device of claim 1, wherein the encrypted communication link is part of a virtual private network communication link that is based on inserting into data packets communicated over the virtual private network communication link one or more data values that vary according to a pseudo-random sequence.

11. The network device of claim 1, wherein the indication. that the second network device is available for the secure communications service is a function of a result of a name lookup.

12. The network device of claim 1, wherein the encrypted communication link is an end-to-end link extending from the network device to the second network device.

13. The network device of claim 1, wherein the interception of the request consists of receiving the request to determine that the second network device is available for the secure communications service.

14. The network device of claim 1, wherein the interception occurs at another network device that is separate from the network device.

15. A method executed by a first network device for communicating with a second network device, the method comprising:

sending a request to look up an internet protocol (IP) address of a second network device based on an identifier associated with the second network device;

receive, following a determination by a name service that the second network device is available for the secure communications service, the determination by the name service being based on the identifier in the request;

(1) an indication that the second network device is available for the secure communications service, (2) the requested IP address of the second network device, and (3) provisioning information for an encrypted communication link;

connecting to the second network device over the encrypted communication link, using the received IP address of the second network device and the provisioning information for the encrypted communication link; and

communicating data with the second network device using the secure communications service over an electronic network via the encrypted communication link,

the first network device being a device at which a user uses the secure communications service to access the encrypted communication link.

16. The method of claim 15, wherein the secure communications service includes a video conferencing service, and communicating includes communicating at least one of encrypted video data and audio data over the encrypted communication link using the video conferencing service.

17. The method of claim 15, wherein the secure communications service includes a messaging service.

18. The method of claim 17, wherein the messaging service includes an e-mail service.

19. The method of claim 15, wherein the secure communications service includes a telephony service.

20. The method of claim 19, wherein the telephony service uses modulation.

21. The method of claim 20, wherein the modulation is based on one of frequency-division multiplexing (M), time-division multiplexing (TDM), or code division multiple access (CDMA).

22. The method of claim 15, wherein at least one of the first network device or the second network device is a mobile device.

23. The method of claim 15, wherein the identifier associated with the second network device is a domain name.

24. The method of claim 15, wherein the encrypted communication link is part of a virtual private network communication link, and communicating includes inserting into data packets communicated over the virtual private network communication link one or more data values that vary according to a pseudo-random sequence.

25. The method of claim 15, wherein the indication that the second network device is available for a secure communications service is a function of a name lookup.

26. The method of claim 15, wherein the encrypted communication link is an end-to-end link extending from the first network device to the second network device.

27. The method of claim 15, wherein the intercepting the request consists of receiving the request to determine that the second network device is available for the secure communications service.

28. The method of claim 15, wherein the intercepting the request occurs at another network device that is separate from the first network device.