Agile network protocol for secure communications with assured system availability
First Claim
Patent Images
1. A method for establishing an encrypted channel between a client and a target computer, comprising the steps of:
- (i) intercepting a DNS request sent by the client; and
(ii) based on the DNS request, establishing the encrypted channel between the client and the target.
4 Assignments
0 Petitions
Accused Products
Abstract
A plurality of computer nodes communicate using seemingly random Internet Protocol source and destination addresses. Data packets matching criteria defined by a moving window of valid addresses are accepted for further processing, while those that do not meet the criteria are quickly rejected. Improvements to the basic design include (1) a load balancer that distributes packets across different transmission paths according to transmission path quality; (2) a DNS proxy server that transparently creates a virtual private network in response to a domain name inquiry; (3) a large-to-small link bandwidth management feature that prevents denial-of-service attacks at system chokepoints; (4) a traffic limiter that regulates incoming packets by limiting the rate at which a transmitter can be synchronized with a receiver; and (5) a signaling synchronizer that allows a large number of nodes to communicate with a central node by partitioning the communication function between two separate entities.
228 Citations
20 Claims
-
1. A method for establishing an encrypted channel between a client and a target computer, comprising the steps of:
-
(i) intercepting a DNS request sent by the client; and
(ii) based on the DNS request, establishing the encrypted channel between the client and the target. - View Dependent Claims (2, 3, 4, 5, 6)
-
- 7. A method for establishing an encrypted channel between a client and a secure host, comprising the step of automatically creating the encrypted channel upon intercepting a DNS request for a domain name comprising a predetermined domain name extension.
- 9. A method for establishing an encrypted channel between a client and a secure host, comprising the step of automatically creating the encrypted channel in response to detecting a request for access to a predetermined IP address.
-
11. A data processing device, comprising memory storing a domain name server (DNS) proxy module that intercepts DNS requests sent by a client and, for each intercepted DNS request, performs the steps of:
-
(i) determining whether the intercepted DNS request corresponds to a secure server;
(ii) when the intercepted DNS request does not correspond to a secure server, forwarding the DNS request to a DNS function that returns an IP address of a nonsecure computer; and
(iii) when the intercepted DNS request corresponds to a secure server, automatically initiating an encrypted channel between the client and the secure server. - View Dependent Claims (12, 13, 14)
-
-
15. A data processing device, comprising memory storing a domain name server (DNS) proxy module that intercepts DNS requests sent by a client and, for each intercepted DNS request, when the intercepted DNS request corresponds to a secure server, determines whether the client is authorized to access the secure server and, if so, automatically initiates an encrypted channel between the client and the secure server.
-
16. A computer readable medium storing a domain name server (DNS) proxy module comprised of computer readable instructions that, when executed, cause a data processing device to perform the steps of:
-
(i) intercepting a DNS request sent by a client;
(ii) determining whether the intercepted DNS request corresponds to a secure server;
(iii) when the intercepted DNS request does not correspond to a secure server, forwarding the DNS request to a DNS function that returns an IP address of a nonsecure computer; and
(iv) when the intercepted DNS request corresponds to a secure server, automatically initiating an encrypted channel between the client and the secure server. - View Dependent Claims (17, 18, 19)
-
-
20. A computer readable medium comprising computer readable instructions that, when executed, cause a domain name server (DNS) proxy module to intercept DNS requests sent by a client and, for each intercepted DNS request, when the intercepted DNS request corresponds to a secure server, determines whether the client is authorized to access the secure server and, if so, automatically initiates an encrypted channel between the client and the secure server.
Specification
-
- Resources
Litigation Campaign Assessment
Thank you for your request. You will receive a custom alert email when the Litigation Campaign Assessment is available.
×
-
Current AssigneeVirnetX Inc. (Virnetx Holding Corporation)
-
Original AssigneeScience Applications International Corporation
-
InventorsLarson, Victor, Munger, Edmund Colby, Schmidt, Douglas Charles, Short, Robert Dunham III, Williamson, Michael
-
Granted Patent
-
Time in Patent OfficeDays
-
Field of Search
-
US Class Current709/225
-
CPC Class CodesH04L 2101/604 Address structures or formatsH04L 45/00 Routing or path finding of ...H04L 45/24 MultipathH04L 45/243 using M+N parallel active p...H04L 45/28 using route fault recoveryH04L 61/35 involving non-standard use ...H04L 61/4511 using domain name system [DNS]H04L 61/5007 Internet protocol [IP] addr...H04L 61/5076 Update or notification mech...H04L 61/5092 by self-assignment, e.g. pi...H04L 63/0272 Virtual private networksH04L 63/0407 wherein the identity of one...H04L 63/0414 during transmission, i.e. p...H04L 63/0428 wherein the data content is...H04L 63/08 for authentication of entit...H04L 63/10 for controlling access to d...H04L 63/1458 Denial of ServiceH04L 63/1466 Active attacks involving in...H04L 63/1491 using deception as counterm...H04L 65/403 Arrangements for multi-part...
