System and method for using a registered name to connect network devices with a link that uses encryption

• US 9,027,115 B2
• Filed: 09/10/2014
• Issued: 05/05/2015
• Est. Priority Date: 10/30/1998
• Status: Expired due to Term

• Current Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Original Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Inventors: Larson, Victor, Short, Robert Dunham III, Munger, Edmund Colby, Williamson, Michael
• Primary Examiner(s): PERUNGAVOOR, VENKATANARAY
• Application Number:
  US14/482,956
• Publication Number:
  US 20140380039A1
• Time in Patent Office: 237 Days
• US Class Current: 726/14
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 2101/30 Types of network names
• CPC Class Codes: H04L 2101/604 Address structures or formats
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/24 Multipath
• CPC Class Codes: H04L 45/28 using route fault recovery
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 61/3015 Name registration, generation or assignment
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5076 Update or notification mechanisms, e.g. DynDNS
• CPC Class Codes: H04L 61/5092 by self-assignment, e.g. picking addresses at random and testing if they are already in use
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0421 : Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
• CPC Class Codes: H04L 63/0428 : wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 : wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0478 : applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/0485 : Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 63/08 : for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 : based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/105 : Multiple levels of security
• CPC Class Codes: H04L 63/1408 : by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 : Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1458 : Denial of Service
• CPC Class Codes: H04L 63/1466 : Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/164 : at the network layer
• CPC Class Codes: H04L 63/168 : above the transport layer
• CPC Class Codes: H04L 67/14 : Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/141 : Setup of application sessions admission control or resource allocation in data switching networks H04L47/70

Abstract

A method for connecting a first network device to a second network device includes receiving a request to resolve a network address of the second network device. The request includes a name associated with the second network device that corresponds to the network address. The request is evaluated to confirm that the name is registered with a name service that facilitates resolving the name and facilitates establishing communication links, which use encryption, between the first network device and the second network device over the network. It is determined whether the second network device is available to establish the communication link. If so, the communication link is automatically established, including sending a signal to a provisioning server to provision the first network device or the second network device with a resource for the communication link.

Claims

1. A method for connecting a first network device to a second network device over a network, the method comprising:

receiving, from the first network device, a request to resolve a network address of the second network device, the request including a name associated with the second network device that corresponds to the network address;

evaluating the request to resolve a network address of the second device, the evaluating including confirming that the name associated with the second network device is registered with a name service that facilitates resolving the name and facilitates establishing communication links, that use encryption, between network devices over the network;

determining, based on the evaluation, whether the second network device is available to establish a communication link that uses encryption; and

if the second device is registered and available to establish the communication link that uses encryption, automatically establishing the communication link, that uses encryption, between the first network device and the second network device over the network, the establishing including sending a signal to a provisioning server to provision the first network device or the second network device with a resource for the communication link that uses encryption, wherein;

the first network device is a user device, and

the communication link that uses encryption enables the first network device to directly communicate with the second network device over the network.

2. The method of claim 1, further comprising returning the resolved network address to the first network device.

3. The method of claim 1, further comprising using an application program of the first network device to communicate data over the established communication link, that uses encryption, between the first network device and the second network device.

4. The method of claim 3, wherein the application program comprises a messaging application program of the first network device to communicate data over the established communication link, that uses encryption, between the first network device and the second network device.

5. The method of claim 1, wherein the established communication link, that uses encryption, between the first network device and a second network device is a first communication link, the method further comprising establishing a second communication link, that uses encryption, with a third network device.

6. The method of claim 5, wherein at least the first network device and the second network device communicate through the first communication link, that uses encryption, over a single session.

7. The method of claim 5, wherein at least the first network device and the second network device communicate through the first communication link, that uses encryption, over multiple sessions.

8. The method of claim 3, wherein the application program comprises one or more of an e-mail application, a word processing application, or a browser application.

9. The method of claim 3, wherein:

the application program comprises one or more of a telephony application or a video conferencing application;

the data includes at least one of video data or audio data; and

the data is encrypted over at least a portion of the established communication link that uses encryption.

10. The method of claim 9, wherein the application program uses modulation.

11. The method of claim 1, wherein the established communication link that uses encryption is based on one of frequency-division multiplexing (FDM), time-division multiplexing (TDM), or code division multiple access (CDMA).

12. The method of claim 1, wherein the first network device is a mobile device.

13. The method of claim 1, wherein the second network device is a user device.

14. The method of claim 13, wherein the second network device is a mobile device.

15. The method of claim 1, wherein the receiving the request to resolve a network address occurs within another network device that is separate from the first network device.

16. The method of claim 1, further comprising:

determining whether software for encrypting data over the established communication link that uses encryption is installed; and

if the software is not installed;

accessing a network address for downloading the software;

downloading the software; and

installing the software.

17. The method of claim 1, further comprising further evaluating the request to resolve a network address of the second device to confirm that a user associated with the first network device is registered with the name service as a user for whom encrypted communication services are defined.

18. The method of claim 1, wherein the name is a domain name.

19. The method of claim 1, wherein at least a portion of the established communication link that uses encryption further provides anonymity for at least one of the first network device or the second network device via a tunnel between the first network device and the second network device.

20. The method of claim 19, wherein the tunnel is based on a network address hopping regime that is used to pseudo-randomly change network addresses in packets transmitted between the first network device and the second network device over the network.

21. The method of claim 1, wherein the request to resolve a network address is encrypted.

22. The method of claim 1, wherein the established communication link that uses encryption enables the first network device to address the second network device over the network.

23. The method of claim 1, wherein establishing the communication link, that uses encryption, between the first network device and the second network device over the network avoids returning the IP address of the second network device to the first network device.

24. A system for connecting a first network device to a second network device over a network, the system including a memory storing instructions and one or more servers configured by executing the instructions to:

receive, from the first network device, a request to resolve a network address of the second network device, the request including a name associated with the second network device that corresponds to the network address;

evaluate the request to resolve a network address of the second device, the evaluating including confirming that the name associated with the second network device is registered with a name service that facilitates resolving the name and facilitates establishing communication links, that use encryption, between network devices over the network;

determine, based on the evaluation, whether the second network device is available to establish a communication link that uses encryption; and

if the second device is registered and available to establish the communication link that uses encryption, automatically send a signal to a provisioning server to provision the first network device or the second network device with a resource for establishing the communication link that uses encryption, between the first network device and the second network device over the network, wherein;

the first network device is a user device, and

the communication link that uses encryption enables the first network device to directly communicate with the second network device over the network.

25. The system of claim 24, wherein the one or more servers are further configured to return the resolved network address to the first network device.

26. The system of claim 24, wherein the one or more servers are further configured to provision the first network device and the second network device to use an application program of the first network device to communicate data over the established communication link, that uses encryption, between the first network device and the second network device.

27. The system of claim 24, wherein the application program comprises one or more of an e-mail application, a word processing application, or a browser application.

28. The system of claim 24, wherein:

the application program comprises one or more of a telephony application or a video conferencing application;

the data includes at least one of video data or audio data; and

the data is encrypted over at least a portion of the established communication link that uses encryption.

29. The system of claim 24, wherein the one or more servers are further configured to evaluate the request to resolve a network address of the second device to confirm that a user associated with the first network device is registered with the name service as a user for whom encrypted communication services are defined.

30. The system of claim 24, wherein the communication link, that uses encryption, enables the first network device to address the second network device over the network.