USOO7418504B2
`
`(12) United States Patent
`(10) Patent N0.:
`US 7,418,504 B2
`
`Larson et al.
`(45) Date of Patent:
`Aug. 26, 2008
`
`(54) AGIHC NE’I‘WORK PROTOCOL FOR SECURE
`COMMUNICATIONS USING SECURE
`DOMAIN NAMES
`
`(58) Field of Classification Search ................. 709/226,
`709/221; 713/201
`See application file for complete search history.
`
`(75)
`
`Inventors: Victor Larson, Fairfax, VA (US);
`Robert Dunham Short, III, Leesburg,
`VA (US); Edmund Colby Munger,
`Crownsville, MD (US); Michael
`Williamson, South Riding, VA (US)
`
`(73) Assignee: VirnetX, Inc., Scotts Valley, CA (US)
`
`( * ) Notice:
`
`Subject to any disclaimer, the term of this
`patent is extended or adjusted under 35
`U.S.C. 154(b) by 646 days.
`
`(21) App1.No.: 10/714’849
`.
`Filed:
`
`Nov. 18, 2003
`
`(22)
`
`(65)
`
`Prlor Publication Data
`US 2004/0098485 A1
`May 20, 2004
`
`Related US. Application Data
`(63) Continuation of application No. 09/558,210, filed on
`Apr. 26, 2000, now abandoned, which is a continua-
`tion-in-part of application No. 09/504 783 filed on
`Feb 15 2000 now Pat No 6 502 13,5 vsihich is a
`..
`’
`.
`.’
`i
`..
`’.
`’
`’
`continuation-in-part of application No. 09/429,643,
`filed on Oct 29 1999 110W Pat No 7 010 604
`'
`'
`‘
`’
`’
`’
`’
`’
`’
`'
`‘
`’
`’
`Provisional application No. 60/137,704, filed on Jun.
`7, 1999, provisional application No. 60/106,261, filed
`on Oct. 303 1998.
`
`(60)
`
`(51)
`
`Int. Cl.
`(2006.01)
`G06F 15/173
`(52) US. Cl.
`...................................................... 709/226
`
`(56)
`
`References Cited
`
`US PATENT DOCUMENTS
`4,933,846 A
`6/1990 Humphrey et a1.
`4,988,990 A
`1/1991 Warrior
`5,164,988 A
`11/1992 Matyas et 21.
`3,276,735 A
`“1994 3°61)?“ 6t al~
`5,311,593 A
`5/1994 Carmi
`
`(Continued)
`FOREIGN PATENT DOCUMENTS
`
`DE
`
`199 24 57 5
`
`12/1999
`
`(Continued)
`OTHER PUBLICATIONS
`
`Laurie Wells (Lancasterbibelmail MSN Com); “Subject: Security
`Icon” Usenet Newsgroup, Oct. 19, 1998, XP002200606.
`
`(Continued)
`Primary ExamineriKrisna 1 ,im
`(74) Attorney, Agent, or FirmiMcDermott Will & Emery,
`LLP
`
`(57)
`
`ABSTRACT
`.
`.
`.
`A secure domain name serv1ce for a computer network is
`disclosed that includes aportal connected to a computer net-
`work, such as the Internet, and a domain name database
`comiected to the computer network through the portal. The
`portal authenticates a query for a secure computer network
`address, and the domain name database stores secure com-
`
`puter network addresses for the computer network. Each
`secure computer network address is based on a non-standard
`top-level domain name, such as .scom,
`.sorg,
`.snet,
`.snet,
`.sedu, .smil and .sint.
`
`60 Claims, 40 Drawing Sheets
`
`ORIGINATING
`TERMINAL
`
`
`
`
`m
`
`
`IP PACKET
`
`
`1P ROUTER
`
`
`
`
`[P ROUTER
`18
`
`
`
`
`
`
`
`
`
`
`DESTIM'I'ION
`
`
`“it“
`
`
`
`New Bay Capital, LLC
`Ex. 1001-Page 1 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 1 of 73
`
`

`

`US 7,418,504 132
`
`Page 2
`
`U.S. PATENT DOCUMENTS
`
`5,329,521 A
`5,341,426 A
`5,367,643 A
`5,559,383 A
`5,561,669 A
`5,538,060 A
`5525526 A
`5,654,695 A
`5,632,480 A
`5,689,566 A
`5,740,375 A
`5,774,660 A
`5,737,173 A
`5,790,548 A
`5796942 A
`5,805,801 A
`5,842,040 A
`5,845,091 A
`5367650 A
`5,870,610 A
`5,878,231 A
`5392903 A
`5,898,830 A
`5,905,859 A
`5,918,019 A
`5,996,016 A
`6,006,259 A
`6,006,272 A
`6,016,318 A
`6,016,512 A
`6,041,342 A
`6,052,788 A
`6,055,574 A
`6,061,736 A
`6,079,020 A
`6,092,200 A
`6,101,182 A
`6.119.171 A
`6,119,234 A
`6,147,976 A
`6,157,957 A
`6,158,011 A
`6,168,409 B1
`6,175,867 B1
`6,178,409 B1
`6,178,505 B1
`6,179,102 B1
`6,222,842 B 1
`6,226,751 B1
`6.233.618 B1
`6,243,360 B1
`6,243,749 B1
`5,243,754 B1
`6,256,671 B1
`6,263,445 B1
`6,236,047 Bl
`6,301,223 B1
`6,308,274 B1
`6,311,207 B1
`6,324,161 B1
`6,330,562 B1
`6,332,158 B1
`6,353,614 B1
`6,425,003 B1
`5,430,155 Bl
`6,430,610 B1
`3487.598 Bl
`6,502,135 B1
`6,505,232 B1
`6,510,154 B1
`6,549,516 B1
`
`7/1994 Walsh 6191
`8/1994 Barneyet a1.
`11/1994 Chg-1186181
`949% Williams
`10/1996 Lenneyeta1~
`12/1996 AZiZ
`4/ 1997 Umekita
`8/1997 OanWich ct a1.
`10/ 1997 Nakagawa
`11/1997 Nguyen
`4/1998 Dunne etal
`6/1998 13161161616131
`7/1998 Arnold
`8/1998 Sismnizadeh et a1.
`8/1998 Esbensen
`9/1998 Holloway et a1.
`11/1998 Hughes 61211.
`12/1998 Dunne et al~
`2/ 1999 08161912111
`2/1999 Beyda eta1~
`3/1999 Baehr et al.
`4/1999 Klaus
`4/1999 W'esinger, Jr et a1.
`5/1999 Holloway et a1.
`6/1999 Valencia
`11/1999 Thalheimer et a1.
`12/1999 Adelman et a1.
`12/1999 Aravamudan et al.
`1/2000 Tomoike
`1/2000 Huitema
`3/2000 Yamaguchi
`4/2000 W'esinger, Jr. et a1.
`4/2000 Slnorodinsky et a1.
`5/2000 Rochberger et a1.
`6/2000 Liu
`7/2000 Muniyappa et al.
`8/2000 Sismnizadeh et a1.
`9/2000 Alkhatib
`9/2000 Aziz ct a1.
`11/2000 Shand et a1.
`12/2000 Berlhaud
`12/2000 Chen et a1.
`1/2001 Fare
`1/2001 Taghadoss
`1/2001 Weber et a1.
`1/2001 Schneider et a1.
`1/2001 Weber et 31.
`21/2001
`Sasyan et a1.
`5/2001 Arrow et 31.
`5/2001 Shannon
`6/2001 Basilico
`6/2001 Sitaraman et 31.
`6/2001 Guerin et a1.
`7/2001 Strentzsch et a1.
`7/2001 Blumenau
`9/2001 Ramanathan et a1.
`10/2001 Hrastar et 31,
`10/2001 Swift
`10/2001 Mighdoll et al.
`11/2001 Kirch
`12/2001 Boden et al.
`12/2001 Risley et a1.
`3/2002 Borclla ct 31.
`7/2002 Herzog et al.
`8/2002 Davie Ct 31.
`8/2002 Carter
`11/2002 V31611013
`12/2002 Munger et al.
`1/2003 Mighdoll et al.
`1/2003 Mayes et a1.
`4/2003 Albert et al.
`
`6,557,037 B1
`6,571,296 B1
`6,571,338 B1
`6,581,166 B1
`6,606,708 B1
`6,618,761 B2
`6,671,702 B2
`6,687,551 B2
`6,714,970 B1
`6,717,949 B1
`6,751,738 B2
`6,760,766 B1
`6,826,616 B2
`6,839,759 B2
`7,010,604 B1
`7,133,930 B2
`7,188,180 B2
`7,197,563 B2
`2002/0004898 A1
`2003/0196122 A1
`2005/0055306 A1
`2006/0059337 A1
`
`4/2 03 P1‘0vi110 ...................... 709/227
`5/2 03 Dillon
`5/2 03 Shaio et a1.
`6/2 03 Hirstetal.
`8/2 03 Devine et a1.
`9/2 03 Mungcr ct a1.
`12/2 03 Kruglikov etal.
`2/2 04 Steindl
`3/2 04 Fiveash et a1,
`4/2 04 Boden et a1.
`6/2 04 Wesinger, Jr. et a1.
`7/2 04 Sahquist
`11/2 04 Larson et a1.
`1/2 05 Larson etal.
`3/2 06 Munger et a1.
`11/2 06 Munger et al.
`3/2 07 Larson et a1.
`3/2 07 Shcymov ct a1.
`1/2 02 Droge
`10/2 03 Wesinger, Jr. et a1.
`3/2 05 Miller et a1.
`3/2 06 Polyhonen et a1.
`
`
`
`FOREIGN PATENT DOCUMENTS
`
`DE
`EP
`EP
`EP
`EP
`EP
`EP
`EP
`GB
`GB
`GB
`W0
`W0
`W0
`W0
`W0
`W0
`W0
`W0
`W0
`
`199 24 575 A1
`0 814 589
`0 814 589 A
`0 838 930
`0 838 930 A
`0 838 930 A2
`836306 A1
`0 858 189
`2 317 792
`2 317 792 A
`2 334 181 A
`9827783 A
`WO 98/27783
`W0 98 55930
`W0 98 59470
`W0 99 38081
`W0 99 48303
`WO 00/17775
`WO 00/70458
`W0 01 50688
`
`12/1999
`12/1997
`12/1997
`4/1998
`4/1998
`4/1998
`4/1998
`8/1998
`4/1998
`4/1998
`8/1999
`6/1998
`6/1998
`12/1998
`12/1998
`7/1999
`9/1999
`3/2000
`11/2000
`7/2001
`
`OTHER PUBLICATIONS
`
`Davila J et a1, “Implementatin of Virtual Private Networks at the
`Transport Layer”, Information Security, Second International Work—
`shop, ISW’99. Proceedings (Lecture Springer-Verlag Berlin, Ger-
`many,
`[Online] 1999, pp. 85-102, XP002399276, ISBN 3-540-
`66695-B, retrieved from the Internet: URL: http://wwwspringerlink.
`com/content/4uac0tbOheccmaS9/fu11text.pdf>(Aberact).
`Donald E. Eastlake. 111, “Domain Name System Security Exten-
`sionS”. Internet DrafiaApr. 1998'
`P. Srisuresh, et 211., “DNS Extensions to Network Address Transla-
`tors”, Internet Draft, Jul. 1998.
`DB. Chapman, et 31., “Building Internet Firewalls, chapters 8 and 10
`(parts)”,pp. 278-296 andpp.351—375.
`Search Report (dated Jun. 18, 2002), International Application No.
`PCT/USOl/13260.
`Search Report (dated Jun. 28, 2002), International Application No.
`PCT/USOl/1326l.
`Donald E. Eastlake, “Domain Name System Security Extensions”,
`DNS Security Working Group. Apr. 1998, 51 pages.
`D. B. Chapman et a1., “Building Internet Firewalls“. Nov. 1995, pp.
`273.297 andpp.351—375.
`P.Srisuresheta1.,“DNS extensionsto NetworkAddress Translators”,
`Jul. 1998,27 pages.
`Laurie Wells, “Security Icon”, Oct. 19, 1998, 1 page.
`W. Stallings, “Cryptography And Network Security”, 2“d Edition,
`Chapter 13, IP Security, Jun. 8. 1998, pp. 399-440.
`
`New Bay Capital, LLC
`Ex. 1001-Page 2 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 2 of 73
`
`

`

`US 7,418,504 132
`
`Page 3
`
`W. Stallings, “New Cryptography and Network Security Book”, Jun.
`8, 1998, 3 pages.
`Fasbender,Kesdogan, and Kubitz: “Variable and Scalable Security:
`Protection of Location Information in Mobile IP”, IEEE publication.
`1996, pp. 963-967.
`Linux FreeS/WAN Index File, printed from http://libertyfreeswan.
`org/freeswan, trees/freeswan-13/d0c/ on Feb. 21, 2002, 3 Pages.
`J. Gilmore, “Swan. Securing the Internet against Wiretapping”.
`printed from http://liberty.freeswan.org/freeswan, trees/freeswan-
`1.3/d0c/rati0nale.html on Feb. 21, 2002, 4 pages.
`Glossary for the Linux FreeS/WAN project, printed from http://
`1iberty.freeswan.org/freeswan
`trees/freeswan—l .3/doc/g10ssary.
`htrnl on Feb. 21, 2002, 25 pages.
`Alan 0. Frier et al., “The SSL Protocol Version 3.0”, Nov. 18, 1996,
`printed fromhttp://www.netseape.com/eng/ss13/draft302.lxton Feb.
`4,2002, 56 pages.
`Search Report (dated Aug. 20, 2002), International Application No.
`PCT/US01/04340.
`Search Report (dated Aug. 23, 2002), International Application No.
`PCT/US01/13260.
`Shree Murthy et al., “Congestion-Oriented Shortest Multipath Rout-
`ing”, Proceedings of IEEE INFOCOM, 1996, pp. 1028-1036.
`Jim Jones et al., “Distributed Denial of Service Attacks: Defenses”.
`Global Integrity Corporation. 2000. pp. 1-14.
`James E. Bellaire, “New Statement of RulesiNaming Internet
`Domains”, Internet Newsgroup, Jul 30, 1995, 1 page.
`D. Clark, “US Calls for Private Domain-Name System”, Computer.
`IEEE Computer Society, Aug. 1. 1998, pp. 22-25.
`August Bequai, “Balancing Legal Concerns Over Crime and Security
`in Cyberspace”, Computer & Security, vol. 17, No. 4, 1998, pp.
`293 -298.
`Rich Winkel, “CAQ: Networkinig W'ith Spooks: The NET & The
`Control Of Information”, Internet Newsgroup, Jun. 21, 1997, 4
`pages.
`
`Search Report (dated Oct. 7. 2002), International Application No.
`PCT/USOI/13261.
`
`F. Halsall, “Data Communications, Computer Networks And Open
`Systems“. Chapter 4, Protocol Basics, 1996, pp. 198-203.
`Reiter. Michael K. and Rubin. Aviel D. (AT&T LabsiResearch),
`“Crowds: Anonymity for Web Transmissoins”, pp. 1—23.
`Dolev, Shlomi and Ostrovsky, Rafil, “Efficient Anonymous Multicast
`and Reception”(Extended Abstract), 16 pages.
`Rubin, Aviel D., Greer, Daniel, and Ranum, Marcus J. (Wiley Com-
`puter Publishing), “Web Security Sourcebook”, pp. 82—94.
`Fasbender, Kesdogan, and Kubitz: “Variable and Scalable Security”
`Protection of Location Information in Mobile IP. IEEE publication.
`1996, pp. 963-967.
`Eastlake, D. E., “Domain Name System Security Extensions”,
`Internet Draft, Apr. 1998, XP002199931, Sections 1, 2.3 and 2.4.
`RFC 2401 (dated Nov. 1998) Security Architecture for the Internet
`Protocol (RTP).
`RFC 2543—SIP (dated Mar. 1999): Session Initiation Protocol (SIP or
`SIPS).
`Search Report, IPER (dataed 1\0V. 13, 2002), International Applica-
`tion No. PCT/USOl/O4340.
`
`Search Report, IPER (dated Feb. 6, 2002), International Application
`No. PCT/US01/13261.
`Search Report, IPER (dated Jan. 14, 2003), International Application
`No. PC"/US01/13260.
`
`
`
`Shankur, A.U. “A verified sliding window protocol with variable flow
`control”. Proceedings of ACM SIGCOMM conference on Commu-
`nications architectures & protocols. pp. 84-91, ACM Press, NY, NY
`1986.
`
`W. Stallings, “Crytography and Network Security”, 2nd, Edition,
`Chapter 13, IP Security, Jun. 8. 1998, pp. 399-440.
`
`New Bay Capital, LLC
`Ex. 1001-Page 3 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 3 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 1 of 40
`
`US 7,418,504 B2
`
`
`
`ORIGINATING
`TERMINAL
`
`
`m
`
`
`
`|P PACKET
`
`INTERNET
`
`E
`
`25
`
`
`
`
`
`
`DESTINATION
`TERMINAL
`110
`
`FIG. 1
`
`New Bay Capital, LLC
`Ex. 1001-Page 4 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 4 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 2 of 40
`
`US 7,418,504 B2
`
` TARP
`
`TERMINAL
`
`
`m
`
`140
`
`TARP PACKET
`
`
`
`TARP
`
`
`146
`ROUTER
`
`
`LINK KEY
`122
`
`
`
`
`lP ROUTER
`
`m
`
`in
`
`
`
`
`
`
`
`
`
`
`
`TARP
`
`ROUTER
`124
`
`INTERNET
`
`fl
`
`
`
`
`lP ROUTER
`fl
`
`TARP
`R01U2T5ER
`
`
` TARP
`TERMINAL
`
`110
`
`FIG. 2
`
`New Bay Capital, LLC
`Ex. 1001-Page 5 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 5 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 3 of 40
`
`US 7,418,504 B2
`
`207b
`2073
`207s
`207d
`' ° '
`
`‘~
`
`fl—_—IEE__-
`\300 DATA STREAM
`
`
`
`‘\ 320 INTERLEAVED
`PAYLOAD DATA
`
`EWINDOW
`
`'- -- \ 330 SESSION-KEY—ENCRYPTED
`. B -
`PAYLOAD DATA
`
`\340 TARP PACKET WITH
`ENCRYPTED PAYLOADS
`
`\350 LlNK—KEY—ENCRYPTED
`TARP PACKETS
`
`'7'-
`
`\360 IP PACKETS WI
`ENCRYPTED TARP
`PACKETS AS PAYLOAD
`
`
`
`
`
`
`
`TARP
`ROUTER 7
`
`TARP
`DESTINATION
`
`
`
`FIG. 3A
`
`New Bay Capital, LLC
`Ex. 1001-Page 6 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 6 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 4 of 40
`
`US 7,418,504 B2
`
`207C
`
`207d
`
`- - o
`
`/300 DATA STREAM
`
`
`
`207b
`207a
`A;
`fl_fl_fl-__- ' ° '
`
`
`
`DUMMY
`
`BLOCKS
`
`OR DATA
`MAY BE
`ADDED
`
`35 \523 ENCRYPTED BLOCK
`DlVIDED INTO PAYLOADS
`INTERLEAVED
`
`517
`
` \523 ENCRYPTED BLOCK
`
`DIVIDED INTO PAYLOADS
`INTERLEAVED
`
` \340TARP PACKETS WITH
`ENCRYPTED PAYLOADS
`
`New Bay Capital, LLC
`Ex. 1001-Page 7 of 73
`
`\5203LOCK-ENCRYPTEO
`(SESSION-KEY) PAYLOAD
`SEQUENCE
`\522ENCRYPTEO BLOCK
`DIVIDED INTO PAYLOADS
`
`5
`
`”‘3
`
`
`
`
`
`
`
`
`
` '
`
`New Bay Capital, LLC
`Ex. 1001-Page 7 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 5 of 40
`
`US 7,418,504 B2
`
`TARP TRANSCEIVER
`fl
`
`NETWORK (IP) LAYER
`
`410 ONE ALTERNATIVE T0
`
`COMBINE
`TARP PROCESSING
`WITH OIS IP
`PROCESSOR
`
`OTHERALTERNATIVE
`TO COMBINE
`TARP PROCESSING
`WITH D.L. PROCESSOR
`(e.g., BURN INTO BOARD
`PRONI
`
`TARP LAYER
`
`DATA LINK LAYER
`
`FIG. 4
`
`450
`DATALINK
`PROTOCOL WRAPPER
`
`New Bay Capital, LLC
`Ex. 1001-Page 8 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 8 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 6 of 40
`
`US 7,418,504 B2
`
`BACKGROUND LOOP - DECOY
`GENERATION
`
`SD
`
`AUTHENTICATE TARP
`PACKET
`
`OUTER LAYER DECRYPTION
`OF TARP PACKET USING
`LINK KEY
`
`$2
`
`33
`
`S4
`
`DUMP DECOY
`
`
`
`
`
`
`
`CHECK FOR DECOY AND
`INCREMENT PERISHABLE
`DECOY COUNTER AS
`APPROPRIATE
`
`
`TRANSMIT DECOY?
`
`YES
`
`NO
`
`DECREMENT
`TTL1TL> 0?
`
`39
`
`YES
`
`85
`
`$7
`
`DETERMINE DESTINATION
`TARPADDRESSAND STORE
`LINK KEYAND IPADDRESS
`
`GENERATENEXT-HOP TARP
`ADDRESSAND STORE LINK
`KEYANDIPADDRESS
`
`38
`
`GENERATE NEXT-HOP TARP
`ADDRESS AND STDRE LINK
`KEYANDIPADDRESS
`
`GENERATE lP HEADER
`AND TRANSMIT
`
`S10
`
`S11
`
`FIG. 5
`
`New Bay Capital, LLC
`Ex. 1001-Page 9 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 9 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 7 0f 40
`
`US 7,418,504 B2
`
`BACKGROUND LOOP - DECOY
`GENERATION
`
`S20
`
`GROUP RECEIVED IP PACKETS
`INTO INTERLEAVE WINDOW
`
`DETERMINE DESTINATION TARP
`ADDRESS, INITIALIZE TTL, STORE
`IN TARP HEADER
`
`RECORD WINDOW SEQ. NOS. AND
`INTERLEAVE SEQ. NOS. IN TARP
`HEADERS
`
`
`
`CHOOSE FIRST HOP TARP
`ROUTER, LOOK UP IP ADDRESS
`AND STORE IN CLEAR IP HEADER,
`OUTER LAYER ENCRYPT
`
`INSTALL CLEAR IP HEADER AND
`TRANSMIT
`
`821
`
`822
`
`823
`
`824
`
`825
`
`FIG. 6
`
`New Bay Capital, LLC
`Ex. 1001-Page 10 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 10 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 8 0f 40
`
`US 7,418,504 B2
`
`BACKGROUND LOOP - DECOY
`
`GENERATION
`
`AUTHENTICATE TARP PACKET
`
`RECEIVED
`
`DECRYPT OUTER LAYER
`ENCRYPTION WITH LINK KEY
`
`INCREMENT PERISHABLE
`COUNTER |F DECOY
`
`
`
`THROW AWAY DECOY OR KEEP
`IN RESPONSE TO ALGORITHM
`
`CACHE TARP PACKETS UNTIL
`
`WINDOW IS ASSEMBLED
`
`DEINTERLEAVE PACKETS
`
`FORMING WINDOW
`
`DECRYPT BLOCK
`
`DIVIDE BLOCK INTO PACKETS
`USING WINDOW SEQUENCE
`DATA, ADD CLEAR IP HEADERS
`GENERATED FROM TARP
`
`HEADERS
`
`S49
`
`HAND COMPLETED IP PACKETS
`TO IP LAYER PROCESS
`
`S50
`
`S40
`
`S42
`
`S43
`
`S44
`
`S45
`
`S46
`
`S47
`
`S48
`
`FIG. 7
`
`New Bay Capital, LLC
`Ex. 1001-Page 11 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 11 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 9 of 40
`
`US 7,418,504 B2
`
`TEEAEINLL
`801
`
`SSYN
`PAgfiET
`
`SSYNACK
`PACKET
`822
`
`SSYNACK
`ACK PACKET
`823
`
`m
`
`TARP
`ROUTER
`
`825
`SECURE SESSION
`INITIATIONACK
`
`824
`SECURE SESSION
`INITIATION
`
`FIG. 8
`
`New Bay Capital, LLC
`Ex. 1001-Page 12 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 12 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 10 of 40
`
`US 7,418,504 B2
`
`CLIENT1 A TARP
`
`ROUTER
`
`RECEIVE TABLE
`TRANSMIT TABLE
`924
`921
`—\.___ ___\__—
`
`131.218.204.98
`131.218.204.221
`131.218.204.139
`131.218.204.12
`
`-
`-
`.
`.
`
`131.218.204.85
`131.218.204.97
`131.218.204.188
`131.218.204.55
`
`131.218.204.98
`131.218.204.221
`131.218.204.139
`131.218.204.12
`
`.
`.
`.
`.
`
`131.218.204.85
`131.218.204.97
`131.218.204.188
`131.218.204.55
`
`RECEIVE TABLE
`TRANSMIT TABLE
`922
`923
`___A__ ___\__—
`
`131.218.204.181
`131.218.204.88
`131.218.204.201
`131.218.204.119
`
`-
`.
`.
`-
`
`131.218.204.89
`131.218.204.212
`131.218.204.127
`131.218.204.49
`
`131.218.204.181
`131.218.204.88
`131.218.204.201
`131.218.204.119
`
`.
`.
`.
`.
`
`131.218.204.89
`131.218.204.212
`131.218.204.127
`131.218.204.49
`
`New Bay Capital, LLC
`Ex. 1001-Page 13 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 13 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 11 of 40
`
`US 7,418,504 B2
`
`
`
` lSPA
`TARP
`
`ROUTER
`1021
`
`
`
`
`
`
` ISPB
`TARP
`
`ROUTER
`
`CUENT
`10m
`
`
`
`10H
`
`1012
`
`
` ISPC
`
`TARP
`ROUTER
`
`
`
`1013
`
`FIG. 10
`
`New Bay Capital, LLC
`Ex. 1001-Page 14 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 14 of 73
`
`

`

`U.S. Patent
`
`mMn
`
`2B405,814,7SU
`
`$958wmgfifmé:
`<8:m:«$192
`mE2:2:25%Mmmmm,a”wagea.55
` R“9m:émowaE_3”wwmmogn:9meS”mwmmog5:Exam
`
`
`<3:
`
`<3:
`
`m3:
`
`m3:
`
`<8:
`
`3.:
`
`08:
`
`/
`
`8:
`
`
`
`
`
`E05:ms_<~_n_Ezmmzm
`
`mm”mmmmog‘>>Iammo8Hwwmmag>>I
`
`.omm
`
`8:
`
`
`
`$05:mszEEzmmzm
`
`55%n__8”wmmmogE:meo8“mmmmog>>:95
`mmofiz
`
`m$232;2:
`
`
`
`e:523:;
`
`:.OE
`
`<8:2”mama:g5mb
`
`
`
`
`Mmmx2”em:22852“mama:.53
`
`EEG:555n:
`
`NENuo<o._><n_
`
`Nn:
`
`New Bay Capital, LLC
`Ex 1001-Page 15 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 15 of 73
`
`
`
`
`
`
`
`
`
`
`

`

`U.S. Patent
`
`g
`
`hS
`
`0
`
`7SU
`
`5,8
`
`2
`
`BIM<3OE
`
`
`mEw.03:01::SLEOIE52%:3:0:
`2,$3$2.%GENE
`M5N
`figEggIE%%IIIfigmEla!
`5%£2x8:x8:m20:52“:7.952%
`
`mcs25mgas
`asfigfig?WEE
`
`
`No2Sfi
`
`New Bay Capital, LLC
`Ex. 1001-Page 16 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 16 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 14 of 40
`
`US 7,418,504 B2
`
`MODE
`OR
`
`1. PROMISCUOUS
`
`2. PROMISCUOUS
`PER VPN
`
`
`
`3. HARDWARE
`HOPPING
`
`EMBODIMENT
`
`
`
`
`HARDWARE
`
`ADDRESSES - VALUES
`
`IF ADDRESSES
`
`DISCRIMINATOR FIELD
`
`SAME FOR ALL NODES
`OR wngh/TIELY
`
`CAN BEVARIED
`IN SYNC
`
`F'XEDFOREACHVPN
`
`
`
`CAN BE VARIED
`IN SYNC
`
`CAN BE VARIED
`|N SYNC
`
`CAN BE VARIED
`|N SYNC
`
`CANBEVARIED
`IN SYNC
`
`CAN BE VARIED
`|N SYNC
`
`CAN BE VARIED
`IN SYNC
`
`
`
`
`
`
`
`
`
`
`
`
`New Bay Capital, LLC
`Ex. 1001-Page 17 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 17 of 73
`
`

`

`U.S. Patent
`
`m6A
`
`0umMmm,
`
`0
`
`7
`
`2BM
`
`vow?
`
`mp2mjo
`
`mon_Non?
`
`won,
`
`<H2mso
`
`m:2
`
`Egg
`
`
`
`mmmoommmm>
`
`m02
`
`
`
`0.”,9%A9:85
`
`
`
`m_‘.QE
`
`.o;<ozm
`
`or”,
`
`NomF
`
`>mxgz:
`
`ompm>mozm
`
`o<o4><m
`
`m3;025
`
`
`
`2058“.52:
`
`
`
`Hm>momoI9won?
`
`mmmmoo<momzowm_
`
`mammoo<.pmmom_
`
`was,2%
`
`2958253
`
`meme
`
`come
`
`New Bay Capital, LLC
`Ex 1001-Page 18 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 18 of 73
`
`
`
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 16 of 40
`
`US 7,418,504 B2
`
`CURRENT |P PAIR ‘~~-
`
`|P PAIR 1
`IP PA|R2
`
`WINDOW
`
`|P PAIR 1
`
`IP PAIR2
`O
`0
`0
`
`IP PAIR W
`ckpt_o
`
`RECEIVER
`
`SENDER'S ISP
`
`CURRENT |P PAIR
`
`ckpt_o
`
`TRANSMITTER
`
`RECIPIENT'S ISP
`
`
`
`KEPT |N SYNC FOR SENDER T0 RECIPIENT SYNCHRONIZER 4 ----------------------- >
`
`KEPT IN SYNC FOR RECIPIENT TO SENDER SYNCHRONIZER <———>
`
`FIG. 14
`
`New Bay Capital, LLC
`Ex. 1001-Page 19 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 19 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 17 of 40
`
`US 7,418,504 B2
`
`SYNC_REQ
`
`@
`
`@ WHEN SYNCHRONIZATION
`BEGINS TRANSMIT (RETRANSMIT
`PERIODICALLY UNTIL ACKed)
`SYNC REQUSINGNEW
`TRANSMITTER CHECKPOINT IP
`
`cI(pI_n IN TRANSMITTER
`
`NEW RECEIVER RESPONSE
`CHECKPOINT Ckpt_r
`
`#
`
`# WHEN SYNC_ACK
`ARRIVES WITH INCOMING
`HEADER = ckpt [I
`GENERATE NEW
`CHECKPOINT lP PAIR
`
`1W
`
`,,
`
`W
`
`]
`
`WYI’SEflcm-GREEA‘E’E’E‘QES
`oUPDATEWINDOW
`
`—'
`°GENERATE NEW
`CHECKPOINT IP PAIR
`cka n IN RECEIVER
`-GENERATE NEW
`CHECKPOINT IP PAIR
`ckar IN TRANSMITTER
`°TRANSMIT SYNC_ACK
`USING NEW CHECKPOINT
`IP PAIR ckpt_r
`
`FIG. 15
`
`New Bay Capital, LLC
`Ex. 1001-Page 20 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 20 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 18 of 40
`
`US 7,418,504 B2
`
`
`
`New Bay Capital, LLC
`Ex. 1001-Page 21 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 21 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 19 of 40
`
`US 7,418,504 B2
`
`WlNDOW_S|ZE
`
`WlNDOW_S|ZE
`
`VIII/I’ll,”
`
`O
`
`VIII/IIIIIIA
`Will/”I’ll
`Wllllllllll.
`mull/[Ill
`VII/IIIIIIIA
`
`O
`
`
`VIII/[I’lllfl
`VIII/IIIIIIJ
`Vllll’lllllllA
`
`
`VII/IIIIIIIIA
`
`
`
`
`000 —
`
`
`
`
`
`I INACTIVE
`a ACTIVE
`E USED
`
`New Bay Capital, LLC
`Ex. 1001-Page 22 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 22 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 20 of 40
`
`US 7,418,504 B2
`
`C
`
`_V
`
`III/”I’m
`C
`
`VIII/[IIIIIA
`VIIIIIIIIIIIA
`VIII/[Illlll
`VII/[IIIIIIA
`Vllllllllll’l
`C
`
`I INACTlVE
`a ACTIVE
`
`3 USED
`
`New Bay Capital, LLC
`Ex. 1001-Page 23 of 73
`
`000
`
`WINDOW_S|ZE
`
`WINDOW_S|ZE
`
`New Bay Capital, LLC
`Ex. 1001-Page 23 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 21 0f 40
`
`US 7,418,504 B2
`
`VIIIIIIIIIII‘
`
`C C
`
`VIII/I’ll'lll
`”III/ll”
`’Illlllllllfl
`
`O
`
`”I’ll/[Illa
`VIII/IIIIIIA
`WII’IIIIIIIA
`VII/IIIIIIIA
`”II/Ill“
`
`
`
`H E 0
`
`|NACT|VE
`
`ACTIVE
`
`USED
`
`00
`
`
`
`VIII/1111114
`
`FIG. 19
`
`New Bay Capital, LLC
`Ex. 1001-Page 24 of 73
`
`000
`
`WINDOW_SIZE
`
`WINDOW_S|ZE
`
`New Bay Capital, LLC
`Ex. 1001-Page 24 of 73
`
`

`

`U.S. Patent
`
`Aug. 26, 2008
`
`Sheet 22 0f 40
`
`US 7,418,504 B2
`
`
` COMPUTER #2
`
`
`
`2008
`
`2005
`
`
`
` COMPUTER #1
`
`2011 FIG.20
`
`New Bay Capital, LLC
`Ex. 1001-Page 25 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 25 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 23 of 40
`
`US 7,418,504 B2
`
`ADTABLE
`|P1
`1P2
`
`IP3
`
`1P4
`
`AE—ABLE
`
`_DTABLE
`
`2101
`
`2102
`
`2103
`
`
`
`
`- 2104
`
`
`
`
`
`
`_ETABLE
`
`LINKDOWN >I‘
`
`2105
`
`BFTABLE
`
`2100/
`
`CDTABLE
`- 2107
`
`CETABLE
`
`CFTABLE
`
`- 2109
`
`New Bay Capital, LLC
`Ex. 1001-Page 26 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 26 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 24 of 40
`
`US 7,418,504 B2
`
`MEASURE
`QUALITY OF
`TRANSMISSION
`PATH X
`
`
`
`
`
`
`
`
`
`
`
`MORE THAN
`
`ONE TRANSMITTER
`TURN ED ON?
`
`
`
`
`
`SET WEIGHT
`
`To MIN. VALUE
`
`
`
`
`PATH X
`QUALITY < THRESHOLD?
`
`
`PATH x
`
`
`WEIGHT LESS THAN
`DECREASE WEIGHT
`STEADY STATE
`FORPATHX
`
`VALUE?
`
`
`
`
`
`
`2203
`
`
`
`INCREASE
`
`WEIGHT FOR PATH X
`
`TOWARD STEADY
`STATE VALUE
`
`
`
`
`ADJUST WEIGHTS
`FOR REMAINING
`PATHS SO THAT
`WEIGHTS EQUAL ONE
`2206
`
`
`
`
`
`FIG. 22A
`
`New Bay Capital, LLC
`Ex. 1001-Page 27 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 27 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 25 of 40
`
`US 7,418,504 B2
`
`(EVENT) TRANSMITTER
`FOR PATH x
`TURNS OFF
`
`
`
`
`2210
`
`
`AT LEAST
`
`ONE TRANSMITTER
`
`
`TURNED ON?
`
`
`
`
`DROP ALL PACKETS
`UNTIL ATRANSMITTER
`
`TURNS ON
`
`SET WEIGHT
`T0 ZERO
`
`
`
`ADJUST WEIGHTS
`FOR REMAINING PATHS
`SO THAT WEIGHTS
`EQUAL ONE
`
`FIG. 228
`
`New Bay Capital, LLC
`Ex. 1001-Page 28 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 28 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 26 of 40
`
`US 7,418,504 B2
`
`
`
`2308
`\
`
`TRANSMIT TABLE
`2302
`
`
`
`PACKET
`
`TRANSMITTER
`
`
`PATH X1
`
`
`
`
`
`W(X1) =02
`PACKET
`
`RECEIVER
`W(X2)=0.1
`
`
`
`w (x3) = 0.6
`
`w (x4) = 0.1
`
`PATH X4
`
`'w
`
`2301
`
`
`
`
`
`
`LINK QUALITY
`MEASUREMENT
`FUNCTION
`
`
`WEIGHT
`
`ADJUSTMENT
`FUNCTION
`
`
`
`
`
`FIG. 23
`
`New Bay Capital, LLC
`Ex. 1001-Page 29 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 29 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 27 of 40
`
`US 7,418,504 B2
`
`2403
`
`E
`
`
`
`
`COMPUTER
`
`9 25Mb/s MESST=8
`
`FIG. 24
`
`2404
`
`2402
`
`
`
`100Mbls MESST=32 9
`
`
`
`
`COMPUTER
`
`New Bay Capital, LLC
`Ex. 1001-Page 30 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 30 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 28 of 40
`
`US 7,418,504 B2
`
`2502
`
`2504
`
`, WEB
`BROWSER
`
`
`
`
`DNS REQ
`
`DNS RESP
`
`PAGE REQ
`
`
`
`TARGET
`
`WEB SITE PAGE RESP
`
`
`FIG. 25
`(PRIOR ART)
`
`New Bay Capital, LLC
`Ex. 1001-Page 31 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 31 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 29 of 40
`
`US 7,418,504 B2
`
`WEB
`BROWSER
`
`
`GATE KEEPER
`
`HOPPING
`
`RULES
`
`2503
`
`2602
`
`
`HOPPING
`
`SECURE
`TARGET
`SITE
`
`
`
`
`UNSECURE
`TARGET
`SITE
`
`2611
`
`FIG. 26
`
`New Bay Capital, LLC
`Ex. 1001-Page 32 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 32 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 30 of 40
`
`US 7,418,504 B2
`
`
` RECEIVE
`
`DNS REQUEST
`FOR TARGET SITE
`
`2701
`
`
`
`
`
`
`PASS THRU
`ACCESS TO
`
`
`REQUEST TO
`SECURE SITE
`
`
`
`DNS SERVER
`REQUESTED?
`
`
`
`
`
`
`
`
`
`
`
`
`
`RETURN
`USER
`
`"HOST UNKNOWN"
`AUTHORIZED TO
`
`ERROR
`CONNECT?
`
`
`2705
`
`
`
`ESTABLISH
`VPN WITH
`TARGETSITE
`
`
`FIG. 27
`
`New Bay Capital, LLC
`Ex. 1001-Page 33 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 33 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 31 of 40
`
`US 7,418,504 B2
`
`2802
`
`2803
`
`2801
`
`HOST
`COMPUTER#1
`
`
`
`
`
`
`
`
`EDGE
`ROUTER
`
`2804
`
`HOST
`COMPUTER#2
`
`2805
`
`WGHBW
`
`FIG. 28
`
`New Bay Capital, LLC
`Ex. 1001-Page 34 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 34 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 32 of 40
`
`US 7,418,504 B2
`
`
`
`HOST COMPUTER #1
`
`
`2901
`
`RX
`
`
`
`L, HOST COMPUTER #2
`
`RX
`
`TX
`
`IP TX
`100-200
`
`HIGH BW
`
`2902
`
`
` 2912 2913
`
`4'
`
`FLOODIP
`TX100-200
`
`2903
`
`
`HACKER
`COMPUTER
`
`
`
`FIG. 29
`
`New Bay Capital, LLC
`Ex. 1001-Page 35 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 35 of 73
`
`

`

`U.S. Patent
`
`Aug. 26
`
`$
`
`2008
`
`Sheet 33 0f 40
`
`US 7,418,504 B2
`
`380%
`
`22.03EE0
`
`mEEmzmw
`
`emmloz>m
`
`59:5
`
`9285
`
`x850%E
`
`om.GE
`
`mm>momm
`
`mmEEmz<E
`
`magma
`
`05.02%
`
`5%E550
`
`39%xx
`
`New Bay Capital, LLC
`Ex. 1001-Page 36 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 36 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 34 of 40
`
`US 7,418,504 B2
`
`M01
`
`M03
`
`
`CUENT#1
`
`
`
`
`
`
`3106
`
`
`CUENT#2
`
`TWRX
`TWRX
`TWRX
`
`
`
`
`
`3102
`
`
`
`3208
`3209
`3210
`
`
`3105
`
`HACKER
`
`FIG. 31
`
`New Bay Capital, LLC
`Ex. 1001-Page 37 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 37 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 35 of 40
`
`US 7,418,504 B2
`
`CLIENT
`\
`
`SEND DATA PACKET
`USING ckpt_n
`CKPT_0=ckpt_n
`GENERATE NEW cka_n
`(STARTTIMER, SHUTTRANSMITTER
`
`F
`
`IF CKPT_0 IN SYNC_ACK
`MATCHES TRANSMITTER'S
`
`ckpt_o
`UPDATE RECEIVER'S
`
`ckar
`KILL TIMER. TURN
`TRANSMITTER ON
`
`SEND DATA PACKET
`USING ckpt_n
`ckpt_o=ckpt_n
`GENERATE NEW ckan
`gTARTTIMER, SHUTTRANSMITTER
`
`FF
`
`WHEN TIMER EXPIRES
`TRANSMIT SYNC_REQ
`USING TRANSMITTERS
`ckao, START TIMER
`
`IF ckao IN SYNC_ACK
`MATCHES TRANSMITTER'S
`
`ckpt_o
`UPDATE RECEIVERS
`
`ckpt_r
`KILL TIMER, TURN
`TRANSMITTER 0N
`
`SERVER
`\
`
`PASS DATA UP STACK
`
`ckpt_o=ckpt_n
`GENERATE NEW ckan
`GENERATE NEW ckpt_r FOR
`TRANSMITTER SIDE
`TRANSMIT SYNC_ACK
`CONTAINING cka_o
`
`ckpt_o=ckpt_n
`GENERATE NEW ckan
`GENERATE NEW ckar FOR
`TRANSMITTER SIDE
`TRANSMIT SYNC_ACK
`CONTAINING ckpt_o
`
`
`
`SYNC—REQ
`
`FIG. 32
`
`New Bay Capital, LLC
`Ex. 1001-Page 38 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 38 of 73
`
`

`

`U.S. Patent
`
`Aug. 26, 2008
`
`Sheet 36 0f 40
`
`US 7,418,504 B2
`
`a:
`
`
`
`8mm"208.—i
`as"E8."22
`_............._~Iuu52%;:
`as‘mzoem.
`
`’7
`
`m8
`
`{JNIx82
`
`”Ema/0mm
`
`manommow
`
`252.:
`
`58
`
`88
`
`8mm
`
`an$52=922%;
`
`2mm._<Eon_
`
`gag
`
`flag
`
`8mm
`
`mzoE
`
`
`
`208210.__<_>_.m_58Eawn—mm:WEBmzom
`
`28
`
`:838
`
`283mm2%mm.®_H_
`
`New Bay Capital, LLC
`Ex. 1001-Page 39 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 39 of 73
`
`
`
`
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 37 of 40
`
`US 7,418,504 B2
`
`3400
`
`3401
`
`
`
`DISPLAY WEB PAGE
`CONTAINING GO
`SECURE HYPERLINK
`
`
`P3402
`
`YES
`
`
`
`
`
`LAUNCH LINK TO
`.COM SITE
`
`3404
`
`DOWNLOAD AND
`INSTALL PLUG-IN
`
`3405
`
`CLOSE CONNECTION
`
`3406
`
`
`
`VPN
`PLUG-IN
`LOAIDED
`
`
`
`
`
`AUTOMATIC REPLACEMENT OF TOP-LEVEL
`DOMAIN NAMEDOIIIIIIINIINSNAUERE TOP-LEVEL
`
`3407
`
`3412
`
`DISPLAY "SECURE" ICON
`
`ACCESS SECURE PORTALAND
`SECURE NETWORKAND SECURE DNS
`
`3408
`
`
` TERMINATE
`
`
`SECURE
`
`
`
`'
`
`3413
`
`“0
`
`OBTAIN SECURE COMPUTER NETWORK
`ADDRESS FOR SECURE WEB SITE
`
`ACCESS GATE KEEPER AND RECEIVE
`PARAMETERS FOR ESTABLISHING VPN
`WI” SECURE WEBS'TE
`
`3409
`
`3410
`
`YES
`REPLACE SECURETOHEVEL
`DOMAIN NAME WITH NON-SECURE
`TOP-LEVEL DOMAIN NAME
`
`3414
`
`3415
`
`DISPLAY “GO SECURE" HYPERLINK
`
`CONNECT TO SECURE WEBSITE
`USING VPN BASED ON PARAMETERS m
`ESTABLISHED BY GATE KEEPER
`34“
`
`New Bay Capital, LLC
`Ex. 1001-Page 40 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 40 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 38 of 40
`
`US 7,418,504 B2
`
`3500
`
`
`
`
`
`REQUESTOR ACCESSES WEBSITE
`AND LOGS INTO SECURE
`DOMAIN NAME REGISTRY SERVICE
`
`
`
`3501
`
`
`
`REQUESTER COMPLETES ONLINE
`REGISTRATION FORM
`
`
`
`QUERY STANDARD DOMAIN NAME
`SERVICE REGARDING OWNERSHIP
`
`
`OF EQUIVALENT NON-SECURE
`DOMAIN NAME
`
`
`RECEIVE REPLY FROM STANDARD
`DOMAIN NAME REGISTRY
`
`
`
`
`
`INFORM REQUESTOR
`OF CONFLICT
`
`3506
`
`
`
`VERIFY INFORMATION AND
`ENTER PAYMENT INFORMATION
`
`3507
`
`
`
`REGISTER SECURE DOMAIN NAME
`
`
`
`3508
`
`FIG. 35
`
`New Bay Capital, LLC
`Ex. 1001-Page 41 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 41 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 39 of 40
`
`US 7,418,504 B2
`
`
`
`
`
`WEB SERVER
`
`SERVER PROXY
`
`VPN GUARD
`
`3611
`
`
` 3610
`
`
`3600
`
`COMPUTER NETWORK
`
`3602
`
`FIREWALL
`
`3601
`
`
`
`
`
`I BROWSER I PROXYAPPLICATION I
`
`3607
`
`3606
`
`3605
`
`CLIENT COMPUTER
`
`3604
`
`FIG. 36
`
`New Bay Capital, LLC
`Ex. 1001-Page 42 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 42 of 73
`
`

`

`US. Patent
`
`Aug. 26, 2008
`
`Sheet 40 of 40
`
`US 7,418,504 B2
`
`3700
`/
`
`GENERATE MESSAGE PACKETS
`
`3701
`
`MODIFY MESSAGE PACKETS WITH PRIVATE
`CONNECTION DATA AT AN APPLICATION LAYER
`
`3702
`
`SEND TO HOST COMPUTER
`THROUGH FIREWALL
`
`RECEIVE PACKETS AND AUTHENTICATE
`AT KERNEL LAYER OF HOST COMPUTER
`
`RESPOND TO RECEIVED MESSAGE
`PACKETS AND GENERATE REPLY
`MESSAGE PACKETS
`
`MODIFY REPLY MESSAGE PACKETS WITH
`PRIVATE CONNECTION DATA AT A
`KERNEL LAYER
`
`SEND PACKETS TO CLIENT COMPUTER
`THROUGH FIREWIRE
`
`RECEIVE PACKETS AT CLIENT
`COMPUTER AND AUTHENTICATE AT
`APPLICATION LAYER
`
`3703
`
`3704
`
`3705
`
`3706
`
`3707
`
`3708
`
`New Bay Capital, LLC
`Ex. 1001-Page 43 of 73
`
`New Bay Capital, LLC
`Ex. 1001-Page 43 of 73
`
`

`

`US 7,418,504 B2
`
`1
`AGILE NETWORK PROTOCOL FOR SECURE
`COMMUNICATIONS USING SECURE
`DOMAIN NAMES
`
`CROSS-REFERENCE TO RELATED
`APPLICATIONS
`
`This application claims priority from and is a continuation
`patent application of US. application Ser. No. 09/558,210,
`filed Apr. 26, 2000 now abandoneed, which is a continuation—
`in-part patent application ofpreviously-filed US. application
`Ser. No. 09/504,783, filed on Feb. 15, 2000, now U.S. Pat. No.
`6,502,135, issued Dec. 31, 2002, which claims priority from
`and is a continuation—in—part patent application ofpreviously—
`filed US application Ser. No. 09/429,643, filed on Oct. 29,
`1999 now US. Pat. No. 7,010,604. The subject matter ofU.S.
`application Ser. No. 09/429,643 , which is bodily incorporated
`herein, derives from provisional U.S. application Nos.
`60/106,261 (filed Oct. 30, 1998) and 60/137,704 (filed Jun. 7,
`1999). The present application is also related to US appli-
`cation Ser. No. 09/558,209, filed Apr. 26, 2000, and which is
`incorporated by reference hcrcin.
`
`GOVERNMENT CONTRACT RIGHTS
`
`This invention was made with Government support under
`Contra ct No. 360000-1999-000000-QC-000-000 awarded by
`the Central Intelligence Agency. The Government has certain
`rights in the invention.
`
`
`
`BACKGROUND OF THE INVENTION
`
`A tremendous variety of methods have been proposed and
`implemented to provide security and anonymity for commu—
`nications over the Internet. The variety stems, inpart, from the
`different needs of different lntemet users. A basic heuristic
`framework to aid in discussing these different security tech-
`niques is illustrated in FIG. 1. Two terminals, an originating
`terminal 100 and a destination terminal 110 are in communi-
`cation over the lntemet. It is desired for the communications
`to be secure, that is, immune to eavesdropping. For example,
`terminal 100 may transmit secret information to terminal 110
`over the Internet 107. Also, it may be desired to prevent an
`eavesdropper from discovering that terminal 100 is in com-
`munication with terminal 110. For example, if terminal 100 is
`a user and terminal 110 hosts a web site, terminal 100’s user
`may not want anyone in the intervening networks to know
`what web sites he is “visiting.” Anonymity would thus be an
`issue, for example, for companies that want to keep their
`market research interests private and thus would prefer to
`prevent outsiders from knowing which web-sites or other
`Internet resources they are “visiting.” These two security
`issues may be called data security and anonymity, respec-
`tively.
`Data security is usually tackled using some form of data
`encryption. An encryption key 48 is known at both the origi-
`nating and terminating terminals 100 and 110. The keys may
`be private and public at the originating and destination tenni-
`nals 100 and 110, respectively or they may be symmetrical
`keys (the same key is used by both parties to encrypt and
`decrypt). Many encryption methods are known and usable in
`this context.
`To hide traffic from a local administrator or ISP, a user can
`employ a local proxy server in communicating over an
`encrypted channel with an outside proxy such that the local
`administrator or ISP only sees the encrypted trafiic. Proxy
`servers prevent destination servers from determining the
`
`10
`
`15
`
`20
`
`25
`
`30
`
`35
`
`40
`
`45
`
`50
`
`55
`
`60
`
`65
`
`2
`identities of the originating clients. This system employs an
`intermediate server interposed between client and destination
`server. The destination server sees only the Internet Protocol
`(IP) address ofthe proxy server and not the originating client.
`The target server only sees the address of the outside proxy.
`This scheme relies on a trusted outside proxy server. Also,
`proxy sche