Agile network protocol for secure communications using secure domain names

• US 9,967,240 B2
• Filed: 05/12/2015
• Issued: 05/08/2018
• Est. Priority Date: 10/30/1998
• Status: Expired due to Fees

• Current Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Original Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Inventors: Larson, Victor, Short, III, Robert Dunham, Munger, Edmund Colby, Williamson, Michael
• Primary Examiner(s): Lim, Krisna
• Application Number:
  US14/710,470
• Publication Number:
  US 20150244680A1
• Time in Patent Office: 1,092 Days
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 2101/30 Types of network names
• CPC Class Codes: H04L 2101/604 Address structures or formats
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/24 Multipath
• CPC Class Codes: H04L 45/28 using route fault recovery
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 61/3015 Name registration, generation or assignment
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5076 Update or notification mechanisms, e.g. DynDNS
• CPC Class Codes: H04L 61/5092 by self-assignment, e.g. picking addresses at random and testing if they are already in use
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0421 : Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
• CPC Class Codes: H04L 63/0428 : wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 : wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0478 : applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/0485 : Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 63/08 : for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 : based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/105 : Multiple levels of security
• CPC Class Codes: H04L 63/1408 : by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 : Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1458 : Denial of Service
• CPC Class Codes: H04L 63/1466 : Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/164 : at the network layer
• CPC Class Codes: H04L 63/168 : above the transport layer
• CPC Class Codes: H04L 67/14 : Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/141 : Setup of application sessions admission control or resource allocation in data switching networks H04L47/70

Abstract

A secure domain name service for a computer network is disclosed that includes a portal connected to a computer network, such as the Internet, and a domain name database connected to the computer network through the portal. The portal authenticates a query for a secure computer network address, and the domain name database stores secure computer network addresses for the computer network. Each secure computer network address is based on a non-standard top-level domain name, such as .scom, .sorg, .snet, .snet, .sedu, .smil and .sint.

Claims

1. A non-transitory computer-readable storage medium storing instructions that, when executed by a computer, cause the computer to perform a method for registering a secure domain name, the method comprising steps of:

receiving a request for registering a first domain name used for establishing an encrypted communication link;

verifying ownership information for an equivalent second domain name, corresponding to the first domain name, that is not used for establishing the encrypted communication link;

registering the first domain name in a domain name service configured to support establishment of encrypted communication links when the ownership information for the second domain name is consistent with ownership information for the first domain name.

2. The non-transitory computer-readable storage medium according to claim 1, wherein the step of verifying ownership information includes steps of:

determining whether second domain name corresponding to the first domain name has been registered in a second domain name service; and

querying whether the second domain name should be registered in the second domain name service when the second domain name has not been registered in second domain name service.

3. The non-transitory computer-readable storage medium of claim 1, wherein the encrypted communication link is a link between computers in a virtual private network.

4. The method of claim 1, further comprising registering the second domain name in association with a certain quality of service for the encrypted communication link.

5. The method of claim 4, wherein the quality of service is a priority for packets transmitted on the encrypted communication link.

6. A method for registering a domain name, comprising steps of:

(i) receiving a request for registering a first domain name used for establishing an encrypted communication link;

(ii) verifying ownership information for a second domain name corresponding to the first domain name, wherein the second domain name is not used for establishing the encrypted communication link; and

(ii) registering the first domain name when the ownership information for the second domain name is consistent with ownership information for the first domain name.

7. The method of claim 6, wherein the first domain name comprises a non-standard top-level domain and the second domain name comprises a standard top-level domain.

8. The method of claim 6, further comprising the step of storing information corresponding to the registration performed in step (iii) in a database separate from a database storing information for standard domain name registrations.

9. The method according to claim 6, wherein the step of verifying ownership information includes steps of:

determining whether the second domain name has been registered in a domain name service; and

querying whether the second domain name should be registered in the domain name service when the second domain name has not been registered in the domain name service.

10. The method of claim 9, wherein the first domain name is a secure domain name.

11. The method of claim 10, wherein the first domain name is registered in a secure domain name service.

12. The method of claim 10, wherein the secure domain name has a top-level domain reserved for secure network connections.

13. The non-transitory computer-readable storage medium of claim 10, wherein the secure domain name has a top-level domain reserved from secure network connections.

14. The method of claim 6, wherein the encrypted communication link is a link between computers in a virtual private network.

15. A non-transitory computer-readable storage medium, comprising computer-readable instructions that, when executed by a computer, cause the computer to perform a method for registering a domain name, the method comprising steps of:

receiving a request for registering a first domain name used for establishing an encrypted communication link;

verifying ownership information for a second domain name corresponding to the first domain name, wherein the second domain name is not used for establishing the encrypted communication link; and

registering the first domain name when the ownership information for the second domain name is consistent with ownership information for the first domain name.

16. The non-transitory computer readable storage medium of claim 15, wherein the first domain name comprises a non-standard top-level domain and the second domain name comprises a standard top-level domain.

17. The computer-readable storage medium of claim 15, wherein the step of verifying ownership information includes steps of:

determining whether the second domain name has been registered in a domain name service; and

querying whether the second domain name should be registered in the domain name service when the second domain name has not been registered in the domain name service.

18. The non-transitory computer-readable storage medium of claim 17, wherein the encrypted communication link is a link between computers in a virtual private network.

19. The non-transitory computer-readable storage medium of claim 15, the method further comprising registering the first domain name in association with a certain quality of service for the encrypted communication link.

20. The non-transitory computer-readable storage medium of claim 19, wherein the quality of service is a priority for packets transmitted on the encrypted communication link.

21. A system comprising:

memory; and

one or more processors configured to execute instructions to;

receive a request for registering a first domain name used for establishing an encrypted communication link;

verify ownership information for an equivalent second domain name, corresponding to the first domain name, that is not used for establishing the encrypted communication link;

register the second domain name in a domain name service configured to support establishment of encrypted communication links when the ownership information for the second domain name is consistent with ownership information for the first domain name.

22. The system of claim 21, wherein the encrypted communication link is a link between computers in a virtual private network.

23. The system of claim 21, wherein the one or more processors are further to execute instructions to register the second domain name in association with a certain quality of service for the encrypted communication link.

24. A system comprising:

memory; and

one or more processors configured to execute instructions to;

(i) receive a request for registering a first domain name used for establishing an encrypted communication link;

(ii) verify ownership information for a second domain name corresponding to the first domain name, wherein the second domain name is not used for establishing the encrypted communication link; and

(ii) register the first domain name when the ownership information for the second domain name is consistent with ownership information for the first domain name.

25. The system of claim 24, wherein the encrypted communication link is a link between computers in a virtual private network.

26. The system of claim 24, wherein the quality of service is a priority for packets transmitted on the encrypted communication link.

27. The system of claim 24, wherein the one or more processors are further to execute instructions to register the second domain name in association with a certain quality of service for the encrypted communication link.

28. The system of claim 27, wherein the quality of service is a priority for packets transmitted on the encrypted communication link.