Third party VPN certification

• US 8,780,906 B2
• Filed: 09/14/2012
• Issued: 07/15/2014
• Est. Priority Date: 01/18/2001
• Status: Expired due to Fees

• Current Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Original Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Inventors: Larson, Victor
• Primary Examiner(s): PHUNKULH, BOB A
• Application Number:
  US13/620,368
• Publication Number:
  US 20130067087A1
• Time in Patent Office: 669 Days
• Field of Search: None
• US Class Current: 370/389
• CPC Class Codes: H04L 2209/64 Self-signed certificates
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/40 using virtualisation of network functions or resources, e.g. SDN or NFV entities
• CPC Class Codes: H04L 47/805 QOS or priority aware
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823

Abstract

A virtual private network (VPN) over a telecommunications network is created by sending a request from a first VPN device to a second VPN device for establishing a VPN between the first and second VPN devices. The request includes a first signed certificate having a verified VPN parameter for the first VPN device. A reply is received at the first VPN device from the second VPN device that includes a second signed certificate having a verified VPN parameter for the second VPN device. The VPN is established between the first and second VPN devices based on each verified VPN parameter for each of the first and second VPN devices.

Claims

1. A method for creating a secure communication link, comprising:

querying an online database to request a secure domain name address of a device;

receiving the secure domain name address in response to the querying;

facilitating an exchange of one or more verified certificates with the device in order to establish the secure communication link using the verified certificates; and

communicating with the device using the established secure communication link.

2. The method of claim 1, wherein the querying includes providing a remote name of a pre-authorized secure name pair to the online database, the method further comprising:

storing information identifying a plurality of pre-authorized secure name pairs, the name pairs each including a local device name and a remote device name for a secure communication link.

3. The method of claim 2, wherein the information identifying the plurality of pre-authorized secure name pairs further includes information identifying a secure connection type for the pair.

4. The method of claim 2, wherein the information identifying the plurality of pre-authorized secure name pairs further includes wildcard information in at least one of the local or remote device names.

5. The method of claim 1, further comprising:

storing a plurality of verified certificates, the plurality of verified certificates containing different secure communication link parameters.

6. The method of claim 5, further comprising:

associating the stored plurality of verified certificates with a plurality of different local names.

7. The method of claim 1, wherein the querying includes providing a public key to the online database.

8. The method of claim 1, wherein the received secure domain name address is used in the exchange of the one or more verified certificates.

9. The method of claim 1, wherein:

the one or more verified certificates each contains at least one verified secure communication parameter for a respective device, and

the communicating using the secure communication link includes using the at least one secure communication parameter from the one or more verified certificates.

10. A non-transitory computer-readable medium storing computer-executable instructions for performing the following:

providing a remote name of a pre-authorized secure name pair to an online database;

receiving a secure domain name address for a device in response to the providing;

facilitating an exchange of one or more verified certificates for the secure communication link with the device using the secure domain name address; and

facilitating the establishment of a secure communication link using the one or more verified certificates.

11. The non-transitory medium of claim 10, further comprising computer-executable instructions for:

facilitating storage of information identifying a plurality of pre-authorized secure name pairs, the name pairs each including a local device name and a remote device name for a secure communication link.

12. The non-transitory medium of claim 11, wherein the information identifying the plurality of pre-authorized secure name pairs further includes information identifying a secure communication link type for the pair.

13. The non-transitory medium of claim 11, wherein the information identifying the plurality of pre-authorized secure name pairs further includes wildcard information in at least one of the local or remote device names.

14. The non-transitory medium of claim 10, further comprising computer-executable instructions for:

facilitating storage of a plurality of verified certificates for the first device, the plurality of verified certificates containing different secure communication link parameters.

15. The non-transitory medium of claim 14, further comprising computer-executable instructions for:

associating the stored plurality of verified certificates with a plurality of different local names.

16. The non-transitory medium of claim 10, wherein providing a remote name includes providing a public key to the online database.

17. The non-transitory medium of claim 10, wherein:

the one or more verified certificates each contain at least one verified secure communication parameter, and

the establishing uses the at least one verified secure communication parameter from the one or more verified certificates.

18. A device, comprising:

a memory storing a plurality of verified certificates for facilitating the establishment of a secure communication link with the device, the verified certificates each being associated with a different local name associated with the device; and

a processor configured to;

receive a request to initiate a secure communication link from a second device, and

locate a name in the request and compare the name with the plurality of different local names to identify at least one stored verified certificate for use in establishing a secure communication link with the the second device.

19. The device of claim 18, wherein the memory further stores information identifying policy restrictions associated with one or more of the local names.

20. The device of claim 18, wherein the device is configured to provide secure communication links for a plurality of client devices.