Please type a plus sign (+) inside this box :>
`
`illllil ’l§ii
`llil»l’--
`MODIFIED PTOISB/05 (03 (J
`Approved for use through 10/31/2002 OMB 0651-tn’
`U 5 Patent and Trademark Office US DEPARTMENT OF COMMEI:
`Under the Paperwork Reduction Act of 1995, no persons are required to respond to a collection of information unless it displays a valid OMB control nurribi
`
`Z0/05/60
`
`UTILITY
`PATENT APPLICATION
`
`°°°82
`cow
`SECURE COMMUNICATIONS WITH ASSURED SYSTEM
`IMPROVEMENTS TO AN AGILE NETWORK PROTOCOL FOR
`AVAILABILITY
`
`(Only for new nonprovisional applications under 37 C F R 1 53(0))
`
`Express Mail Label No
`
`APPLICATION ELEMENTS
`See MPEF’ chapter 600 concerning utility patent application contents
`Fee Transmittal Form (e g , PTO/SBII7)
`(Submit an original and a duplicate for fee processing)
`Applicant claims small entity status
`See 37 CFR 1.27
`[Total Pages E-_| ]
`Specification
`(preferred arrangement set forth below)
`— Descriptive title of the Invention
`— Cross Reference to Related Applications
`- Reference to sequence listing, a table,
`V Smemem Regardmg Fed sponsored R 8‘ D
`07 3 C0mDUteT Pl'09l3m “SW19 appelldlx
`- Background of the Invention
`— Brief Summary of the Invention
`- Brief Description of the Drawings ( if filed)
`- Detailed Description
`- Claimts)
`- Abstract of the Disclosure
`
`[Total Sheets
`
`I
`
`]
`
`Drawing(s) (35 U S C 113)
`4. IX]
`IE Formal, or
`a
`b D Informal
`[Total Pages
`5. Oath or Declaration
`a El Newly executed (original or copy), or
`b
`IX Copy from a prior application (37 CFR 1 63 (d))
`(for a continuation/divisional with Box 18 completed)
`i l:I DELETION OF lNVENTOR(S)
`Signed statement attached deleting inventor(s)
`named in the prior application, see 37 CFR
`1 63(d)(2) and 1 33(b)
`6. IE Application Data Sheet. See 37 CFR 1.76
`
`Assistant Commissioner for Patents
`Box PatentAppIication
`Washington, DC 20231
`
`7 I:] CD—ROM or CD—R in duplicate, large table or
`Computer Program (Appendix)
`8. Nucleotide and/or Amino Acid Sequence Submission
`(if applicable, all necessary)
`a
`[:I Computer Readable Form (CRF)
`b Specification Sequence Listing on
`i_ E] C_D_RQM 0, CD_R (2 Copies)‘ or
`ii’ E] paper
`in identit of above coies
`c El Statements veri
`ACCOMPANYING APPLICATIONS PARTS
`
`0
`5:
`05
`:3
`
`an
`3~--.
`*1
`
`9. E]
`
`Assignment Papers (cover sheet & document(s))
`37 C F R §3.73(b) Statement E] Power of
`(when there is an assignee)
`Attorney
`English Translation Document (if applicable)
`
`I:l Copies of IDS
`Citations
`
`lnfomiation Disclosure
`Statement (IDS)/PTO—1449
`Preliminary Amendment
`Return Receipt Postcard (MPEP 503)
`(Should be specifically itemized)
`Certified Copy of Priority Document(s)
`(if foreign priority is claimed)
`Nonpublication Request under 35 U S C 122
`(b)(2)(B)(i). Applicant must attach form PTO/SB/35
`or its equivalent
`Other
`
`18. If a CONTINUING APPLICATION, check appropriate box, and supply the requisite information below and in a preliminary amendment,
`or in an Application Data Sheet under 37 CFR 1 76
`of prior application No. Q l 504 783
`El Continuation
`E Divisional
`El Continuation~in-part (CIP)
`Group / Art Unit C
`Prior application information
`Examiner Krisna Lim
`For CONTINUATION or DIVISIONAL APPS only: The entire disclosure of the prior application, from which an oath or declaration is supplied
`under Box 5b, is considered a part of the disclosure of the accompanying or divisional application and is hereby incorporated by reference.
`The incorporation can only be relied upon when a portion has been inadvertently omitted from the submitted application parts.
`17. CORRESPONDENCE ADDRESS
`22907
`
`E Customer Number or Bar Code Label
`
`(Insert Customer No or Attach bar code label here)
`
`' W D C°"e5P°”d9”C5‘ 5dd"355 below
`
`Name
`
`Address
`
`CW
`Country
`
`Name (Print/Type)
`
`Signature
`
`1 State
`Telephone
`
`I Zip Code
`Fax
`
`49,024
`
`September 30, 2002
`
`Burden Hour Statement This form is estimated to take 0 2 hours to complete Time will vary depending upon the needs 01 the individual case Any
`comments on the amount of time you are required to complete this form should be sent to the Chief Information Officer, U S Patent and Trademark
`Office_ Washington, DC 20231. DO NOT SEND FEES OR COMPLETED FORMS TO THIS ADDRESS. SEND TO: Assistant Commissioner for
`Patents, Box Patent Application, Washington, DC 20231
`
`1
`
`MICROSOFT 1002
`
`Petitioner Apple Inc. - Exhibit 1002, p. 1
`
`

`
`E?i.I‘iZ2i.il".IL%l
`Illiil
`ill
`ll»-ll"
`‘léill *1-«ll-49:2‘!
`IE2!’
`.'_‘li.. iii.
`Approved for use through 10/31/2002 OMB 0651003.
`U 5 Patent and Trademark Office U 8 DEPARTMENT OF COMMERCE
`Under the Paperwork Reduction Act of 1995, no persons are required to respond to a collection of information unless it displays a valid OMB control number
`
`Mu .,
`
`Application Number
`Filing Date
`First Named Inventor
`Examiner Name
`Group IArt Unit
`Attorne Docket No
`
`3. ADDITIONAL FEES
`
`Complete if Known
`
`TBA
`September 30, 2002
`Edmond Colby Munger
`TBA
`2153
`000479 00082
`
`FEE CALCULATION (continued)
`
`code
`205
`227
`
`139
`147
`112
`
`113
`
`215
`216
`
`217
`218
`
`228
`219
`220
`221
`138
`240
`241
`242
`243
`244
`I22
`123
`126
`
`581
`
`246
`
`249
`
`279
`169
`
`Fee Description
`Surcharge - late filing fee or oath
`Surcharge - late provisional filing fee
`or cover sheet
`Non-English specification
`For filing a request for reexamination
`Requesting publication of SIR prior to
`Examiner action
`Requesting publication of SIR after
`Examiner action
`Extension for reply within first month
`Extension for reply within second
`month
`Extension for reply within third month
`Extension for reply within tourlh
`month
`Extension for reply within fifth month
`Notice of Appeal
`Filing a brief in support of an appeal
`Request for oral hearing
`Petition to institute a public use
`proceeding
`Petition to revive - unavoidable
`Petition to revive — unintentional
`Utility issue fee (or reissue)
`Design issue fee
`Plant issue fee
`Petitions to the Commissioner
`Processing fee under 37 CFR 1 17 (q)
`Submission of Information Disclosure
`Stmt
`Recording each patent assignment
`per property (times number of
`properties)
`Filing a submission afterfinal rejection
`(37 CFR § 1 129(a))
`For each additional invention to be
`examined (37 CFR § 1 129(b))
`370 Request for Continued Examination (RCE)
`900
`Request for expedited examination
`of a design application
`
`40
`
`370
`
`370
`
`Other fee (specity)
`
`‘Reduced by Basic Filing Fee Paid
`
`FEE TRANSMITTAL
`
`for FY 2002
`Patent fees are subject to annual revision
`
`I:I Applicant claims small entity status. See 37 CFR 1.27
`
`($)
`TOTAL AMOUNT OF PAYMENT
`METHOD OF PAYMENT (check all that apply)
`
`[I Money [I Other
`Order
`
`I] None
`
`E] Check
`
`El Credit card
`E Deposit Account
`Deposit
`Account
`Number
`
`190733
`
`Banner & Witcoff, Ltd
`
`Deposit
`Accou nt
`Name
`The Commissioner is authorized to: (check all that apply)
`E Charge fee(s) indicated below 8 Credit any overpayments
`El Charge any additional fee(s) during the pendency of this application
`|:| Charge fee(s) indicated below, except for the filing fee
`to the above-identified deosit account
`FEE CALCULATION
`BASIC FILING FEE
`
`Fee Desc rlptlon
`
`Utility filing fee
`Design filing fee
`Plant filing fee
`Reissue filing fee
`Provisional filling fee
`
`SUBTOTAL (1)
`2. EXTRA CLAIM FEES
`
`20
`
`740
`
`Fee
`
`Fee fioiii
`Extra
`below
`Claims
`l_0__lXlj|
`EX
`XEZ
`
`Small Entit
`Fee
`($l
`
`F66 DGSCTIQIIOH
`Claims in excess of 20
`independent claims in excess of 3
`Multiple dependent claim, if not paid
`"' Reissue independent claims over
`original patent
`“ Reissue claims in excess of 20 and
`over original patent
`
`94
`
`2
`
`42
`
`9
`
`SUBTOTAL i2)
`
`is) 335
`
`“oi number previously paid, ifgreater. For Reissues, see above
`
`SUBMITTED BY
`
`Name {PnnVType)
`
`Signalure
`
`Ross A Dannenberg
`
`I Registration No Attorney/Agent)
`
`49,024
`
`Telephone
`
`(202) 505-9153
`
`Date
`
`September 30, 2002
`
`Q9-V»
`WARNING:
`Information on this form may become public. Credit card Information should not be
`Included on this form. Provide credit card Information and authorization on PTO-2038.
`Burden Hour Statement This form is estimated to take 0 2 hours to complete Time will vary depending upon the needs of the individual case Any comments on the
`amount of time you are required to complete this form should be sent to the Chief Information Officer, U S Patent and Trademark Office, Washington, DC 20231
`DO NOT SEND FEES OR COMPLETED FORMS TO THIS ADDRESS SEND TO Assistant Commissioner for Patents, Washington, DC 20231
`
`2
`
`Petitioner Apple Inc. - Exhibit 1002, p. 2
`
`

`
`Lu.
`_IZ3'3..51i’Iil;--E!533$}“€113I’-vii~"§§313‘~ii~
`
`.1.
`
`ii3!"3Z
`
`T“
`
`Application Data Sheet
`
`Application Information
`
`Application number::
`
`Filing Date::
`
`Application Type::
`
`Subject Matter::
`
`Suggested classification:
`
`Suggested Group Art Unitc:
`CD—ROM or CD-R?::
`
`Number of CD diskszz
`
`Number of copies of CDs::
`
`Sequence submission?::
`
`Computer Readable Form (CRF)?::
`
`Number of copies of CRF::
`
`Titlez:
`
`IMPROVEMENTS TO AN AGILE NETWORK
`
`PROTOCOL FOR SECURE COMMUNICATIONS
`
`WITH ASSURED SYSTEM AVAILABILITY
`
`Attorney Docket Number::
`
`OOO479.00082
`
`NO
`
`NO
`
`35
`
`NO
`
`Request for Early Pub|ication?::
`
`Request for Non-Pub|ication?::
`
`Suggested Drawing Figurezz
`
`Total Drawing Sheets:
`
`Small Entity?::
`Latin name::
`
`Variety denomination namez:
`
`Petition inc|uded?::
`
`Petition Type::
`
`Licensed US Govt. Agency:
`Contract or Grant Numberszz
`
`Initial O9/30/02
`
`3
`
`Petitioner Apple Inc. - Exhibit 1002, p. 3
`
`

`
`Secrecy Order in Parent App|.?::
`
`Applicant Information
`
`Applicant Authority Type:
`
`Primary Citizenship Country::
`Status::
`
`Given Name:
`
`Middle Name:
`
`Family Name::
`
`Name Suffix:
`
`City of Residence::
`
`State or Province of Residence:
`
`Country of Residence:
`
`Inventor
`
`USA
`
`Full Capacity
`
`Edward
`
`Colby
`
`Munger
`
`Crownsville
`
`MD
`
`USA
`
`Street of mailing address:
`
`1101 Opaca Court
`
`City of mailing address::
`
`Crownsville
`
`State or Province of mailing address:
`
`Country of mailing address::
`
`Postal or Zip Code of mailing address:
`
`Applicant Authority Type::
`
`Primary Citizenship Country:
`Status::
`
`Given Name::
`
`Middle Name:
`
`Family Name::
`Name Suffix::
`
`City of Residence::
`
`State or Province of Residence:
`
`Country of Residence::
`
`Street of mailing address:
`
`MD
`
`USA
`
`21032
`
`Inventor
`
`USA
`
`Full Capacity
`
`Douglas
`
`Charles
`
`Schmidt
`
`Severna Park
`
`MD
`
`USA
`
`230 Oak Court
`
`Initial O9/30/02
`
`4
`
`Petitioner Apple Inc. - Exhibit 1002, p. 4
`
`

`
`3i:'.’:‘i E53? *7?‘
`
`‘~‘}'=2‘l
`
`1.,
`
`iifii *3’-33%
`
`T.§“:}‘.1i§Cl§!
`
`iilfii i§:i}"‘E
`
`City of mailing address:
`
`Serverna Park
`
`State or Province of mailing address:
`
`Country of mailing address::
`
`Postal or Zip Code of mailing address:
`
`Applicant Authority Type::
`
`Primary Citizenship Country:
`Status:
`
`Given Name::
`
`Middle Name::
`
`Family Name::
`
`Name Suffix:
`
`City of Residence::
`
`State or Province of Residence::
`
`Country of Residence:
`
`Street of mailing address::
`
`City of mailing address::
`
`State or Province of mailing address:
`
`Country of mailing address:
`
`Postal or Zip Code of mailing address:
`
`Applicant Authority Type::
`
`Primary Citizenship Country:
`Status:
`
`Given Name::
`
`Middle Name::
`
`Family Name::
`Name Suffix:
`
`City of Residence:
`
`MD
`
`USA
`
`21146
`
`Inventor
`
`USA
`
`Full Capacity
`Robert
`
`Dunham
`
`Shon
`
`Ill
`
`Leesburg
`VA
`
`USA
`
`38710 Goose Creek Lane
`
`Leesburg
`VA
`
`USA
`
`20175
`
`Inventor
`
`USA
`
`Full Capacity
`Victor
`
`Larson
`
`Fairfax
`
`State or Province of Residence:
`
`VA
`
`Initial O9/30/O2
`
`5
`
`Petitioner Apple Inc. - Exhibit 1002, p. 5
`
`

`
`l.,;g; :i.,;;,.:i:;:; ;2..;;..
`
`In
`
`ii..;li "'7“..:1,i
`
`.
`
`'
`
`Country of Residence:
`
`Street of mailing address:
`
`City of mailing address:
`
`State or Province of mailing address::
`
`Country of mailing address:
`
`Postal or Zip Code of mailing address:
`
`Applicant Authority Type::
`
`Primary Citizenship Country:
`Status::
`
`Given Name::
`
`Middle Name:
`
`Family Name::
`
`Name Suffix::
`
`City of Residence::
`
`State or Province of Residence:
`
`Country of Residence:
`
`Street of mailing address::
`
`City of mailing address::
`
`State or Province of mailing address::
`
`Country of mailing address:
`
`Postal or Zip Code of mailing address::
`
`Correspondence Information
`
`Correspondence Customer Number:
`
`Representative Information
`
`Representative Customer Number:
`
`USA
`
`12026 Lisa Marie Court
`
`Fairfax
`
`VA
`
`USA
`
`22033
`
`Inventor
`
`USA
`
`Full Capacity
`Michael
`
`Williamson
`
`South Riding
`VA
`
`USA
`
`26203 Ocala Circle
`
`South Riding
`VA
`
`USA
`
`20152
`
`Initial 09/30/02
`
`6
`
`Petitioner Apple Inc. - Exhibit 1002, p. 6
`
`

`
`Domestic Priority Information
`
`Application:
`This Application
`
`Continuity Type:
`Division of
`
`Parent Application::
`O9/504,783
`
`Parent Filing Date:
`O2/15/O0
`
`l
`
`A
`
`Foreign Priority Information
`
`}
`l
`
`l
`
`Country:
`
`Application number:
`
`Filing Date::
`
`Priority Claimed:
`
`Assignee Information
`
`Assignee name::
`
`Science Applications International Corporation
`
`Street of mailing address::
`
`10260 Campus Point Drive
`
`City of mailing address::
`
`San Diego
`
`State or Province of mailing address:
`
`CA
`
`Country of mailing address::
`
`USA
`
`Postal or Zip Code of mailing address:
`
`92121
`
`Initial O9/30/O2
`
`7
`
`Petitioner Apple Inc. - Exhibit 1002, p. 7
`
`

`
`00047900082
`
`IMPROVEMENTS TO AN AGILE NETWORK PROTOCOL
`FOR SECURE COMMUNICATIONS
`WITI-I ASSURED SYSTEM AVAILABILITY
`
`CROSS-REFERENCE TO RELATED APPLICATIONS
`
`This application is a divisional application of 09/504,783 (filed February 15, 2000),
`[01]
`which claims priority from and is a continuation-in-part of previously filed U.S. application
`serial number 09/429,643 (filed October 29, 1999). The subject matter of that application, which
`is bodily incorporated herein, derives from provisional U.S. application numbers 60/106,261
`(filed October 30, 1998) and 60/137,704 (filed June 7, 1999).
`
`BACKGROUND OF THE INVENTION
`
`A tremendous variety of methods have been proposed and implemented to provide
`[02]
`security and anonymity for communications over the Intemet. The variety stems, in part, from
`the different needs of different Internet users. A basic heuristic framework to aid in discussing
`these different security techniques is illustrated in FIG. 1. Two terminals, an originating terminal
`100 and a destination terminal 110 are in communication over the Internet. It is desired for the
`
`communications to be secure, that is, immune to eavesdropping. For example, terminal 100 may
`transmit secret information to terminal 110 over the Internet 107. Also, it may be desired to
`
`prevent an eavesdropper from discovering that terminal 100 is in communication with terminal
`
`1 10. For example, if terminal 100 is a user and terminal 1 10 hosts a web site, terminal 100’s user
`
`may not want anyone in the intervening networks to know what web sites he is "visiting."
`Anonymity would thus be an issue, for example, for companies that want to keep their market
`research interests private and thus would prefer to prevent outsiders from knowing which web-
`sites or other Internet resources they are “visiting.” These two security issues may be called data
`
`security and anonymity, respectively.
`
`Data security is usually tackled using some form of data encryption. An encryption key
`[03]
`48 is known at both the originating and terminating terminals 100 and 110. The keys may be
`private and public at the originating and destination terminals 100 and 110, respectively or they
`may be symmetrical keys (the same key is used by both parties to encrypt and decrypt). Many
`encryption methods are known and usable in this context.
`
`8
`
`Petitioner Apple Inc. - Exhibit 1002, p. 8
`
`

`
`00047900082
`
`"-35 M-“1E’él3‘-I
`
`H.
`
`$312?!
`
`‘*3,-‘ll Ifiiiiiilifill il'.".l3%i§':3‘ff
`
`To hide traffic from a local administrator or ISP, a user can employ a local proxy server
`[04]
`in communicating over an encrypted channel with an outside proxy such that
`the local
`
`administrator or ISP only sees the encrypted traffic. Proxy servers prevent destination servers
`
`fiom determining the identities of the originating clients. This system employs an intermediate
`
`server interposed between client and destination server. The destination server sees only the
`Internet Protocol (IP) address of the proxy server and not the originating client. The target server
`only sees the address of the outside proxy. This scheme relies on a trusted outside proxy server.
`Also, proxy schemes are vulnerable to traffic analysis methods of determining identities of
`
`transmitters and receivers. Another important limitation of proxy servers is that the server knows
`
`the identities of both calling and called parties. In many instances, an originating terminal, such
`
`as terminal A, would prefer to keep its identity concealed from the proxy, for example, if the
`
`proxy server is provided by an Internet service provider (ISP).
`
`[05]
`
`To defeat traffic analysis, a scheme called Chaum’s mixes employs a proxy server that
`
`transmits and receives fixed length messages, including dummy messages. Multiple originating
`terminals are connected through a mix (a server) to multiple target servers. It is difficult to tell
`
`which of the originating terminals are communicating to which of the connected target servers,
`
`and the dummy messages confiise eavesdroppers’ efforts to detect communicating pairs by
`analyzing traffic. A drawback is that there is a risk that the mix server could be compromised.
`One way to deal with this risk is to spread the trust among multiple mixes. If one mix is
`
`compromised, the identities of the originating and target terminals may remain concealed. This
`
`strategy requires a number of alternative mixes so that the intermediate servers interposed
`between the originating and target terminals are not determinable except by compromising more
`than one mix. The strategy wraps the message with multiple layers of encrypted addresses. The
`
`first mix in a sequence can decrypt only the outer layer of the message to reveal the next
`
`destination mix in sequence. The second mix can decrypt the message to reveal the next mix and
`
`so on. The target server receives the message and, optionally, a multi-layer encrypted payload
`
`containing return information to send data back in the same fashion. The only way to defeat such
`
`a mix scheme is to collude among mixes. If the packets are all fixed—length and intermixed with
`
`dummy packets, there is no way to do any kind of traffic analysis.
`
`9
`
`Petitioner Apple Inc. - Exhibit 1002, p. 9
`
`

`
`000479.00082
`
`,§§l,_§:3|i1:§F§33§§3§13-{3}*l~§!»=5f}?li'3i-i3-- M ‘iii?! §.::3§: ATE:
`
`Still another anonymity technique, called ‘crowds,’ protects the identity of the originating
`[06]
`terminal from the intermediate proxies by providing that originating terminals belong to groups
`of proxies called crowds. The crowd proxies are interposed between originating and target
`terminals. Each proxy through which the message is sent is randomly chosen by an upstream
`
`proxy. Each intermediate proxy can send the message either to another randomly chosen proxy
`in the “crowd” or to the destination. Thus, even crowd members cannot determine if a preceding
`proxy is the originator of the message or if it was simply passed from another proxy.
`
`ZKS (Zero-Knowledge Systems) Anonymous IP Protocol allows users to select up to any
`[07]
`of five different pseudonyms, while desktop sofiware encrypts outgoing traffic and wraps it in
`User Datagram Protocol (UDP) packets. The first server in a 2+-hop system gets the UDP
`
`packets, strips off one layer of encryption to add another, then sends the traffic to the next server,
`
`which strips off yet another layer of encryption and adds a new one. The user is permitted to
`
`control the number of hops. At the fina] server, traffic is decrypted with an untraceable IP
`
`address. The technique is called onion—routing. This method can be defeated using traffic
`
`analysis. For a simple example, bursts of packets fi‘om a user during low-duty periods can reveal
`the identities of sender and receiver.
`
`[08]
`
`Firewalls attempt to protect LANs from unauthorized access and hostile exploitation or
`
`damage to computers connected to the LAN . Firewalls provide a server through which all access
`
`to the LAN must pass. Firewalls are centralized systems that require administrative overhead to
`
`maintain. They can be compromised by virtual-machine applications (“applets”). They instill a
`false sense of security that leads to security breaches for example by users sending sensitive
`information to servers outside the firewall or encouraging use of modems to sidestep the firewall
`
`security. Firewalls are not useful for distributed systems such as business travelers, extranets,
`small teams, etc.
`
`SUMMARY OF THE INVENTION
`
`[09]
`
`A secure mechanism for communicating over the intemet, including a protocol referred
`
`to as the Tunneled Agile Routing Protocol (TARP), uses a unique two—layer encryption format
`
`and special TARP routers. TARP routers are similar in function to regular IP routers. Each
`
`TARP router has one or more IP addresses and uses normal LP protocol to send IP packet
`
`10
`
`Petitioner Apple Inc. - Exhibit 1002, p. 10
`
`

`
`O0O479.00082
`
`messages (“packets” or “datagrams”). The IP packets exchanged between TARP terminals Via
`
`TARP routers are actually encrypted packets whose true destination address is concealed except
`
`to TARP routers and servers. The normal or “clear” or “outside” IP header attached to TARP IP
`
`packets contains only the address of a next hop router or destination server. That is, instead of
`
`indicating a final destination in the destination field of the IP header, the TARP packet’s IP
`
`header always points to a next-hop in a series of TARP router hops, or to the final destination.
`
`This means there is no overt indication from an intercepted TARP packet of the true destination
`
`of the TARP packet since the destination could always be next—hop TARP router as well as the
`final destination.
`
`[10]
`
`Each TARP packet’s true destination is concealed behind a layer of encryption generated
`
`using a link key. The link key is the encryption key used for encrypted communication between
`
`the hops intervening between an originating TARP terminal and a destination TARP terminal.
`
`Each TARP router can remove the outer layer of encryption to reveal the destination router for
`
`each TARP packet. To identify the link key needed to decrypt the outer layer of encryption of a
`
`TARP packet, a receiving TARP or routing terminal may identify the transmitting terminal by
`the sender/receiver IP numbers in the cleartext IP header.
`
`[11]
`
`Once the outer layer of encryption is removed, the TARP router determines the final
`
`destination. Each TARP packet 140 undergoes a minimum number of hops to help foil traffic
`
`analysis. The hops may be chosen at random or by a fixed value. As a result, each TARP packet
`
`may make random trips among a number of geographically disparate routers before reaching its
`
`destination. Each trip is highly likely to be different for each packet composing a given message
`
`because each trip is independently randomly determined. This feature is called agile routing. The
`
`fact that different packets take different routes provides distinct advantages by making it difficult
`
`for an interloper to obtain all the packets forming an entire multi—packet message. The associated
`
`advantages have to do with the inner layer of encryption discussed below. Agile routing is
`
`combined with another feature that furthers this purpose; a feature that ensures that any message
`
`is broken into multiple packets.
`
`[12]
`
`The IP address of a TARP router can be changed, a feature called IP agility. Each TARP
`
`router, independently or under direction from another TARP terminal or router, can change its IP
`
`11
`
`Petitioner Apple Inc. - Exhibit 1002, p. 11
`
`

`
`0O0479.00082
`
`address. A separate, unchangeable identifier or address is also defined. This address, called the
`
`TARP address, is known only to TARP routers and terminals and may be correlated at any time
`
`by a TARP router or a TARP terminal using a Lookup Table (LUT). When a TARP router or
`
`terminal changes its IP address, it updates the other TARP routers and terminals which in turn
`
`update their respective LUTs.
`
`[13]
`
`The message payload is hidden behind an inner layer of encryption in the TARP packet
`
`that can only be unlocked using a session key. The session key is not available to any of the
`
`intervening TARP routers. The session key is used to decrypt the payloads of the TARP packets
`permitting the data stream to be reconstructed.
`
`[14]
`
`Communication may be made private using link and session keys, which in turn may be
`
`shared and used according to any desired method. For example, public/private keys or symmetric
`
`keys may be used.
`
`[15]
`
`To transmit a data stream, a TARP originating terminal constructs a series of TARP
`
`packets from a series of IP packets generated by a network (IP) layer process. (Note that the
`
`terms “network layer,” “data link layer,” “application layer,” etc. used in this specification
`
`correspond to the Open Systems Interconnection (OSI) network terminology.) The payloads of
`
`these packets are assembled into a block and chain—block encrypted using the session key. This
`
`assumes, of course, that all the IP packets are destined for the same TARP terminal. The block is
`
`then interleaved and the interleaved encrypted block is broken into a series of payloads, one for
`
`each TARP packet to be generated. Special TARP headers IPT are then added to each payload
`
`using the IP headers from the data stream packets. The TARP headers can be identical to nonnal
`
`IP headers or customized in some way. They should contain a formula or data for deinterleaving
`
`the data at the destination TARP terminal, a time—to-live (TTL) parameter to indicate’ the number
`
`of hops still to be executed, a data type identifier which indicates whether the payload contains,
`
`for example, TCP or UDP data, the sender’s TARP address, the destination TARP address, and
`
`an indicator as to whether the packet contains real or decoy data or a formula for filtering out
`
`decoy data if decoy data is spread in some way through the TARP payload data.
`
`12
`
`Petitioner Apple Inc. - Exhibit 1002, p. 12
`
`

`
`00047900082
`
`[16] Note that although chain—block encryption is discussed here with reference to the session
`
`key, any encryption method may be used. Preferably, as in chain block encryption, a method
`
`should be used that makes unauthorized decryption difficult without an entire result of the
`
`encryption process. Thus, by separating the encrypted block among multiple packets and making
`
`it difficult for an interloper to obtain access to all of such packets,
`
`the contents of the
`
`communications are provided an extra layer of security.
`
`[17]
`
`Decoy or dummy data can be added to a stream to help foil traffic analysis by reducing
`
`the peak-to—average network load. It may be desirable to provide the TARP process with an
`
`ability to respond to the time of day or other criteria to generate more decoy data during low
`
`traffic periods so that communication bursts at one point in the Internet cannot be tied to
`
`communication bursts at another point to reveal the communicating endpoints.
`
`Dummy data also helps to break the data into a larger number of inconspicuously-sized
`[18]
`packets permitting the interleave window size to be increased while maintaining a reasonable
`
`size for each packet. (The packet size can be a single standard size or selected from a fixed range
`
`of sizes.) One primary reason for desiring for each message to be broken into multiple packets is
`
`apparent if a chain block encryption scheme is used to form the first encryption layer prior to
`
`interleaving. A single block encryption may be applied to portion, or entirety, of a message, and
`
`that portion or entirety then interleaved into a number of separate packets. Considering the agile
`
`IP routing of the packets, and the attendant difficulty of reconstructing an entire sequence of
`
`packets to form a single block-encrypted message element, decoy packets can significantly
`
`increase the difficulty of reconstructing an entire data stream.
`
`[19]
`
`The above scheme may be implemented entirely by processes operating between the data
`
`link layer and the network layer of each server or terminal participating in the TARP system.
`
`Because the encryption system described above is insertable between the data link and network
`
`layers, the processes involved in supporting the encrypted communication may be completely
`
`transparent to processes at the IP (network) layer and above. The TARP processes may also be
`
`completely transparent to the data link layer processes as well. Thus, no operations at or above
`
`the Network layer, or at or below the data link layer, are affected by the insertion of the TARP
`
`stack. This provides additional security to all processes at or above the network layer, since the
`
`13
`
`Petitioner Apple Inc. - Exhibit 1002, p. 13
`
`

`
`0O0479.00082
`
`difficulty of unauthorized penetration of the network layer (by, for example, a hacker) is
`
`increased substantially. Even newly developed servers running at the session layer leave all
`
`processes below the session layer vulnerable to attack. Note that in this architecture, security is
`
`distributed. That is, notebook computers used by executives on the road, for example, can
`
`communicate over the Internet without any compromise in security.
`
`[20]
`
`IP address changes made by TARP terminals and routers can be done at regular intervals,
`
`at random intervals, or upon detection of “attacks.” The variation of IP addresses hinders traffic
`
`analysis that might reveal which computers are communicating, and also provides a degree of
`
`immunity from attack. The level of immunity from attack is roughly proportional to the rate at
`
`which the IP address of the host is changing.
`
`[21]
`
`As mentioned, IP addresses may be changed in response to attacks. An attack may be
`
`revealed, for example, by a regular series of messages indicating that a router is being probed in
`
`some way. Upon detection of an attack, the TARP layer process may respond to this event by
`
`changing its IP address. In addition, it may create a subprocess that maintains the original IP
`
`address and continues interacting with the attacker in some manner.
`
`[22] Decoy packets may be generated by each TARP terminal on some basis determined by an
`
`algorithm. For example, the algorithm may be a random one which calls for the generation of a
`
`packet on a random basis when the terminal
`
`is idle. Alternatively,
`
`the algorithm may be
`
`responsive to time of day or detection of low traffic to generate more decoy packets during low
`
`traffic times. Note that packets are preferably generated in groups, rather than one by one, the
`
`groups being sized to simulate real messages. In addition, so that decoy packets may be inserted
`
`in normal TARP message streams, the background loop may have a latch that makes it more
`
`likely to insert decoy packets when a message stream is being received. Alternatively, if a large
`
`number of decoy packets is received along with regular TARP packets, the algorithm may
`
`increase the rate of dropping of decoy packets rather than forwarding them. The result of
`
`dropping and generating decoy packets in this way is to make the apparent incoming message
`
`size different from the apparent outgoing message size to help foil traffic analysis.
`
`14
`
`Petitioner Apple Inc. - Exhibit 1002, p. 14
`
`

`
`000479.00082
`
`“E3-3? '-“ll-7“ES3iJ W £1135 3*
`
`[23]
`
`In various other embodiments of the invention, a scalable version of the system may be
`
`constructed in which a plurality of IP addresses are preassigned to each pair of communicating
`
`nodes in the network. Each pair of nodes agrees upon an algorithm for “hopping” between IP
`
`addresses (both sending and receiving), such that an eavesdropper sees apparently continuously
`
`random IP address pairs (source and destination) for packets transmitted between the pair.
`
`Overlapping or “reusable” IP addresses may be allocated to different users on the same subnet,
`
`since each node merely verifies that a particular packet includes a valid source/destination pair
`
`from the agreed—upon algorithm. Source/destination pairs are preferably not reused between any
`
`two nodes during any given end-to-end session, though limited IP block sizes or lengthy sessions
`might require it.
`
`[24]
`
`Further improvements described in this continuation—in-part application include: (1) a
`
`load balancer
`
`that distributes packets across different
`
`transmission paths according to
`
`transmission path quality; (2) a DNS proxy server that transparently creates a virtual private
`
`network in response to a domain name inquiry; (3) a large-to-small link bandwidth management
`
`feature that prevents denial-of—se1vice attacks at system chokepoints; (4) a traffic limiter that
`
`regulates incoming packets by limiting the rate at which a transmitter can be synchronized with a
`
`receiver; and (5) a signaling synchronizer that allows a large number of nodes to communicate
`
`with a central node by partitioning the communication function between two separate entities
`
`BRIEF DESCRIPTION OF THE DRAWINGS
`
`FIG. 1 is an illustration