Agile network protocol for secure communications with assured system availability

• US 9,479,426 B2
• Filed: 05/18/2012
• Issued: 10/25/2016
• Est. Priority Date: 10/30/1998
• Status: Expired due to Fees

• Current Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Original Assignee: Virnetz Incorporated
• Inventors: Munger, Edmund Colby, Sabio, Vincent J., Short, Robert Dunham III, Gligor, Virgil D., Schmidt, Douglas Charles
• Primary Examiner(s): STRANGE, AARON N
• Application Number:
  US13/475,637
• Publication Number:
  US 20130091354A1
• Time in Patent Office: 1,621 Days
• Field of Search: 709/230, 709/232, 709/236
• US Class Current: 1/1
• CPC Class Codes: H04L 2101/604 Address structures or formats
• CPC Class Codes: H04L 45/20 Hop count for routing purposes, e.g. TTL
• CPC Class Codes: H04L 45/24 Multipath
• CPC Class Codes: H04L 61/2539 Hiding addresses; Keeping addresses anonymous
• CPC Class Codes: H04L 61/30 Managing network names, e.g. use of aliases or nicknames name-to-address mapping H04L61/45
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5076 Update or notification mechanisms, e.g. DynDNS
• CPC Class Codes: H04L 61/5092 by self-assignment, e.g. picking addresses at random and testing if they are already in use
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0421 Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0435 wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption cryptographic mechanisms or cryptographic arrangements for symmetric key encryption H04L9/06
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 69/14 Multichannel or multilink protocols
• CPC Class Codes: H04L 9/065 Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3
• CPC Class Codes: H04M 3/42008 Systems for anonymous communication between parties, e.g. by use of disposal contact identifiers

Abstract

A plurality of computer nodes communicates using seemingly random IP source and destination addresses and (optionally) a seemingly random discriminator field. Data packets matching criteria defined by a moving window of valid addresses are accepted for further processing, while those that do not meet the criteria are rejected. In addition to “hopping” of IP addresses and discriminator fields, hardware addresses such as Media Access Control addresses can be hopped. The hopped addresses are generated by random number generators having non-repeating sequence lengths that are easily determined a-priori, which can quickly jump ahead in sequence by an arbitrary number of random steps and which have the property that future random numbers are difficult to guess without knowing the random number generator'"'"'s parameters. Synchronization techniques can be used to re-establish synchronization between sending and receiving nodes.

Claims

1. A method of transmitting data over a computer network, comprising the steps of:

at an originating terminal connected to the computer network, receiving a stream of data and forming a first level packet payload based on the stream of data;

identifying a network destination address for the stream of data;

forming a first level packet including the first level packet payload and a first level header containing data representing the network destination address;

encrypting at least a portion of the first level packet to form a second level packet payload;

forming a second level packet including the second level packet payload and a second layer header containing a router address of an intermediate router connecting the originating terminal to the network destination address;

including in one of the first and second layer headers, an indicator of a number of hops to be made by the first level packet before arriving at the network destination address; and

sending the second level packet to the intermediate router at the router address;

wherein the intermediate router determines, based on the indicator, whether to forward the second level packet to another intermediate router at another router address or to forward the second level packet to the network destination address.

2. The method of claim 1, further comprising determining the intermediate router by randomly selecting from a group of intermediate routers.

3. The method of claim 1, the intermediate router decrementing the indicator of a number of hops and sending the first level packet to another intermediate router responsive to a value of the indicator of a number of hops.

4. The method of claim 1, further comprising:

decrypting the second level packet payload;

determining from the first level header the network destination address;

forming a new packet containing at least the first level packet payload; and

attaching a header to the new packet containing the network destination address, whereby a true destination of the data stream is concealed behind a layer of encryption for at least a portion of its travel over the network.

5. The method of claim 4, wherein the step of determining from the first level header the network destination address includes converting the data representing the network destination address to the network destination address using correlation data stored on the intermediate router.