VALIDATING PACKETS IN NETWORK COMMUNICATIONS

• US 20120017265A1
• Filed: 09/23/2011
• Published: 01/19/2012
• Est. Priority Date: 10/17/2007
• Status: Active Grant

• Current Assignee: Dispersive Holdings Incorporated (Dispersive Networks, Inc.)
• Original Assignee: Dispersive Networks, Inc.
• Inventors: Twitchell, Robert W. Jr.
• Granted Patent: US 9,246,980 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: H04L 12/56 Packet switching systems
• CPC Class Codes: H04L 45/586 of virtual routers
• CPC Class Codes: H04L 47/17 Interaction among intermediate nodes, e.g. hop by hop
• CPC Class Codes: H04L 51/06 Message adaptation to terminal or network requirements
• CPC Class Codes: H04L 67/06 specially adapted for file transfer, e.g. file transfer protocol [FTP]
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols
• CPC Class Codes: H04L 69/18 Multiprotocol handlers, e.g. single devices capable of handling multiple protocols
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers
• CPC Class Codes: H04L 69/28 Timers or timing mechanisms used in protocols
• CPC Class Codes: H04L 69/32 Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
• CPC Class Codes: H04L 69/325 in the network layer [OSI layer 3], e.g. X.25 H04L69/16 takes precedence

Abstract

A method for validating packets in network communications includes receiving, at networking hardware of a device, a packet communicated from another device over a network; intercepting, by virtual dispersive routing (VDR) software loaded on the device, the packet as it is passed from the networking hardware; determining, by the VDR software, that a destination address of the packet corresponds to an address associated with the device; and determining, by the VDR software, using a virtual machine for a network connection that virtualizes network capabilities of the device, that the packet belongs to a valid application running on the device.

Claims

1. A method for validating packets in network communications, comprising the steps of:

(a) receiving, at networking hardware of a device, a packet communicated from another device over a network;

(b) intercepting, by virtual dispersive routing (VDR) software loaded on the device, the packet as it is passed from the networking hardware;

(c) determining, by the VDR software, that a destination address of the packet corresponds to an address associated with the device; and

(d) determining, by the VDR software, using a virtual machine for a network connection that virtualizes network capabilities of the device, that the packet belongs to a valid application running on the device.

2. The method of claim 1, wherein the virtual machine is spawned by the VDR software in response to a request for a network connection from a particular application running on the device.

3. The method of claim 2, wherein said step of determining that the packet belongs to a valid application running on the device comprises determining that the packet belongs to the particular application running on the device.

4. The method of claim 2, wherein the particular application is a computer game.

5. The method of claim 1, wherein the device is a computer.

6. The method of claim 5, wherein the computer includes a plurality of processing cores.

7. The method of claim 1, wherein the device is a mobile phone.

8. The method of claim 1, wherein said step of determining, using a virtual machine for a network connection that virtualizes network capabilities of the device, that the packet belongs to a valid application utilizes a spider configured to thread together an upper application layer and a lower layer of a protocol stack.

9. The method of claim 1, wherein the method further includes the steps of:

(a) determining, based on application information associated with a valid application running on the device, that the packet is atypical; and

(b) quarantining, utilizing a virtual machine for a network connection that virtualizes network capabilities of the device, the packet and other packets received over the network pending verification.

10. The method of claim 1, wherein the method further includes the steps of:

(a) running a hashing algorithm on the packet; and

(b) determining, based on a result of the hashing algorithm, that the packet is corrupt.

11. The method of claim 10, wherein the method further includes a step of, in response to determining that the packet is corrupt, quarantining the packet.

12. The method of claim 1, wherein the method further includes the step of determining, based at least in part on application information associated with a valid application running on the device, that the packet is corrupt.

13. The method of claim 12, wherein the method further includes a step of, in response to determining that the packet is corrupt, quarantining the packet.

14. The method of claim 1, wherein the method further includes the steps of:

(a) running a hashing algorithm on the packet; and

(b) determining, based at least partially on a result of the hashing algorithm, and at least partially on application information associated with a valid application running on the device, that the packet is corrupt.

15. The method of claim 14, wherein the method further includes a step of, in response to determining that the packet is corrupt, quarantining the packet.

16. The method of claim 1, wherein the method further includes the steps of:

(a) running a hashing algorithm on the packet; and

(b) determining, based at least partially on a result of the hashing algorithm, and at least partially on application information associated with a valid application running on the device, that the packet is atypical.

17. The method of claim 16, wherein the method further includes a step of, in response to determining that the packet is atypical, quarantining the packet.

18. A method of utilizing information from one layer of a protocol stack to inform decisions at another layer of the protocol stack, comprising:

(a) spawning a virtual machine for a network connection that virtualizes network capabilities of a device;

(b) loading a spider configured to thread together an upper application layer and a lower layer of a protocol stack;

(c) receiving, using the virtualized network capabilities of the virtual machine, a packet at the lower layer; and

(c) determining whether a value from the packet corresponds to a value associated with the application layer.

19. A method of utilizing information from one layer of a protocol stack to inform decisions at another layer of the protocol stack, comprising:

(a) loading, at a device, a spider configured to thread together an upper application layer and a lower layer of a protocol stack;

(b) receiving a network packet at the lower layer;

(c) determining whether a value derived from information in the network packet corresponds to a value associated with the application layer.

20. The method of claim 19, wherein the device comprises a computer.