Method for establishing connection between devices

• US 9,413,766 B2
• Filed: 10/29/2014
• Issued: 08/09/2016
• Est. Priority Date: 10/30/1998
• Status: Expired due to Fees

• Current Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Original Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Inventors: Larson, Victor, Short, Robert Dunham III, Munger, Edmund Colby, Williamson, Michael
• Primary Examiner(s): Lim, Krisna
• Application Number:
  US14/526,669
• Publication Number:
  US 20150058933A1
• Time in Patent Office: 650 Days
• US Class Current: 1/1
• CPC Class Codes: H04L 2101/604 Address structures or formats
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/24 Multipath
• CPC Class Codes: H04L 45/28 using route fault recovery
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 61/45 Network directories; Name-to-address mapping
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5076 Update or notification mechanisms, e.g. DynDNS
• CPC Class Codes: H04L 61/5092 by self-assignment, e.g. picking addresses at random and testing if they are already in use
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0414 during transmission, i.e. party's identity is protected against eavesdropping, e.g. by using temporary identifiers, but is known to the other party or parties involved in the communication
• CPC Class Codes: H04L 63/0421 Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1491 : using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 63/18 : using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215

Abstract

A device and method for establishing a connection between devices is disclosed. A first device receives a request to connect to a second network device and, based on the request, a determination is made as to whether the first device is set to a first communication mode or a second communication mode. If the first device is set to the first communication mode then a first name associated with the second device is sent to a first name service, the first name service supporting establishing an encrypted connection to the second device, a resource for the encrypted connection to the second device is received at the first device, and communication with the second device is established over the network via the encrypted connection using the received resource. If the first device is set to the second communication mode then communication with the second device is established via a second connection.

Claims

1. A method performed by a first network device for communicating over a network, the method comprising:

receiving, at the first network device, a request to connect to a second network device;

based on the request to connect, determining whether the first network device is set to the first communication mode or the second communication mode;

if it is determined that the first network device is set to the first communication mode;

sending, to a first name service, a first name associated with the second network device and for which the first name service supports establishing an encrypted connection to the second network device;

receiving, at the first network device, a resource for the encrypted connection to the second network device; and

communicating with the second network device over the network via the encrypted connection using the received resource; and

if it is determined that the first network device is set to the second communication mode, communicating with the second network device via a second connection;

wherein the first name service determines a quality of service level for the encrypted connection, and the resource indicates the determined quality of service level for the encrypted connection.

2. The method of claim 1, further comprising, in response to sending the first name to the first name service, receiving, at the first network device, a network address associated with the second network device.

3. The method of claim 1, wherein the first name service determines the quality of service level based on the first name.

4. The method of claim 1, wherein the first name service determines the quality of service level for the encrypted connection based on information associated with the first network device.

5. The method of claim 1, wherein the first name service determines the quality of service level based on a subscription.

6. The method of claim 5, wherein the subscription is associated with the first network device or the user of the first network device.

7. The method of claim 1, wherein the resource includes one or more network addresses.

8. The method of claim 7, wherein the set of one or more network addresses includes pseudorandom network addresses.

9. The method of claim 1, wherein the resource is used for authenticating communications between the first network device and the second network device to the determined quality of service level.

10. The method of claim 1, wherein the encrypted connection is a secure communication link.

11. The method of claim 1, wherein the encrypted connection is a communication link between the first and second network devices in a virtual private network.

12. The method of claim 1, wherein the encrypted connection passes through one or more intermediate devices on the network, the intermediate devices providing anonymity of at least one of the first network device and the second network device by translating one or more addresses in packets transmitted over the encrypted connection.

13. The method of claim 1, further comprising executing an application program on the first network device, wherein the first and second communication modes are provided by the application program.

14. The method of claim 13, wherein the application program comprises at least one of a video, audio, messaging, chat, telephony, or web browser application.

15. The method of claim 13, wherein the application program comprises a user interface allowing the user to set the first network device to the first communication mode or the second communication mode, and the method further comprises receiving, via the user interface, a selection of the first communication mode or a selection of the second communication mode.

16. The method of claim 1, further comprising:

based on a determination that the first network device is set to the first communication mode, determining whether an encrypted communication software module is installed on the first network device; and

if the module is not installed;

accessing a network address for downloading the module;

downloading the module; and

installing the module on the first network device.

17. The method of claim 1, wherein the second connection is not encrypted.

18. The method of claim 1, further comprising, based on a determination that the first network device is set to the second communication mode, sending, to a second name service, a second name associated with the second network device.

19. The method of claim 1, wherein the first and second network devices are mobile devices.

20. A first network device configured to communicate over a network, the first network device comprising:

a memory storing instructions; and

one or more processors configured to execute the instructions to;

allow the first network device to be set to a first communication mode or a second communication mode by a user;

receive a request to connect to a second network device;

based on the request to connect, determine whether the first network device is set to the first communication mode or the second communication mode;

if it is determined that first network device is set to the first communication mode;

send, to a first name service, a first name associated with the second network device and for which the first name service supports establishing an encrypted connection to the second network device;

receive, at the first network device, a resource for the encrypted connection to the second network device; and

communicate with the second network device over the network via the encrypted connection using the received resource; and

if it is determined that the first network device is set to the second communication mode, communicate with the second network device via a second connection;

wherein the first name service determines a quality of service level for the encrypted connection, and the resource indicates the determined quality of service level for the encrypted connection.

21. The first network device of claim 20, wherein the one or more processors are further configured to execute the instructions to, in response to sending the first name to the first name service, receive a network address associated with the second network device.

22. The first network device of claim 20, wherein the first name service determines the quality of service level based on the first name.

23. The first network device of claim 20, wherein the first name service determines the quality of service level for the encrypted connection based on information associated with the first network device.

24. The first network device of claim 20, wherein the first name service determines the quality of service level based on a subscription.

25. The first network device of claim 24, wherein the subscription is associated with the first network device or the user of the first network device.

26. The first network device of claim 20, wherein the resource includes one or more network addresses.

27. The first network device of claim 26, wherein the set of one or more network addresses includes pseudorandom network addresses.

28. The first network device of claim 20, wherein the resource is used for authenticating communications between the first network device and the second network device to the determined quality of service level.

29. The first network device of claim 20, wherein the encrypted connection is a secure communication link.

30. The first network device of claim 20, wherein the encrypted connection is a communication link between the first and second network devices in a virtual private network.

31. The first network device of claim 20, wherein the encrypted connection passes through one or more intermediate devices on the network, the intermediate devices providing anonymity of at least one of the first network device and the second network device by translating one or more addresses in packets transmitted over the encrypted connection.

32. The first network device of claim 20, wherein the one or more processors are further configured to execute the instructions to, execute an application program on the first network device, wherein the first and second communication modes are provided by the application program.

33. The first network device of claim 32, wherein the application program comprises at least one of a video, audio, messaging, chat, telephony, or web browser application.

34. The first network device of claim 32, wherein the application program comprises a user interface allowing the user to set the first network device to the first communication mode or the second communication mode, and the one or more processors are further configured to execute the instructions to receive, via the user interface, a selection of the first communication mode or a selection of the second communication mode.

35. The first network device of claim 20, wherein the one or more processors are further configured to execute the instructions to:

based on a determination that the first network device is set to the first communication mode, determine whether an encrypted communication software module is installed on the first network device; and

if the module is not installed;

access a network address for downloading the module;

download the module; and

install the module on the first network device.

36. The first network device of claim 20, wherein the second connection is not encrypted.

37. The first network device of claim 20, wherein the one or more processors are further configured to execute the instructions to send, based on a determination that the first network device is set to the second communication mode, to a second name service, a second name associated with the second network device.

38. The first network device of claim 20, wherein the first and second network devices are mobile devices.