VIRNETX EXHIBIT 2012
`Apple v. VirnetX
`Trial IPR2015-00811
`
`Page 1 of 2
`
`

`
`Administrator’s Guide
`
`lb
`
`_..
`
`during the connection request. Aventail Connect will forward the host~
`name to the extranet (SOCKS) server in step 2 and the SOCKS server
`performs the hostname resolution.
`
`'1 C —-
`
`; —-
`
`-
`
`lfthe DNS proxy option is enabled and the domain cannot be looked up
`directly, Aventail Connect creates a fake DNS entry that it can recog-
`nize later, and returns this to the calling application. The false entry tells
`Aventail Connect that the DNS lookup must be proxied, and that it must
`send the fully qualified hostname to the SOCKS server with the SOCKS
`connection request.
`
`2. The application requests a connection to the remote host. This causes the
`underlying stack to begin the TCP handshake. When the handshake is com-
`plete, the application is notified that the connection is established and that
`data may now be transmitted and received. Aventail Connect does the follow-
`ing:
`
`2
`
`a. Aventail Connect checks the connection request.
`a -4
`-
`if the request contains a false DNS entry (from step 1),
`"'[:—'
`proxied.
`
`2 Q
`
`it will be
`
`2 QC;
`
`“LO, Q; in
`
`-T
`
`lfthe request contains a routable IP address, and the rules in the
`configuration file say it must be proxied, Aventail Connect will call
`WinSock to begin the TCP handshake with the server designated
`in the configuration file.
`
`-
`
`If the request contains a real IP address and the configuration file
`rule says that it does not need to be proxied, the request will be
`passed to WinSock and processing jumps to step 3 as if Aventail
`l._._...... Connect were not running.
`
`2 \O
`
`b. When the connection is completed, Aventail Connect begins the
`SOCKS negotiation.
`
`.
`Zbca
`
`l
`
`Xg
`
`Z \O CA
`‘
`
`3 C
`
`-
`
`f’-
`lt dthl'tftht't'
`thd
`bld'th
`econ igu
`ra::rr1)fis!e_e is o au en ica ion me o sena e in
`- Once the server selects an authentication method, Aventail Con-
`nect executes the specified authentication processing.
`it then sends the proxy request to the extranet (SOCKS) server.
`This includes either the IP address provided by the application or
`the DNS entry (hostname) provided in step 1.
`
`-
`
`c. When the SOCKS negotiation is completed, Aventail Connect notifies
`the application. From the application’s point of view, the entire SOCKS
`negotiation, including the authentication negotiation, is merely the TCP
`handshaking.
`
`3 The application transmits and receives data.
`
`3 -——
`
`If an encryption module is enabled and selected by the SOCKS server, Aven-
`tail Connect encrypts the data on its way to the server on behalf of the appli-
`cation. If data is being returned, Aventail Connect decrypts it so that the
`application sees cleartext data.
`
`Page 2 on T
`
`Petitioner Apple Inc. — Ex. 1009, p. 12
`
`
`
`Aventail Connect 3.01/2.51 Administrator’s Guide - 12
`
`Page 2 of 2