Systems and methods for certifying devices to communicate securely

• US 9,673,988 B2
• Filed: 08/14/2015
• Issued: 06/06/2017
• Est. Priority Date: 01/18/2001
• Status: Expired due to Term

• Current Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Original Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Inventors: Larson, Victor
• Primary Examiner(s): PHUNKULH, BOB A
• Application Number:
  US14/827,243
• Publication Number:
  US 20150358168A1
• Time in Patent Office: 662 Days
• Field of Search: None
• CPC Class Codes: H04L 2209/64 Self-signed certificates
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 47/805 QOS or priority aware
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A virtual private network (VPN) over a telecommunications network is created by sending a request from a first VPN device to a second VPN device for establishing a VPN between the first and second VPN devices. The request includes a first signed certificate having a verified VPN parameter for the first VPN device. A reply is received at the first VPN device from the second VPN device that includes a second signed certificate having a verified VPN parameter for the second VPN device. The VPN is established between the first and second VPN devices based on each verified VPN parameter for each of the first and second VPN devices.

Claims

1. A method for certifying a device for communicating securely over a network, the method comprising:

receiving, at a certification authority from the device, a request to generate a certificate for the device to communicate securely with other devices over the network, the request including a name of the device and at least one communication link parameter, wherein the name is used to be used by the other devices to communicate with the device using an encrypted link;

verifying, at the certification authority, the at least one communication link parameter;

generating, using at least one computer processor, a cryptographically-signed certificate for the device, the cryptographically-signed certificate containing the name of the device and the verified at least one communication link parameter; and

making the cryptographically-signed certificate available to the device.

2. The method of claim 1, wherein the certification authority is a name server.

3. The method of claim 1, wherein the at least one communication link parameter includes at least one of an identity of the device, a range of addresses used by the device when communicating securely, a security parameter used by the device when communicating securely, a Quality-of-Service (QoS) parameter used by the device when communicating securely, an address of the device, a gateway address for the device, or a hostname of the device.

4. The method of claim 1, wherein the at least one communication link parameter includes a security parameter used by the device when communicating securely.

5. The method of claim 4, wherein the security parameter includes a east one of an encryption algorithm, a key length, or a rekey rate.

6. The method of claim 1, wherein the at least one communication link parameter includes a Quality-of-Service (QoS) parameter used by the device when communicating securely.

7. The method of claim 6, wherein the QoS parameter includes a bandwidth requirement of the device when communicating securely.

8. The method of claim 1, further comprising:

associating, by the certification authority, the verified at least one communication link parameter with the name of the device; and

storing the associated name and the verified at least communication link parameter in a repository.

9. The method of claim 1, wherein making the cryptographically-signed certificate available to the device includes making the cryptographically-signed certificate available for download and installation by the device.

10. The method of claim 1, wherein the device uses the cryptographically-signed certificate when proposing a connection to another device.

11. The method of claim 1, wherein communicating securely includes communicating over an encrypted communication link.

12. The method of claim 1, wherein communicating securely includes communicating over a communication link between devices in a virtual private network.

13. The method of claim 1, wherein the device is a mobile device.

14. The method of claim 13, wherein the mobile device is a phone.

15. A certification authority system for certifying devices for communicating securely over a network, comprising:

a repository; and

one or more processors configured to;

receive, from a device, a request to generate a certificate for the device to communicate securely with other devices over the network, the request including a name of the device and least one communication link parameter, wherein the name is used to be used by the other devices to communicate with the device using an encrypted link;

verify the at least one communication link parameter;

generate a cryptographically-signed certificate for the device, the cryptographically-signed certificate containing the name of the device and the verified at least one communication link parameter; and

make the cryptographically-signed certificate available to the device.

16. The certification authority system of claim 15, wherein the certification authority is a domain name server.

17. The certification authority system of claim 15, wherein the at least one communication link parameter includes at least one of an identity of the device, a range of addresses used by the device when communicating securely, a security parameter used by the device when communicating securely, a Quality-of-Service (QoS) parameter used by the device when communicating securely, an address of the device, a gateway address for the device, or a hostname of the device.

18. The certification authority system of claim 15, wherein the at least one communication link parameter includes a security parameter used by the device when communicating securely.

19. The certification authority system of claim 18, wherein the security parameter includes at least one of an encryption algorithm, a key length, or a rekey rate.

20. The certification authority system of claim 15, wherein the at least one communication link parameter includes a Quality-of-Service (QoS) parameter used by the device when communicating securely.

21. The certification authority system of claim 20, wherein the QoS parameter includes a bandwidth requirement of the device when communicating securely.

22. The certification authority system of claim 15, wherein the one or more processors are further configured to:

associate the verified at least one communication link parameter with the name of the device; and

store the associated name and the verified at least one communication link parameter in the repository.

23. The certification authority system of claim 15, wherein making the cryptographically-signed certificate available to the device includes making the cryptographically-signed certificate available for download and installation by the device.

24. The certification authority system of claim 15, wherein the device uses the cryptographically-signed certificate when proposing a connection to another device.

25. The certification authority system of claim 15, wherein communicating securely includes communicating over an encrypted communication link.

26. The certification authority system of claim 15, wherein communicating securely includes communicating over a communication link between devices in a virtual private network.

27. The certification authority system of claim 15, wherein the device is a mobile device.

28. The certification authority system of claim 27, wherein the mobile device is a phone.