Method for establishing secure communication link between computers of virtual private network

• US 9,094,399 B2
• Filed: 07/12/2011
• Issued: 07/28/2015
• Est. Priority Date: 10/30/1998
• Status: Expired due to Fees

• Current Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Original Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Inventors: Larson, Victor, Short, Robert Dunham III, Munger, Edmund Colby, Williamson, Michael
• Primary Examiner(s): Lim, Krisna
• Application Number:
  US13/181,041
• Publication Number:
  US 20110270998A1
• Time in Patent Office: 1,477 Days
• Field of Search: 709/227, 709/228, 709/229
• US Class Current: 1/1
• CPC Class Codes: H04L 2101/604 Address structures or formats
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/24 Multipath
• CPC Class Codes: H04L 45/28 using route fault recovery
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 61/45 Network directories; Name-to-address mapping
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5076 Update or notification mechanisms, e.g. DynDNS
• CPC Class Codes: H04L 61/5092 by self-assignment, e.g. picking addresses at random and testing if they are already in use
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0414 during transmission, i.e. party's identity is protected against eavesdropping, e.g. by using temporary identifiers, but is known to the other party or parties involved in the communication
• CPC Class Codes: H04L 63/0421 Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1491 : using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 63/18 : using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215

Abstract

A technique is disclosed for establishing a secure communication link between a first computer and a second computer over a computer network. Initially, a secure communication mode of communication is enabled at a first computer without a user entering any cryptographic information for establishing the secure communication mode of communication. Then, a secure communication link is established between the first computer and a second computer over a computer network based on the enabled secure communication mode of communication. The secure communication link is a virtual private network communication link over the computer network in which one or more data values that vary according to a pseudo-random sequence are inserted into each data packet.

Claims

1. A method of transparently establishing an encrypted communication link with a remote network device, the method comprising:

from a user network device;

sending a query message to a domain name service to resolve a domain name; and

automatically initiating the encrypted communication link between the user network device and the remote network device based on;

an evaluation of the query message to resolve the domain name to determine that the domain name is a secure domain name, and

a determination, based on a comparison between an identifier associated with the user network device and one or more user network device identifiers, that the user network device is authorized to connect to the remote network device via the encrypted communication link.

2. The method of claim 1, wherein automatically initiating the encrypted communication link includes receiving a response message containing a secure computer network address associated with the secure domain name.

3. The method of claim 2, wherein the received response message is in an encrypted form.

4. The method of claim 2, wherein the received response message is encrypted, and further including decrypting the encrypted response message.

5. The method of claim 2, wherein the secure computer network address is an Internet Protocol (IP) address.

6. The method of claim 2, further including automatically establishing the encrypted communication link using the secure computer network address.

7. The method of claim 1, wherein automatically initiating the encrypted communication link includes receiving a response message containing the secure computer network address associated with the secure domain name through a tunnel.

8. The method of claim 1, wherein automatically initiating the encrypted communication link further includes receiving a response message containing the secure computer network address associated with the secure domain name from at least one tunneled packet.

9. The method of claim 1, further including supporting a plurality of services over the encrypted communication link.

10. The method of claim 9, wherein the plurality of services include a plurality of communication protocols, a plurality of application programs, multiple sessions, or combination thereof.

11. The method of claim 10, wherein the plurality of application programs include video conferencing, email, word processing programs, telephony, or combination thereof.

12. The method of claim 9, wherein the plurality of services include audio, video, or combination thereof.

13. The method of claim 1, wherein the encrypted communication link is an authenticated link.

14. The method of claim 1, wherein the user network device and remote network device are connected to a communication network.

15. A non-transitory machine-readable medium storing machine-readable instructions for performing a method for transparently establishing an encrypted communication link with a remote network device, the method comprising:

sending a query message to a domain name service to resolve a domain name; and

automatically initiating the encrypted communication link between the user network device and the remote network device based on;

an evaluation of the query to resolve the domain name to determine that the domain name is a secure domain name, and

a determination, based on a comparison between an identifier associated with the user network device and one or more user network device identifiers, that the user network device is authorized to connect to the remote network device via the encrypted communication link.

16. The non-transitory machine-readable medium of claim 15, wherein automatically initiating the encrypted communication link includes receiving a response message containing a secure computer network address associated with the secure domain name.

17. The non-transitory machine-readable medium of claim 16, wherein the response message is received in an encrypted form.

18. The non-transitory machine-readable medium of claim 16, wherein the received response message is encrypted, and the method further includes decrypting the encrypted response message.

19. The non-transitory machine-readable medium of claim 16, wherein the secure computer network address is an Internet Protocol (IP) address.

20. The non-transitory machine-readable medium of claim 16, wherein the method further includes automatically establishing the encrypted communication link using the secure computer network address.

21. The non-transitory machine-readable medium of claim 15, wherein automatically initiating the encrypted communication link includes receiving a response message containing the secure network address associated with the secure domain name through tunneling within a secure communication link.

22. The non-transitory machine-readable medium of claim 15, wherein automatically initiating the encrypted communication link further includes receiving a response message containing the secure network address associated with the secure domain name from at least one tunneled packet.

23. The non-transitory machine-readable medium of claim 15, the method further including supporting a plurality of services over the encrypted communication link.

24. The non-transitory machine-readable medium of claim 23, wherein the plurality of services include a plurality of communication protocols, a plurality of application programs, multiple sessions, or combination thereof.

25. The non-transitory machine-readable medium of claim 24, wherein the plurality of application programs include video conferencing, email, word processing programs, telephony, or combination thereof.

26. The non-transitory machine-readable medium of claim 23, wherein the plurality of services include audio, video, or combination thereof.

27. The non-transitory machine-readable medium of claim 15, wherein the encrypted communication link is an authenticated link.

28. The non-transitory machine-readable medium of claim 15, wherein the user network device and remote network device are connected to a communication network.

29. A network device configured to transparently establish an encrypted communication link with a remote network device, the network device including a memory storing instructions and a processor configured to execute the instructions to:

send a query message to a domain name service to resolve a domain name; and

automatically initiate the encrypted communication link between the user network device and the remote network device based on;

an evaluation of the query to resolve the domain name to determine that the domain name is a secure domain name, and

a determination, based on a comparison between an identifier associated with the user network device and one or more user network device identifiers, that the user network device is authorized to connect to the remote network device via the encrypted communication link.

30. The network device of claim 29, wherein automatically initiating the encrypted communication link includes receiving a response message containing a secure computer network address associated with the secure domain name.

31. The network device of claim 30, wherein the processor receives the response message in an encrypted form.

32. The network device of claim 31, wherein the processor is further configured to decrypt the encrypted response message.

33. The network device of claim 30, wherein the secure computer network address is an Internet Protocol (IP) address.

34. The network device of claim 30, wherein the processor is further configured to automatically establish the encrypted communication link using the secure computer network address.

35. The network device of claim 29, wherein automatically initiating the encrypted communication link includes receiving a response message containing a secure network address associated with the secure domain name through tunneling within a secure communication link.

36. The network device of claim 29, wherein automatically initiating the encrypted communication link includes receiving a response message containing a secure network address associated with the secure domain name from at least one tunneled packet.

37. The network device of claim 29, wherein the processor is further configured to support a plurality of services over the encrypted communication link.

38. The network device of claim 37, wherein the plurality of services include a plurality of communication protocols, a plurality of application programs, multiple sessions, or combination thereof.

39. The network device of claim 38, wherein the plurality of application programs include video conferencing, email, word processing programs, telephony, or combination thereof.

40. The network device of claim 37, wherein the plurality of services include audio, video, or combination thereof.

41. The network device of claim 29, wherein the encrypted communication link is an authenticated link.

42. The network device of claim 29, wherein the user network device and remote network device are connected to a communication network.