Agile network protocol for secure video communications with assured system availability

• US 9,860,283 B2
• Filed: 05/08/2013
• Issued: 01/02/2018
• Est. Priority Date: 10/30/1998
• Status: Expired due to Fees

• Current Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Original Assignee: VirnetX Inc. (Virnetx Holding Corporation)
• Inventors: Munger, Edmund Colby, Schmidt, Douglas Charles, Short, III, Robert Dunham, Larson, Victor, Williamson, Michael
• Primary Examiner(s): Lim, Krisna
• Application Number:
  US13/890,206
• Publication Number:
  US 20130262587A1
• Time in Patent Office: 1,700 Days
• CPC Class Codes: H04L 2101/604 Address structures or formats
• CPC Class Codes: H04L 45/00 Routing or path finding of packets in data switching networks routing or path finding in wireless networks H04W40/00
• CPC Class Codes: H04L 45/24 Multipath
• CPC Class Codes: H04L 45/243 using M+N parallel active paths
• CPC Class Codes: H04L 45/28 using route fault recovery
• CPC Class Codes: H04L 61/35 involving non-standard use of addresses for implementing network functionalities, e.g. coding subscription information within the address or functional addressing, i.e. assigning an address to a function
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 61/5076 Update or notification mechanisms, e.g. DynDNS
• CPC Class Codes: H04L 61/5092 by self-assignment, e.g. picking addresses at random and testing if they are already in use
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/0414 during transmission, i.e. party's identity is protected against eavesdropping, e.g. by using temporary identifiers, but is known to the other party or parties involved in the communication
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04L 63/1491 using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment
• CPC Class Codes: H04L 65/403 Arrangements for multi-party communication, e.g. for conferences data switching systems for conference H04L12/18; arrangements for connecting several subscribers to a common circuit, i.e. affording conference facilities H04M3/56; television conferencing systems H04N7/15

Abstract

A system and method for video conferencing over a secure communication link is disclosed. In various implementations, the system is configured connect to a communication network, store a plurality of network addresses of devices of registered users, each device of a registered user having an application program for conducting video conferencing between, the client device and the target device, and establish a secure communication link between the client device and the target device. The secure communication link is established in response to a query (a) generated by the client device and (b) including an identifier associated with a network address of the target device, the establishment of the secure communication link being based on a determination that the target device can accept a secure communication link connection with the client device. Video conferencing is conducted over the secure communication link connection between the client device and the target device.

Claims

1. A system for connecting devices over a network, the system comprising:

a memory storing instructions; and

one or more processors configured to execute the instructions to;

receive a request from a first device for a network address associated with a second device, wherein the request includes a name associated with the second device, and further wherein the second device is associated with a first predetermined name and a second predetermined name;

analyze the name included in the request;

if, based on the analysis of the name, the name included in the request is the first predetermined name, resolve the first predetermined name into a first network address associated with the second device, wherein the first network address is used for encrypted communications with the second device, and provide the first device with one or more resources used for communicating with the second device over a communication link that uses encryption; and

if, based on the analysis of the name, the name included in the request is the second predetermined name, resolve the second predetermined name into a second network address associated with the second device,

wherein the communication link goes through one or more intermediate devices that provide anonymity of at least one of the first device and the second device by receiving packets communicated between the first device and the second device over the communication link, translating one or more network addresses contained in the received packets, and transmitting packets containing the translated one or more network addresses.

2. The system of claim 1, wherein the request for the network address is a domain name service (DNS) request.

3. The system of claim 1, wherein the name included in the request is a domain name.

4. The system of claim 1, wherein the first and second network addresses associated with the second device are Internet Protocol (IP) addresses.

5. The system of claim 1, wherein at least the first device is a user device.

6. The system of claim 1, wherein at least the first device is a mobile device.

7. The system of claim 1, wherein the one or more resources includes one or more network addresses.

8. The system of claim 1, wherein the one or more network addresses are pseudorandom network addresses.

9. The system of claim 1, wherein the one or more processors are further configured to execute the instructions to, if the name included in the request is the first predetermined name, return the first network address to the first device.

10. The system of claim 1, wherein the one or more processors are further configured to execute the instructions to, if the name included in the request is the second predetermined name, return the second network address to the first device.

11. The system of claim 1, wherein the one or more processors are further configured to execute the instructions to:

determine whether at least one of the first device or a user associated with the first device is authorized to access the second device via the communication link; and

if the name included in the request is the first predetermined name and at least one of the first device or the user associated with the first device is authorized to access the second device via the communication link, resolve the first network address associated with the second device and provide the first device with the one or more resources.

12. The system of claim 1, wherein the communication link is a direct encrypted communication link.

13. The system of claim 1, wherein the communication link is a communication link between the first device and the second device in a virtual private network (VPN).

14. The system of claim 1, wherein the communication link is a secure communication link.

15. The system of claim 1, wherein the communication link provides anonymity of at least one of the first device and the second device.

16. The system of claim 1, wherein the communication link uses modulation.

17. The system of claim 16, wherein the modulation is based on one of frequency-division multiplexing (FDM), time-division multiplexing (TDM), or code division multiple access (CDMA).

18. The system of claim 1, wherein the communication link supports an application program of the first device.

19. The system of claim 18, wherein the application program comprises at least one of a video, audio, messaging, chat, telephony, or web browser application.

20. The system of claim 1, wherein first network address is same as the second network address.

21. The system of claim 1, wherein first network address is different from the second network address.

22. A method for connecting devices over a network, the method comprising:

receiving a request from a first device for a network address associated with a second device, wherein the request includes a name associated with the second device, and further wherein the second device is associated with a first predetermined name and a second predetermined name;

analyzing the name included in the request;

if, based on the analysis of the name, the name included in the request is the first predetermined name, resolving the first predetermined name into a first network address associated with the second device, wherein the first network address is used for encrypted communications with the second device, and provide the first device with one or more resources used for communicating with the second device over a communication link that uses encryption; and

if, based on the analysis of the name, the name included in the request is the second predetermined name, resolving the second predetermined name into a second network address associated with the second device,

wherein the communication link goes through one or more intermediate devices that provide anonymity of at least one of the first device and the second device by receiving packets communicated between the first device and the second device over the communication link, translating one or more network addresses contained in the received packets, and transmitting packets containing the translated one or more network addresses.

23. The method of claim 22, wherein the request for the network address is a domain name service (DNS) request.

24. The method of claim 22, wherein the name included in the request is a domain name.

25. The method of claim 22, wherein the first and second network addresses associated with the second device are Internet Protocol (IP) addresses.

26. The method of claim 22, wherein at least the first device is a user device.

27. The method of claim 22, wherein at least the first device is a mobile device.

28. The method of claim 22, wherein the one or more resources includes one or more network addresses.

29. The method of claim 22, wherein the one or more network addresses are pseudorandom network addresses.

30. The method of claim 22, further comprising, if the name included in the request is the first predetermined name, returning the first network address to the first device.

31. The method of claim 22, further comprising, if the name included in the request in the second predetermined name, returning the second network address to the first device.

32. The method of claim 22, further comprising:

determining whether at least one of the first device or a user associated with the first device is authorized to access the second device via the communication link; and

if the name included in the request is the first predetermined name and at least one of the first device or the user associated with the first device is authorized to access the second device via the communication link, resolving the first network address associated with the second device and providing the first device with the one or more resources.

33. The method of claim 22, wherein the communication link is a direct encrypted communication link.

34. The method of claim 22, wherein the communication link is a communication link between the first device and the second device in a virtual private network (VPN).

35. The method of claim 22, wherein the communication link is a secure communication link.

36. The method of claim 22, wherein the communication link provides anonymity of at least one of the first device and the second device.

37. The method of claim 22, wherein the communication link uses modulation.

38. The method of claim 37, wherein the modulation is based on one of frequency-division multiplexing (FDM), time-division multiplexing (TDM), or code division multiple access (CDMA).

39. The method of claim 22, wherein the communication link supports an application program of the first device.

40. The method of claim 39, wherein the application program comprises at least one of a video, audio, messaging, chat, telephony, or web browser application.

41. The method of claim 22, wherein first network address is same as the second network address.

42. The method of claim 22, wherein first network address is different from the second network address.

43. A system for connecting devices over a network, the system comprising:

a memory storing instructions; and

one or more processors configured to execute the instructions to;

receive a request from a first device for a network address associated with a second device, wherein the request includes a name associated with the second device, and further wherein the second device is associated with a first predetermined name and a second predetermined name;

analyze the name included in the request;

if, based on the analysis of the name, the name included in the request is the first predetermined name, resolve the first predetermined name into a first network address associated with the second device, wherein the first network address is used for encrypted communications with the second device, and provide the first device with one or more resources used for communicating with the second device over a communication link that uses encryption; and

if, based on the analysis of the name, the name included in the request is the second predetermined name, resolve the second predetermined name into a second network address associated with the second device,

wherein the communication link goes through one or more intermediate devices that provide anonymity of at least one of the first device and the second device by receiving packets communicated between the first device and the second device over the communication link, translating one or more network addresses contained in the received packets, and transmitting packets containing the translated one or more network addresses.

44. The system of claim 43, wherein the one or more intermediate devices include one or more routers.

45. The system of claim 43, wherein the one or more intermediate devices include one or more terminal devices.

46. The system of claim 45, wherein the one or more terminal devices include one or more user computers.

47. The system of claim 43, wherein the one or more intermediate devices include one or more gatekeeper devices.

48. The system of claim 43, wherein the one or more intermediate devices perform the translation by looking up the one or more network addresses contained in the received packets on a lookup table.

49. The method of claim 43, wherein the one or more network addresses are pseudorandom network addresses.

50. The method of claim 43, wherein the one or more network addresses are Media Access Control (“

MAC”

) hardware addresses.