Agile network protocol for secure communications with assured system availability

• US 20040003116A1
• Filed: 03/31/2003
• Published: 01/01/2004
• Est. Priority Date: 10/30/1998
• Status: Active Grant

• Current Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Original Assignee: Science Applications International Corporation
• Inventors: Munger, Edmund Colby, Schmidt, Douglas Charles, Gligor, Virgil D., Short, Robert Dunham III, Sabio, Vincent J.
• Granted Patent: US 7,133,930 B2
• Time in Patent Office: Days
• US Class Current: 709/245
• CPC Class Codes: H04L 2101/604 Address structures or formats
• CPC Class Codes: H04L 45/20 Hop count for routing purposes, e.g. TTL
• CPC Class Codes: H04L 45/24 Multipath
• CPC Class Codes: H04L 61/2539 Hiding addresses; Keeping addresses anonymous
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5076 Update or notification mechanisms, e.g. DynDNS
• CPC Class Codes: H04L 61/5092 by self-assignment, e.g. picking addresses at random and testing if they are already in use
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0421 Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols
• CPC Class Codes: H04L 9/065 Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3
• CPC Class Codes: H04M 3/42008 Systems for anonymous communication between parties, e.g. by use of disposal contact identifiers

Abstract

A plurality of computer nodes communicates using seemingly random IP source and destination addresses and (optionally) a seemingly random discriminator field. Data packets matching criteria defined by a moving window of valid addresses are accepted for further processing, while those that do not meet the criteria are rejected. In addition to “hopping” of IP addresses and discriminator fields, hardware addresses such as Media Access Control addresses can be hopped. The hopped addresses are generated by random number generators having non-repeating sequence lengths that are easily determined a-priori, which can quickly jump ahead in sequence by an arbitrary number of random steps and which have the property that future random numbers are difficult to guess without knowing the random number generator'"'"'s parameters. Synchronization techniques can be used to re-establish synchronization between sending and receiving nodes. These techniques include a self-synchronization technique in which a sync field is transmitted as part of each packet, and a “checkpoint” scheme by which transmitting and receiving nodes can advance to a known point in their hopping schemes. A fast-packet reject technique based on the use of presence vectors is also described. A distributed transmission path embodiment incorporates randomly selected physical transmission paths.

Claims

1. A method of transmitting data packets from a first computer to a second computer, comprising the steps of:

(i) determining a sender'"'"'s Internet Protocol (IP) address selected from a first set of IP addresses allocated to the first computer;

(ii) determining a receiver'"'"'s IP address selected from a second set of IP addresses allocated to the second computer;

(iii) creating a packet header comprising the sender'"'"'s and receiver'"'"'s IP addresses; and

(iv) the first computer transmitting to the second computer a data packet comprising the packet header.

2. The method of claim 1, wherein the first and second sets of addresses are mutually exclusive.

3. The method of claim 1, wherein in steps (i) and (ii) the IP address determination is based on a pseudo-random algorithm that selects an IP address pair.

4. A method of transmitting data packets between a first computer and a second computer, comprising the steps of:

(i) the second computer receiving a data packet including a packet header comprising a first sender Internet Protocol (IP) address and a first receiver IP address;

(ii) determining a second sender IP address selected from a first set of IP addresses allocated to the first computer;

(iii) determining a second receiver IP address selected from a second set of IP addresses allocated to the second computer;

(iv) accepting the packet when first and second sender IP addresses match and first and second receiver IP addresses match, otherwise, rejecting the packet.

5. The method of claim 4, wherein the first and second sets of IP addresses are mutually exclusive.

6. The method of claim 4, wherein in steps (ii) and (iii) the IP address determination is based on a pseudo-random algorithm that selects an IP address pair.

7. The method of claim 6, further comprising the step of maintaining a window of IP address pairs corresponding to a sequence of IP address pairs generated by the pseudo-random algorithm, and

wherein step (iv) accepts any data packet whose packet header IP addresses match any of the IP address pairs presently in the window.

8. A receiving computer that receives data packets from a transmitting computer, wherein the receiving computer comprises computer instructions that execute the steps of:

(i) receiving data packets from a transmitting computer including a packet header comprising a first sender Internet Protocol (IP) address and a first receiver IP address;

(ii) for each data packet, determining a second sender IP address selected from a first set of IP addresses allocated to the first computer;

(iii) for each data packet, determining a second receiver IP address selected from a second set of IP addresses allocated to the second computer;

(iv) for each data packet, accepting the packet when first and second sender IP addresses match and first and second receiver IP addresses match, otherwise, rejecting the packet.

9. The receiving computer of claim 8, wherein the first and second sets of IP addresses are mutually exclusive.

10. The receiving computer of claim 8, wherein in steps (ii) and (iii) the IP address determination is based on a pseudo-random algorithm that selects an IP address pair.

11. The receiving computer of claim 10, wherein the receiving computer maintains a window of valid second IP address pairs, wherein the window is moved in response to detecting matches.

12. A transmitting computer that transmits data packets to a receiving computer, wherein the transmitting computer comprises computer instructions that execute the steps of:

(i) determining a sender'"'"'s IP address selected from a first set of IP addresses allocated to the first computer;

(ii) determining a receiver'"'"'s IP address selected from a second set of IP addresses allocated to the second computer;

(iii) creating a packet header comprising the sender'"'"'s and receiver'"'"'s IP addresses; and

(iv) the first computer transmitting to the second computer a data packet comprising the packet header.

13. The transmitting computer of claim 12, wherein the first and second sets of IP addresses are mutually exclusive.

14. The transmitting computer of claim 12, wherein in steps (i) and (ii) the IP address determination is based on a pseudo-random algorithm that selects an IP address pair.