System and method for establishing a communication link

• US 9,386,000 B2
• Filed: 09/14/2012
• Issued: 07/05/2016
• Est. Priority Date: 10/30/1998
• Status: Expired due to Fees

• Current Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Original Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Inventors: Larson, Victor, Short, Robert Dunham III, Munger, Edmund Colby, Williamson, Michael
• Primary Examiner(s): Shaw, Peter
• Application Number:
  US13/617,375
• Publication Number:
  US 20130014226A1
• Time in Patent Office: 1,390 Days
• Field of Search: 726/5
• US Class Current: 1/1
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: G06F 21/606 by securing the transmission between two devices or processes
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 2101/30 Types of network names
• CPC Class Codes: H04L 2101/604 Address structures or formats
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/24 Multipath
• CPC Class Codes: H04L 45/28 using route fault recovery
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 61/3015 Name registration, generation or assignment
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5076 Update or notification mechanisms, e.g. DynDNS
• CPC Class Codes: H04L 61/5092 by self-assignment, e.g. picking addresses at random and testing if they are already in use
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0421 : Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
• CPC Class Codes: H04L 63/0428 : wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 : wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/0478 : applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key cryptographic mechanisms or cryptographic arrangements using a plurality of keys or algorithms H04L9/14
• CPC Class Codes: H04L 63/0485 : Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
• CPC Class Codes: H04L 63/08 : for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0876 : based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/105 : Multiple levels of security
• CPC Class Codes: H04L 63/1408 : by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 : Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1458 : Denial of Service
• CPC Class Codes: H04L 63/1466 : Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/164 : at the network layer
• CPC Class Codes: H04L 63/168 : above the transport layer
• CPC Class Codes: H04L 67/14 : Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/141 : Setup of application sessions admission control or resource allocation in data switching networks H04L47/70

Abstract

A system for and method of establishing a secure communication link is disclosed. The method comprises: (1) generating a Domain Name Service (DNS) request; (2) determining that the DNS request corresponds a first computer configured to communicate securely; (3) sending, based on the determination, a request to establish a secure communication link with the first computer configured to communicate securely, the request including an identifier of a client device used to determine whether the client device is authorized to communicate with the first computer; (4) receiving, in response to the request to establish a secure communication link, a resource used to establish the secure communication link; (5) automatically establishing the secure communication link using the received resource; and (6) communicating securely with the first computer over the established secure communication link.

Claims

1. A method of establishing a communication link, comprising:

generating a Domain Name Service (DNS) request comprising a domain name;

determining that the DNS request corresponds to a first computer configured to communicate securely;

sending, based on the determination, a request to establish a communication link with the first computer configured to communicate securely, the request including an identifier of a client device used to determine whether the client device is authorized to communicate with the first computer;

receiving, in response to the request to establish the communication link, a resource used to establish the communication link;

determining, in response to the request to establish a communication link, whether a software module for communicating securely requires installation on the client device;

if it is determined that the software module requires installation on the client device;

accessing a network address for downloading the software module, downloading the software module, and installing the software module on the client device;

automatically establishing the communication link using the received resource; and

communicating securely with the first computer over the established communication link, wherein the communication link passes through one or more intermediate devices that provide anonymity of at least one of the client device and the first computer, and

wherein the client device is a user device.

2. The method of claim 1, wherein the resource is obtained from a second computer that is separate from the first computer.

3. The method of claim 1, wherein the resource includes at least one random or pseudorandom value used to establish the communication link.

4. The method of claim 1, wherein the communication link is a communication link between the client device and the first computer in a virtual private network (VPN).

5. The method of claim 1, wherein the client device identifier is an IP address.

6. The method of claim 1, wherein communicating includes using modulation.

7. The method of claim 6, wherein the modulation is based on one of frequency-division multiplexing (FDM), time-division multiplexing (TDM), or code division multiple access (CDMA).

8. The method of claim 1, wherein the client device includes a mobile device.

9. The method of claim 1, further comprising:

receiving a request for proof that the client device is authorized to access the first computer; and

sending the requested proof that the client device is authorized to access the first computer.

10. The method of claim 9, wherein the request for proof is generated by a second computer that is separate from the first computer.

11. The method of claim 9, wherein the requested proof is sent to a second computer that is separate from the first computer to determine whether the client device is authorized to access the first computer.

12. The method of claim 1, wherein the DNS request is a request for an Internet Protocol (IP) address associated with the domain name.

13. The method of claim 1, wherein the communication link is encrypted.

14. The method of claim 1, wherein the communication link is a secure communication link.

15. The method of claim 14, wherein the secure communication link provides anonymity of at least the client device or the first computer.

16. The method of claim 1, wherein the resource indicates a quality of service level for the communication link.

17. The method of claim 16, wherein a name service determines the quality of service level for the communication link based on the domain name.

18. The method of claim 16, wherein a name service determines the quality of service level for the communication link based on information associated with the client device.

19. The method of claim 16, wherein a name service determines the quality of service level based on a subscription.

20. The method of claim 19, wherein the subscription is associated with the first computer or a user of the first computer.

21. The method of claim 16, wherein the resource includes a set of one or more network addresses.

22. The method of claim 21, wherein the set of one or more network addresses includes one or more pseudorandom network addresses.

23. The method of claim 16, wherein the quality of service level indicates whether to encrypt the communication link.

24. The method of claim 16, wherein the quality of service level indicates whether the communication link is to be a virtual private network communication link.

25. The method of claim 16, wherein the resource is used for at least one of setting a quality of service parameter for the communication link or for authenticating communications between the client device and the first computer to the determined quality of service level.

26. The method of claim 16, wherein communicating securely includes inserting the resource indicating the quality of service level into packets transmitted from the client device to the first computer.

27. The method of claim 1, further comprising:

determining, at the client device, whether the client device is configured to communicate securely;

if it is determined that the client device is configured to communicate securely, using as the domain name in the generating step a first domain name for communicating securely.

28. The method of claim 27, further comprising, if it is determined that the client device is not configured to communicate securely, using as the domain name in the generating step a second domain name.

29. The method of claim 27, further comprising executing an application program on the client device, wherein the application program allows a user to configure the client device to communicate securely.

30. The method of claim 29, wherein the application program comprises at least one of a video, audio, messaging, chat, telephony, or web browser application.

31. The method of claim 29, wherein the application program comprises a user interface for configuring the client device to communicate securely, and the method further comprises receiving, via the user interface, input from the user configuring the client device to communicate securely.

32. The method of claim 1, wherein the one or more intermediate devices change a protocol of communications between the client device and the first computer.

33. The method of claim 1, wherein the communication link is a direct communication link.

34. The method of claim 1, wherein the one or more intermediate devices provide anonymity by translating one or more network addresses associated with packets sent over the communication link.

35. The method of claim 1, wherein the one or more intermediate devices comprise one or more routers.

36. A system for establishing a communication link, comprising:

a storage device configured to store instructions; and

one or more processors configured to execute the instructions to;

generate a Domain Name Service (DNS) request comprising a domain name;

determine that the DNS request corresponds to a first computer configured to communicate securely;

send, based the determination, a request to establish a communication link with the first computer, the request including an identifier of a client device used to determine whether the client device is authorized to communicate with the first computer;

receive, in response to the request to establish the communication link, a resource used to establish the communication link;

store the received resource in the storage device;

determine, in response to the request to establish the communication link, whether a software module for communicating securely requires installation on the client device;

if it is determined that the software module requires installation on the client device;

access a network address for downloading the software module, download the software module, and install the software module on the client device;

automatically establish the communication link using the received resource; and

communicate securely with the first computer over the established communication link, wherein the communication link passes through one or more intermediate devices that provide anonymity of at least one of the client device and the first computer, and

wherein the client device is a user device.

37. The system of claim 36, wherein the resource is obtained from a second computer that is separate from the first computer.

38. The system of claim 36, wherein the resource includes at least one random or pseudorandom value used to establish the communication link.

39. The system of claim 36, wherein the communication link is a communication link between the client device and the first computer in a virtual private network (VPN).

40. The system of claim 36, wherein the client device identifier is an IP address.

41. The system of claim 36, wherein the one or more processors are further configured to communicate with the first computer using modulation.

42. The system of claim 41, wherein the modulation is based on one of frequency-division multiplexing (FDM), time-division multiplexing (TDM), and code division multiple access (CDMA).

43. The system of claim 36, wherein the client device includes a mobile device.

44. The system of claim 36, wherein the one or more processors are further configured to:

receive a request for proof that the client device is authorized to access the first computer; and

send the requested proof that the client device is authorized to access the first computer.

45. The system of claim 44, wherein the request for proof is generated by a second computer that is separate from the first computer.

46. The system of claim 44, wherein the requested proof is sent to a second computer that is separate from the first computer to determine whether the client device is authorized to access the first computer.

47. The system of claim 36, wherein the DNS request is a request for an Internet Protocol (IP) address associated with the domain name.

48. The system of claim 36, wherein the communication link is encrypted.

49. The system of claim 36, wherein the communication link is a secure communication link.

50. The system of claim 49, wherein the secure communication link provides anonymity of at least the client device or the first computer.

51. The system of claim 36, wherein the resource indicates a quality of service level for the communication link.

52. The system of claim 51, wherein a name service determines the quality of service level for the communication link based on the domain name.

53. The system of claim 51, wherein a name service determines the quality of service level for the communication link based on information associated with the client device.

54. The system of claim 51, wherein a name service determines the quality of service level based on a subscription.

55. The system of claim 54, wherein the subscription is associated with the first computer or a user of the first computer.

56. The system of claim 51, wherein the resource includes a set of one or more network addresses.

57. The system of claim 56, wherein the set of one or more network addresses includes one or more pseudorandom network addresses.

58. The system of claim 51, wherein the quality of service level indicates whether to encrypt the communication link.

59. The system of claim 51, wherein the quality of service level indicates whether the communication link is to be a virtual private network communication link.

60. The system of claim 51, wherein the resource is used for at least one of setting a quality of service parameter for the communication link or for authenticating communications between the client device and the first computer to the determined quality of service level.

61. The system of claim 51, wherein, when communicating securely, the one or more processors are further configured to execute the instructions to insert the resource indicating the quality of service level into packets transmitted from the client device to the first computer.

62. The system of claim 36, wherein the one or more processors are further configured to execute the instructions to:

determine, at the client device, whether the client device is configured to communicate securely;

if it is determined that the client device is configured to communicate securely, use as the domain name in the generating step a first domain name for communicating securely.

63. The system of claim 62, wherein the one or more processors are further configured to execute the instructions to, if it is determined that the client device is not configured to communicate securely, use as the domain name in the generating step a second domain name.

64. The system of claim 62, wherein the one or more processors are further configured to execute the instructions to execute an application program on the client device, wherein the application program allows a user to configure the client device to communicate securely.

65. The system of claim 64, wherein the application program comprises at least one of a video, audio, messaging, chat, telephony, or web browser application.

66. The system of claim 64, wherein the application program comprises a user interface for configuring the client device to communicate securely, and one or more processors are further configured to execute the instructions to receive, via the user interface, input from the user configuring the client device to communicate securely.

67. The system of claim 36, wherein the one or more intermediate devices change a protocol of communications between the client device and the first computer.

68. The system of claim 36, wherein the communication link is a direct communication link.

69. The system of claim 36, wherein the one or more intermediate devices provide anonymity by translating one or more network addresses associated with packets sent over the communication link.

70. The system of claim 36, wherein the one or more intermediate devices comprise one or more routers.