US6502135B1
Expired / Lapsed
US
⏱️ 0.0 years remaining
Agile network protocol for secure communications with assured system availability
Assignee: Virnetx Inc
•
Filing: 2000-02-15
•
Granted: 2002-12-31
•
Expires: 2020-02-15
Abstract
Abstract A plurality of computer nodes communicate using seemingly random Internet Protocol source and destination addresses. Data packets matching criteria defined by a moving window of valid addresses are accepted for further processing, while those that do not meet the criteria are quickly rejected. Improvements to the basic design include (1) a load balancer that distributes packets across different transmission paths according to transmission path quality; (2) a DNS proxy server that transparently creates a virtual private network in response to a domain name inquiry; (3) a large-to-small link bandwidth management feature that prevents denial-of-service attacks at system chokepoints; (4) a traffic limiter that regulates incoming packets by limiting the rate at which a transmitter can be synchronized with a receiver; and (5) a signaling synchronizer that allows a large number of nodes to communicate with a central node by partitioning the communication function between two separate entities.
Inventors
- 👤 Edmund Colby Munger
- 👤 Douglas Charles Schmidt
- 👤 Robert Dunham Short, III
- 👤 Victor Larson
- 👤 Michael Williamson
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-24 13:57
CPC Classifications
H; H04; H04L; H04L45/00; H04L45/24; H04L45/243; H04L45/28; H04L61/00; H04L61/35; H04L61/45; H04L61/4505; H04L61/4511; H04L61/50; H04L61/5007; H04L61/5076; H04L61/5092; H04L63/00; H04L63/02; H04L63/0272; H04L63/04; H04L63/0407; H04L63/0414; H04L63/0428; H04L63/08; H04L63/14; H04L63/1441; H04L63/1458; H04L63/1466; H04L63/1491; H04L65/00; H04L65/40; H04L65/403; H04L2101/00; H04L2101/60; H04L2101/604; H04L63/10
Claims Analysis
Total Claims: 20
Claim 1
Independent Claim
101 words
A method of transparently creating a virtual private network (VPN) between a client computer and a target computer, comprising the steps of: (1) generating from the client computer a Domain Name Service (DNS) request that requests an IP address corresponding to a domain name associated with the target computer; (2) determining whether the DNS request transmitted in step (1) is requesting access to a secure web site; and (3) in response to determining that the DNS request in step (2) is requesting access to a secure target web site, automatically initiating the VPN between the client computer and the target computer.
Claim 2
Independent Claim
101 words
A method of transparently creating a virtual private network (VPN) between a client computer and a target computer, comprising the steps of: (1) generating from the client computer a Domain Name Service (DNS) request that requests an IP address corresponding to a domain name associated with the target computer; (2) determining whether the DNS request transmitted in step (1) is requesting access to a secure web site; and (3) in response to determining that the DNS request in step (2) is requesting access to a secure target web site, automatically initiating the VPN between the client computer and the target computer.
Claim 3
Dependent Claim
22 words
The method of claim 1 , wherein steps (2) and (3) are performed at a DNS server separate from the client computer.
Claim 4
Dependent Claim
50 words
The method of claim 1 , further comprising the step of: (4) in response to determining that the DNS request in step (2) is not requesting access to a secure target web site, resolving the IP address for the domain name and returning the IP address to the client computer.
Claim 5
Dependent Claim
54 words
The method of claim 1 , wherein step (3) comprises the step of, prior to automatically initiating the VPN between the client computer and the target computer, determining whether the client computer is authorized to establish a VPN with the target computer and, if not so authorized, returning an error from the DNS request.
Claim 6
Dependent Claim
54 words
The method of claim 1 , wherein step (3) comprises the step of, prior to automatically initiating the VPN between the client computer and the target computer, determining whether the client computer is authorized to resolve addresses of non secure target computers and, if not so authorized, returning an error from the DNS request.
Claim 7
Dependent Claim
31 words
The method of claim 1 , wherein step (3) comprises the step of establishing the VPN by creating an IP address hopping scheme between the client computer and the target computer.
Claim 8
Dependent Claim
31 words
The method of claim 1 , wherein step (3) comprises the step of using a gatekeeper computer that allocates VPN resources for communicating between the client computer and the target computer.
Claim 9
Dependent Claim
44 words
The method of claim 1 , wherein step (2) is performed in a DNS proxy server that passes through the request to a DNS server if it is determined in step (3) that access is not being requested to a secure target web site.
Claim 10
Dependent Claim
34 words
The method of claim 5 , wherein step (3) comprises the step of transmitting a message to the client computer to determine whether the client computer is authorized to establish the VPN target computer.
Claim 11
Independent Claim
135 words
A system that transparently creates a virtual private network (VPN) between a client computer and a secure target computer, comprising: a DNS proxy server that receives a request from the client computer to look up an IP address for a domain name, wherein the DNS proxy server returns the IP address for the requested domain name if it is determined that access to a non-secure web site has been requested, and wherein the DNS proxy server generates a request to create the VPN between the client computer and the secure target computer if it is determined that access to a secure web site has been requested; and a gatekeeper computer that allocates resources for the VPN between the client computer and the secure web computer in response to the request by the DNS proxy server.
Claim 12
Independent Claim
135 words
A system that transparently creates a virtual private network (VPN) between a client computer and a secure target computer, comprising: a DNS proxy server that receives a request from the client computer to look up an IP address for a domain name, wherein the DNS proxy server returns the IP address for the requested domain name if it is determined that access to a non-secure web site has been requested, and wherein the DNS proxy server generates a request to create the VPN between the client computer and the secure target computer if it is determined that access to a secure web site has been requested; and a gatekeeper computer that allocates resources for the VPN between the client computer and the secure web computer in response to the request by the DNS proxy server.
Claim 13
Dependent Claim
40 words
The system of claim 10 , wherein the gatekeeper computer creates the VPN by establishing an IP address hopping regime that is used to pseudorandomly change IP addresses in packets transmitted between the client computer and the secure target computer.
Claim 14
Dependent Claim
39 words
The system of claim 10 , wherein the gatekeeper computer determines whether the client computer has sufficient security privileges to create the VPN and, if the client computer lacks sufficient security privileges, rejecting the request to create the VPN.
Claim 15
Independent Claim
126 words
A method of establishing communication between one of a plurality of client computers and a central computer that maintains a plurality of authentication tables each corresponding to one of the client computers, the method comprising the steps of: (1) in the central computer, receiving from one of the plurality of client computers a request to establish a connection; (2) authenticating, with reference to one of the plurality of authentication tables, that the request received in step (1) is from an authorized client; (3) responsive to a determination that the request is from an authorized client, allocating resources to establish a virtual private link between the client and a second computer; and (4) communicating between the authorized client and the second computer using the virtual private link.
Claim 16
Independent Claim
126 words
A method of establishing communication between one of a plurality of client computers and a central computer that maintains a plurality of authentication tables each corresponding to one of the client computers, the method comprising the steps of: (1) in the central computer, receiving from one of the plurality of client computers a request to establish a connection; (2) authenticating, with reference to one of the plurality of authentication tables, that the request received in step (1) is from an authorized client; (3) responsive to a determination that the request is from an authorized client, allocating resources to establish a virtual private link between the client and a second computer; and (4) communicating between the authorized client and the second computer using the virtual private link.
Claim 17
Dependent Claim
38 words
The method of claim 13 , wherein step (4) comprises the step of communicating according to a scheme by which at least one field in a series of data packets is periodically changed according to a known sequence.
Claim 18
Dependent Claim
41 words
The method of claim 14 , wherein step (4) comprises the step of comparing an Internet Protocol (IP) address in a header of each data packet to a table of valid IP addresses maintained in a table in the second computer.
Claim 19
Dependent Claim
47 words
The method of claim 15 , wherein step (4) comprises the step of comparing the IP address in the header of each data packet to a moving window of valid IP addresses, and rejecting data packets having IP addresses that do not fall within the moving window.
Claim 20
Dependent Claim
39 words
The method of claim 13 , wherein step (2) comprises the step of using a checkpoint data structure that maintains synchronization of a periodically changing parameter known by the central computer and the client computer to authenticate the client.
References Cited (Backward Citations)
GB814589A
Cited
US4933846A
Cited
US5588060A
Cited
US5878231A
Cited
US5689566A
Cited
US5842040A
Cited
US6016318A
Cited
US5892903A
Cited
GB2317792A
Cited
US5898830A
Cited
US6052788A
Cited
EP0838930A2
Cited
US5796942A
Cited
WO1998027783A1
Cited
US5805801A
Cited
US5905859A
Cited
EP0858189A2
Cited
US6178505B1
Cited
WO1998059470A2
Cited
WO1999038081A1
Cited
US6079020A
Cited
US6119171A
Cited
US6353614B1
Cited
WO1999048303A2
Cited
US6226751B1
Cited
DE19924575A1
Cited
US6286047B1
Cited
US6243749B1
Cited
US6006259A
Cited
US6332158B1
Cited
US6330562B1
Cited
WO2000070458A1
Cited
WO2001050688A1
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2005-12-30 | 2006-07-01 | 2006-12-31 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2009-12-30 | 2010-07-01 | 2010-12-31 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2013-12-30 | 2014-07-01 | 2014-12-31 | $7700.00 | Window Closed / Lapsed |