US007490151B2
`
`(12) United States Patent
`Munger et al.
`
`(10) Patent No.:
`(45) Date of Patent:
`
`US 7,490,151 B2
`Feb. 10, 2009
`
`(54) ESTABLISHMENT OF A SECURE
`COMMUNICATION LINK BASED ON A
`DOMAIN NAME SERVICE (DNS) REQUEST
`
`(75)
`
`Inventors: Edward Colby Munger, Crownsville,
`MD (US); Robert Dunham Short, III,
`Leesburg, VA (US); Victor Larson,
`Fairfax, VA
`S ; Michael Williamson,
`South Ridingivg, (US)
`
`(73) Assignee: Virnetx Inc., Scotts Valley Drive, CA
`(US)
`
`( * ) Notice:
`
`Subject to any disclaimer, the term of this
`patent is extended or adjusted under 35
`U.S.C. 154(b) by 818 days.
`
`(21) APPL N05 10/2593494
`
`(56)
`
`References Cited
`
`US’ PATENT DOCUMENTS
`4,933,846 A
`6/1990 Humphrey et al.
`(Continued)
`FOREIGN PATENT DOCUMENTS
`199 24 575
`12/1999
`(Continued)
`
`DE
`
`OTHER PUBLICATIONS
`Search Report (dated Aug. 23, 2002), International Application No.
`PCT/USO 1/ 13260,
`
`(C°“‘i““ed)
`Primary Examiner—Krisna Lim
`(74) Attorney, Agent, or Firm—McDermott Will & Emery
`
`(22)
`
`Filed:
`
`Sep. 30, 2002
`
`(57)
`
`ABSTRACT
`
`(65)
`
`Prior Publication Data
`Us 2003/0037142 A1
`Feb, 20, 2003
`
`Related US, Application Data
`
`(60) Division of application No. 09/504,783, filed on Feb.
`15, 2000, now Pat. No. 6,502,135, which is a continu-
`ation-in-part of application No. 09/429,643, filed on
`Oct’ 29’ 1999’ now Pat’ No’ 7’010’604'
`(60) Provisional application No. 60/137,704, filed on Jun.
`7, 1999, provisional application No, 60/106,261, filed
`on Oct, 30, 1998,
`
`(51)
`
`Int. Cl.
`(2006.01)
`G06F 15/1 73
`(52) U.S. Cl.
`..................................... .. 709/225; 709/229
`(58) Field of Classification Search ....... .. 709/217—225,
`709/229; 713/201
`See application file for complete search history.
`
`A plurality of computer nodes communicate using seemingly
`random Internet Protocol source and destination addresses.
`Data packets matching criteria defined by a moving window
`of valid addresses are accepted for further processing, while
`those that do not meet the criteria are quickly rejected.
`Improvements to the basic design include (1) a load balancer
`h
`d'
`'b
`k
`d'ff
`'
`'
`h
`Elcactoréisltlré Fotetsrapsscmitzigfirgsasth 1(1uE:,r1Ei:tI;tE:I)1S:,I1g:iIOSnpPé,aOtX;
`server that transparently creates a virtual private network in
`1‘eSP0I1Sei0 3 d0I11aii1 1131119 inquiry; (3) 3 large-t0-small link
`bandwidth management feature that prevents denial-of-ser-
`vice attacks at system chokepoints; (4) a trafiic limiter that
`regulates incoming packets by limiting the rate at which a
`transmitter can be synchronized with a receiver; and (5) a
`signaling synchronizer that allows a large number of nodes to
`communicate with a central node by partitioning the commu-
`nieatien function between two separate entities
`
`16 Claims, 35 Drawing Sheets
`
`100
`0R|G|NAT|NG
`TERMINAL
`
`A it
`
`
`ROUTER
`
`
`
`
`IP
`ROUTER
`
`‘P
`ROUTER
`
`29
`
`25
`IP
`
`QT-
`ENCRYPTION KEY
`
`110
`DESTINATION
`TERMINAL
`
`MANGROVE 1001
`
`MANGROVE 1001
`
`

`
`US 7,490,151 B2
`Page 2
`
`..... .. 370/401
`
`............ .. 726/15
`
`U.S. PATENT DOCUMENTS
`4,988,990 A
`1/1991 Warrior
`...................... .. 380/273
`5,164,986 A * 11/1992 Bright
`5,276,735 A
`1/1994 Boebert et al.
`5,311,593 A
`5/1994 Carrni
`5,329,521 A
`7/1994 Walsh etal,
`5,341,426 A
`8/1994 Barneyetal
`5,367,643 A
`11/1994 Chang etal,
`5,559,883 A
`9/1996 Williams
`5,561,669 A
`10/1996 Lenneyetal
`5,588,060 A
`12/1996 Aziz
`5,625,626 A
`4/1997 Uniekila
`5,654,695 A
`8/1997 Olnowich et al.
`5,682,480 A
`10/1997 Nakagawa
`5,689,566 A
`11/1997 Nguyen
`5,740,375 A
`4/1998 Dunne etal,
`5,774,660 A
`6/1998 Brendel et al.
`5,787,172 A
`7/1998 Arnold
`5,790,548 A *
`8/1998 Sistanizadeh et al.
`5,796,942 A
`8/1998 Esbensen
`5,805,801 A
`9/1998 Hollowayetal,
`5,842,040 A
`11/1998 Hnghesetal,
`5,845,091 A
`12/1998 Dunne etal,
`5,867,650 A
`2/1999 Oslerrnan
`5,870,610 A
`2/1999 Beyda etal,
`5,878,231 A
`3/1999 Baehr etal.
`5,892,903 A
`4/1999 Klaus
`5,898,830 A *
`4/1999 Wesingeretal.
`5,905,859 A
`5/1999 Holloway et al.
`5,918,019 A
`6/1999 Valencia
`5,996,016 A
`11/1999 Thalheimer etal.
`6,006,259 A
`12/1999 Adelman etal.
`6,006,272 A
`12/1999 Aravamudan etal.
`6,016,318 A
`1/2000 Tomoike
`6,016,512 A
`1/2000 Huitema
`6,041,342 A
`3/2000 Yamaguchi
`6,052,788 A
`4/2000 Wesinger,Jr.etal.
`6,055,574 A
`4/2000 Smorodinsky etal.
`6,061,736 A
`5/2000 Rochbergeretal.
`6,079,020 A *
`6/2000 Liu .......................... .. 713/201
`6,092,200 A
`7/2000 Muniyappa etal.
`6,101,182 A *
`8/2000 Sistanizadeh etal.
`6,119,171 A
`9/2000 Alkhatib
`6,119,234 A *
`9/2000 Aziz etal.
`6,147,976 A
`11/2000 Shand etal.
`6,157,957 A
`12/2000 Berthaud
`6,158,011 A
`12/2000 Chen etal.
`6,168,409 B1
`1/2001 Fare
`6,175,867 B1
`1/2001 Taghadoss
`6,178,409 B1
`1/2001 Weber etal.
`5,178,505 B1
`1/3001 Se1111e1de1e131
`5,179,103 B1
`1/3001 Webe1e131~
`5,333,843 B1
`4/3001 S35Y311 e1 31
`6,226,751 B1
`5/2001 Arrowet al.
`5,333,518 B1
`5/3001 S1131111011
`6,243,360 B1
`6/2001 Basilico
`5,343,749 B1
`5/3001 S113131T1311e131
`5,343,754 B1
`5/3001 G11e1111 e131
`6,256,671 B1 *
`7/2001 Strentzsch et al.
`6,263,445 B1
`7/2001 Blumenau
`5,385,047 B1
`9/3001 R31T13113111311e131
`5,301,333 B1
`10/3001 H13S131e131
`6,308,274 B1
`10/2001 Swift
`5,311,307 B1
`10/3001 M1g11d011e131
`5,334,151 B1
`11/3001 K0911
`6,330,562 B1
`12/2001 Boden etal.
`5,333,158 B1 * 13/3001 R151eY e131 ~~~~~~~~~~~~~~ ~- 709/319
`6,353,614 B1
`3/2002 Borella etal.
`5,425,003 B1 *
`7/2002 Herzog el 31 ------------- -- 709/223
`6,430,155 B1
`8/2002 Davie etal.
`6,430,610 B1
`8/2002 Carter
`6,487,598 B1
`11/2002 Valencia
`
`..... .. 370/352
`
`................ .. 713/201
`
`........ .. 709/227
`
`............ .. 709/225
`
`6,502,135 131* 12/2002 Mungeretal.
`6505 232 B1
`1/2003 Mi
`doll etal.
`6:510:154 B1
`1/2003 Magyiiasetal.
`6,549,516 B1
`4/2003 Albefi et 31.
`6,557,037 B1
`4/2003 Provino
`6,571,296 B1
`5/2003 Dillon
`6,571,338 B1
`5/2003 Shaio etal.
`6,581,166 B1
`6/2003 Hirstetal.
`6,606,708 131*
`8/2003 Devine etal.
`6,618,761 B2
`9/2003 Mungeretal.
`6,671,702 B2
`12/2003 Kruglikov etal.
`6,687,551 B2
`2/2004 Steindl
`6,714,970 B1
`3/2004 Fiveash etal.
`6,717,949 B1
`4/2004 Boden et 31.
`6,751,738 132*
`6/2004 Wesingeretal.
`6,760,766 B1
`7/2004 Sahlqvist
`6,826,616 B2
`11/2004 Larson etal.
`6,839,759 B2
`1/2005 Larson et al.
`7,010,604 B1
`3/2006 Mungeretal.
`7,133,930 B2
`11/2006 Munger et al.
`7,188,180 B2
`3/2007 Larson etal.
`7,197,563 B2
`3/2007 Sheymov etal.
`2002/0004898 A1
`1/2002 Droge
`2003/0196122 A1* 10/2003 Wesingeretal.
`2005/0055306 A1
`3/2005 Milleretal.
`2006/0059337 A1*
`3/2006 Poyhonen etal.
`
`............. .. 713/201
`
`.......... .. 713/201
`
`.......... .. 713/201
`
`......... .. 713/165
`
`FOREIGN PATENT DOCUMENTS
`
`E1’
`E1’
`E1’
`E1’
`E1’
`E1’
`013
`013
`013
`013
`W0
`W0
`W0
`W0
`W0
`W0
`W0
`W0
`W0
`W0
`
`0 814 589
`0814 589 A
`0 838 930
`0 838930 A
`835305 A1
`0858189
`3 317 793
`3317 793 A
`3334181 A
`3334181 A
`9837783 A
`W0 98/37783
`W0 9837783 A
`W0 98 55930
`W0 98 59470
`W0 99 38081
`W0 99 48303
`W0 00/ 17775
`W0 00/70458
`W00150588
`
`13/ 1997
`13/1997
`4/ 1998
`4/ 1998
`4/1998
`8/1998
`4/ 1998
`4/ 1998
`8/ 1999
`8/1999
`0/ 1998
`0/ 1998
`5/ 1998
`13/ 1998
`13/1998
`7/ 1999
`9/1999
`3/3000
`11/3000
`7/3001
`
`Internet
`
`OTHER PUBLICATIONS
`Donald E. Eastlake, 3”’, “Domain Name System Security Exten-
`sions”, Internet Draft, Apr. 1998, pp. 1-51.
`D. B. Chapman et al., “Building Internet Firewalls”, Nov. 1995, pp.
`273.375.
`P. Srisuresh etal., “DNA extensions to Network address Translators
`(DNS_ALG)”, Internet Draft, Jul. 1998, pp. 1-27.
`James E. Bellaire, “New Statement of Rules—Namin
`g
`Domains”, Internet Newsgroup, Jul. 30, 1995, lpage.
`1). Clark, “Us C3115 for private D0main_Name system”, Computer
`g0ciety,Aug. 1, 1993,1515. 22-25.
`AugustBequai,“BalancingLegal ConcernsOVerCrimeandSecurity
`in Cyberspace”, Computer & Security, Vol. 17, No. 4, 1998, pp.
`293.298.
`Rich Winkel, “CAQ: Networking With Spooks: The NET & The
`Control Of Information”, Internet Newsgroup, Jun. 21, 1997, 4
`3 es.
`ISe§.rch Report (dated Jun. 18, 2002), International Application No.
`PCT/US01/13260,
`Search Report (dated Jun. 28, 2002), International Application No.
`PCTMS01/13261.
`Donald E. Eastlake, “Domain Name System Security Extensions”,
`DNS Security Working Group, Apr. 1998, 51 pages.
`MANGROVE 1001
`
`MANGROVE 1001
`
`

`
`US 7,490,151 B2
`Page 3
`
`D. B. Chapman et al., “Building Internet Firewalls”, Nov. 1995, pp.
`278-297 and pp. 351-375.
`P. Srisuresh eta1., “DNS extensions to Network Address Translators”,
`Jul. 1998, 27 pages.
`Laurie Wells, “Security Icon”, Oct. 19, 1998, 1 page.
`W. Stallings, “Cryptography And Network Security”, 2“ Edition,
`Chapter 13, IP Security, Jun. 8, 1998, pp. 399-440.
`W. Stallings, “New Cryptography and Network Security Book”, Jun.
`8, 1998, 3 pages.
`Search Report (dated Aug. 20, 2002), International Application No.
`PCT/US01/04340.
`Shree Murthy et al., “Congestion-Oriented Shortest Multipath Rout-
`ing”, Proceedings of IEEE Infocom, 1996, pp. 1028-1036.
`Jim Jones et al., “Distributed Denial of Service Attacks: Defenses”,
`Global Integrity Corporation, 2000, pp. 1-14.
`Fasbender, Kesdogan, and Kubitz: “Variable and Scalable Security:
`Protection of Location Information in Mobile IP”, IEEE publication,
`1996, pp. 963-967.
`Laurie Wells (Lancasterbibelrnail MSN COM); “Subject: Security
`Icon” Usenet Newsgroup, Oct. 19, 1998, XP002200606.
`Davila J et al, “Implementation of Virtual Private Networks at the
`Transport Layer”, Inforn1ation Security, Second International Work-
`shop, ISW ’99. Proceedings (Lecture Springer-Verlag Berlin, Ger-
`many,
`[Online] 1999, pp. 85-102, XP002399276, ISBN 3-540-
`66695-B, retrieved from the Internet: URL: http://www.springerlink.
`com/content/4uac0tb0heccma89/fulltext.pdf> (Abstract).
`Alan 0. Frier et al., “The SSL Protocol Version 30”, Nov. 18, 1996,
`printed from http://www.netscape.com/eng/ssl13/ draft302.b<t on
`Feb. 4, 2002, 56 pages.
`Davila J et al, “Implementation of Virtual Private Networks at the
`Transport Layer”, Inforn1ation Security, Second International Work-
`shop, ISW’99. Proceedings (Lecture Springer-Verlag Berlin, Ger-
`
`[Online] 1999, pp. 85-102, XP002399276, ISBN 3-540-
`many,
`66695-B, retrieved from the Internet: URL: http://www. springerlink.
`com/content/4uac0tb0hecoma89/fulltext.pdf>.
`Dolev, Shlomi and Ostrovsky, Rafil, Efficient Anonymous Multicast
`and Reception (Extended Abstract), 16 pages.
`F. Halsall, “Data Communications, Computer Networks and Open
`Systems”, Chapter 4, Protocol Basics, 1996, pp. 198-203.
`Glossary for the Linux FreeS/WAN project, printed from http://
`liberty.freeswan .org/freeswan_trees/freeswan-1 .3/
`doc/glo ssary.
`html on Feb. 21, 2002, 25 pages.
`J. Gilmore, “Swan: Securing the Internet against Wiretapping”,
`printed from http ://liberty. freeswan. org/freeswan_trees/freeswan- 1 .
`3.doc/rationale.html on Feb. 21, 2002, 4 pages.
`Linux FreeS/WAN Index File, printed from http://liberty.freewan.
`org/freeswan trees/freeswan-1.3/doc/ on Feb. 21, 2002, 3 pages.
`Reiter, Michael K. and Rubin, Aviel D. (AT&T Labs—Research),
`Crowds: Anonymity for Web Transactions, pp. 1-23.
`RFC 2401-Security Architecture for the Internet Protocol (RTP).
`RFC 2543-SIP: Session Initiation Protocol (SIP or SIPS).
`Rubin, Aviel D., Geer, Daniel, and Ranum, Marcus J. (Wiley Com-
`puter Publishing), “Web Security Sourcebook”, pp. 82-94.
`Search Report, IPER (dataed Nov. 13, 2002), International Applica-
`tion No. PCT/USO 1/04340.
`Search Report, IPER (dated Feb. 6, 2002), International Application
`No. PCT/US01/13261.
`Search Report, IPER (dated Jan. 14, 2003), International Application
`No. PCT/US01/13260.
`Shar1kar, A.U. “A verified sliding window protocol with variable flow
`control”. Proceedings of ACM SIGCOMM conference on Commu-
`nications architectures & protocols. pp. 84-91, ACM Press, NY,NY
`1986.
`
`* cited by examiner
`
`MANGROVE 1001
`
`MANGROVE 1001
`
`

`
`U.S. Patent
`
`Feb. 10, 2009
`
`Sheet 1 of 35
`
`US 7,490,151 B2
`
`100
`
`ORKHNAHNG
`TERMINAL
`
`40
`
`107
`
` 28
`
`IP
`ROUTER
`
`110
`
`ENCRYPTION KEY
`
`DEST|NAT|0N
`TERMINAL
`
`FIG. 1
`
`MANGROVE 1001
`
`MANGROVE 1001
`
`

`
`U.S. Patent
`
`Feb. 10, 2009
`
`Sheet 2 of 35
`
`US 7,490,151 B2
`
`100
`
`TARP
`
`TERMINAL
`
`145
`
`TARP PACKET
`
`131
`
`
`
`LINK KEY
`
`TARP
`
`ROUTER
`
`129
`
`IP
`
`ROUTER
`
`128
`
`IP
`ROUTER
`
`TARP
`ROUTER
`
`132
`
`"3
`ROUTER
`
`126
`
`TARP
`ROUTER
`
`127
`
`TARP
`ROUTER
`
`LINK KEY
`
`143
`®T.
`SESS,0N KEY
`
`3.11
`110
`LINK KEY
`TARP PACKET
`
`
`
`
`
`
`
`TARP
`
`TERMINAL
`
`
`
`FIG. 2
`
`MANGROVE 1001
`
`MANGROVE 1001
`
`

`
`U.S. Patent
`
`Feb. 10, 2009
`
`Sheet 3 of 35
`
`US 7,490,151 B2
`
`DATA STREAM Q9
`
`INTERLEAVED
`
`SESS|ON—KEY-ENCRYPTED
`PAYLOAD DATA 3_3g
`
`TARP PACKET WITH
`ENCRYPTED PAYLOADS §4_Q
`
`TARP PACKETS ESQ
`
`LINK-KEY-ENCRYPTED
`
`~-.-,»_ |P PACKETS WI ENCRYPTED
`"
`TARP PACKETS AS
`PAYLOAD 3_6_Q
`
`
`
`
`
`
`TARP
`
`ROUTER 2
`
`TARP
`ROUTER 1
`
`
`
`
`
`TARP
`
`
`
`TARP
`ROUTER 5
`
`TARP
`
`ROUTER 6
`
`TARP
`ROUTER 7
`
`TARP
`
`ROUTER 3
`
`
`
`
`
`TARP
`
`ROUTER 4
`
`
`
`
`
`FIG. 3A
`
`MANGROVE 1001
`
`MANGROVE 1001
`
`

`
`U.S. Patent
`
`Feb. 10, 2009
`
`Sheet 4 of 35
`
`US 7,490,151 B2
`
`892mm><s_
`
`
`<29moeaos§__>_8
`
`
`Ev_.zo_m$aaE%_,m.va3m.
`
`
`
`ea_>aVacsazaozm
`
`§8<o§§z_
`
`
`
`aflozmgomm23%
`
`...IIIIIEIEIE
`
`§_>_$E2ea‘&...£8£3asas
`
`
`
`oma_>aVacsazéuzm
`
`
`
`.mm|a>§%:z_8<o:§9z_
`
`Boss53m853%
`
`
`
`
`
`m§m>,$Ez_mm<o._><n_o._.z_
`
`_.:_>>Evaahas
`
`
`
`%220::EESE
`
`MANGROVE 1001
`
`MANGROVE 1001
`
`
`
`
`

`
`U.S. Patent
`
`W
`
`2Bm
`
`0,
`
`IM%.:m&$_;M§o5m$_z_E,aU
`
`w.o_”_
`
`1.n__2o_.:_>>Mez_m$ooE$3
`
`mzazoo
`
`Wmommmoog
`
`
`
`o._.m_>:.<zm_m._.._<mzo
`
`m_§m>_§z§E%
`
`3$5Ev_§Ez
`
`Agog;
`
`ozamaog
`
`E:mz_m_>_89m>_2_,_$:<$15
`
`9289z_E8.3mommaog.3E:
`
`MANGROVE 1001
`
`MANGROVE 1001
`
`
`
`

`
`U.S. Patent
`
`Feb. 10, 2009
`
`Sheet 6 of 35
`
`US 7,490,151 B2
`
`BACKGROUND LOOP-DECOY
`GENERATION
`
`S0
`
`AUTHENTICATE TARP PACKET
`
`S2
`
`S3
`
`S4
`
`85
`
`37
`
`38
`
`S10
`
`311
`
`MANGROVE 1001
`
`
`
`TRANSMIT DECOY?
`
`
`
`YES
`
`
`
`GENERATE NEXT-HOP TARP
`ADDRESS AND STORE LINK KEY
`AND IP ADDRESS
`
`S9
`
`DETERMINE DESTINATION TARP
`ADDRESS AND STORE LINK KEY
`AND IP ADDRESS
`
`GENERATE NEXT-HOP TARP
`ADDRESS AND STORE LINK KEY
`AND IP ADDRESS
`
`GENERATE IP HEADER
`AND TRANSMIT
`
`FIG. 5
`
`DUMP DECOY
`
`OUTER LAYER DECRYPTION OF
`TARP PACKET USING LINK KEY
`
`CHECK FOR DECOY AND
`INCREMENT PIERISHABLE DECOY
`COUNTER AS APPROPRIATE
`
`MANGROVE 1001
`
`

`
`U.S. Patent
`
`Feb. 10, 2009
`
`Sheet 7 of 35
`
`US 7,490,151 B2
`
`BACKGROUND LOOP-DECOY
`
`GENERATION
`
`320
`
`GROUP RECEIVED IP PACKETS
`INTO INTERLEAVE WINDOW
`
`S21
`
`DETERMINE DESTINATION TARP
`ADDRESS, INITIALIZE TTL, STORE
`IN TARP HEADER
`
`S22
`
`RECORD WINDOW SEQ. NOS. AND
`INTERLEAVE SEQ. NOS IN TARP
`HEADERS
`
`S23
`
`CHOOSE FIRST HOP TARP
`
`
`
`ROUTER, LOOK UP IP ADDRESS
`AND STORE IN CLEAR IP HEADER,
`OUTER LAYER ENCRYPT
`
`S24
`
`INSTALL CLEAR IP HEADER
`
`AND TRANSMIT
`
`S25
`
`FIG. 6
`
`MANGROVE 1001
`
`MANGROVE 1001
`
`

`
`U.S. Patent
`
`Feb. 10, 2009
`
`Sheet 8 of 35
`
`US 7,490,151 B2
`
`S40
`
`ACKROUND LOOP-DECOY
`GENERATION
`
`S42
`
`AUTHENTICATE TARP PACKET
`RECEIVED
`
`349
`
`DIVIDE BLOCK INTO PACKETS s43
`
`USING WINDOW SEQUENCE DATA,
`ADD CLEAR IP HEADERS
`GENERATEDFROM TARP
`HEADERS
`
`DECRYPT OUTER LAYER
`ENCRYPTION WITH LINK KEY
`
`S50
`
`HAND COMPLETED IP PACKETS
`
`TO IP LAYER PROCESS
`
`'N%%EUIfll§Iéy|’E§'§gé$LE
`
`S44
`
`S45
`
`THROW AWAY DECOY OR KEEP
`IN RESPONSE TO ALGORITHM
`
`S46
`
`CACHE TARP PACKETS UNTIL
`WINDOW IS ASSEMBLED
`
`S47
`
`S48
`
`DEINTERLEAVE PACKETS
`FORMING WINDOW
`
`DECRYPT BLOCK
`
`FIG. 7
`
`MANGROVE 1001
`
`MANGROVE 1001
`
`

`
`U.S. Patent
`
`Sheet 9 of 35
`
`US 7,490,151 B2
`
`$58I5.m“as$50502E3Mm?_va<n:_o<25MQmvag25§
`
`
`
`._<z_%.._m:.:,m__d
`
`
`
`
`
`_.aQzo_z:_z_zgmmmmmmamm
`
`
`
`
`
`flV2zo_._.<_._._z_zoawwmwsomw
`
`w.o_u_
`
`MANGROVE 1001
`
`MANGROVE 1001
`
`
`
`

`
`U.S. Patent
`
`US 7,490,151 B2
`
`
`
`m.,aggfie_§.§.§.§M£§.§.E_$§.§.§
`
`
`
`9$.§.E.§_:.§.§.§m§.§.§.§_m2.§.E.§
`
`
`
`Wmwasm>_m8m
`
`
`
`n_m<._
`
`aWmsom
`
` :_>_mz<EWHH %§.§.§.§.§.2N.§mmmwas
`
`
`
`
`
`
`E.g$§2_©$8.2N_§
`
`
`
`5.3.25.5.S~.SN.2N.§
`
`3023.5_2:§:..§
`
`_Hzw:o
`
`am
`
`$.§.2N.§.$.§.£~.§Qwas
`§_.a,z<E
`
`3.3$E.§.§N.§.2~.§
`
`
`
`§.§.2N.§.m2.§.§.§
`
`
`
`52.2.5.=.§.E.§
`
`
`
`Nwwasm>_§m
`
`g.§.§.§_§.§.2N.§
`
`E.§.E.§.$335.5
`
`E.§..E.§.§.§.§.§
`
`$.g§N.§.m:.§.§.§
`
`m.o_n_
`
`MANGROVE 1001
`
`MANGROVE 1001
`
`

`
`U.S. Patent
`
`Feb. 10, 2009
`
`Sheet 11 of 35
`
`US 7,490,151 B2
`
`:0.
`
`N_o_
`
`m_o_
`
`<mw_
`
`mmqg
`
`mmhzom
`
`mmm_
`
`mm¢F
`
`mwpgom
`
`FNOF
`
`NNOF
`
`mNo_
`
`Hzwso
`
`‘
`
`Foo_
`
`2oz
`
`MANGROVE 1001
`
`MANGROVE 1001
`
`
`
`

`
`U.S. Patent
`
`6m,
`
`2
`
`
`
`
`3:mmnmamog<5:2”m$%o<:_._am<3::_._Em
`mm”m$m8<:15%mg:mg:3”m$§<:1En.
`
`
`mmo<m:
`
`mmo<mI
`
`m:<m¢:mzmmI:m
`
`m:<m¢:mzmmI:m
`
`»/.00:
`
`»/.om:
`
`
`Eo<&_E5:FEo<&_mg::”m$E9:_.53a_mE:”m$%9:_W958<3:2_mm%2a_$58m$3:<2:92SE:_%ma03:Os:2SE:__6m_Qm5w$§E_Hmamg:
`
`
`
`
`
`
`
`
`m_‘_‘GE
`
`7,N:23::m2:
`
` 5<2:$3:m.E9:m.mm§<o:$2::a<3:a
`
`
`
`02:m_:Em:_>__%_m_o
`mg:2.mm§§_5%E2”w$%9a_M958
`
`2:
`
`MANGROVE 1001
`
`MANGROVE 1001
`
`
`
`

`
`U.S. Patent
`
`Feb. 10, 2009
`
`Sheet 13 of 35
`
`US 7,490,151 B2
`
`
`
`<N_.®_n_
`
`MANGROVE 1001
`
`gag
`
`fiflaa
`
`MANGROVE 1001
`
`

`
`U.S. Patent
`
`Feb. 10, 2009
`
`Sheet 14 of 35
`
`US 7,490,151 B2
`
`
`
`am:%2z_2_5m_n_
`
`33,;
`
`BE,mm25
`
`025z_
`
`BE,mm25
`
`02$z_
`
`82%mm25
`
`02%z_
`
`$m$m8E_
`
`B_m<>mm25
`
`025z_
`
`82>mm25
`
`oz;z_
`
`82%mm26
`
`023z_
`
`mm<>>e_<_._
`
`$m$§<
`
`382._._<mem_>_$
`
`:m_En_s_8mo
`
`_>_8z§
`
`2%SEmeax:
`
`82%mm25
`
`02$_,__
`
`woos.
`
`mo
`
`._.zm_s__n_oms_m_
`
`%o8m__2oE._
`
`m88w_s_oEN
`
`2n_>mm:
`
`mméei_m
`
`oz_nEo_._
`
`ms.o_“_
`
`MANGROVE 1001
`
`MANGROVE 1001
`
`

`
`U.S. Patent
`
`Feb. 10, 2009
`
`Sheet 15 of 35
`
`US 7,490,151 B2
`
`m_.zm__.6
`
`<._.zm__._o
`
`07%B228
`
`.o._<ozm
`
`22
`
`r_>§o
`
`9dc
`
`m$m8<M958n__
`
`
`
`w$%o<.53.__
`
`was,Q25
`
`2058032;
`
`was,02;,
`
`
`
`2058E<>_i
`
`$3.2:
`
`aE>$zm_
`
`n_<o._><m
`
`22
`
`82
`
`MANGROVE 1001
`
`MANGROVE 1001
`
`
`
`

`
`U.S. Patent
`
`Feb. 10, 2009
`
`Sheet 16 of 35
`
`U
`
`5,
`
`2
`
`$:_s_mz<E
`
`;__<n_n__
`
`Nm_<n_n__
`
`%:__2mz<E
`
`
`
`n_m_mr_.zm__n__om_mn_m_mfiozmm
`
`
`
`
`
`m30_u_
`
`
`
`
`
`$N_zo$_oz>E_,m_n__amo:mQzm$_o$2>mz_Ee_mAIIIII:In|l|v$N_zo$az>mfiozmm9:,_m_n__om_mme07%z_Ev.MA......................--v
`
`
`
`
`
`MANGROVE 1001
`
`MANGROVE 1001
`
`

`
`U.S. Patent
`
`US 7,490,151 B2
`
`
`
`
`oz_s_ooz_._.E>>$>_§<5;__oeB_aE2oz?~__§n__E_oe_85m5.1oz;:_>az,E.E2EsmzmomE:_2mzs:z__.93H.E0u$951wmin__:__oe_omIo
`
`
`
`
`
` $>_§mz___EU#w_as;__oe_..mIoW>>ooz_>>.u:.<on5.>>mmzommmm$>m.$m52wauaxom_mm_>_mommEsmzmooz<:E0m_<n_Mumm_o<m=.__.E>>n=._.z_o$6m_._omm:__>_mz<Eo.z__>_ooz_
`anE2Esmzmo.X202%2%;3”
`
`$>_%<$m02%E1?52ez_%§_025
`
`
`
`
`
`:e2_<.:_mE_s_mz<Ez___E0
`
`3.O_u_
`
`MANGROVE 1001
`
`31-02%©
`zo:.<N_zom_._oz>m5:;©
`
`
`
`§_mz$_me:s_mz<E.28¢
`
`
`
`.§§:Es>._._<o_oo_mmn_
`
`MANGROVE 1001
`
`

`
`U.S. Patent
`
`Feb. 10, 2009
`
`Sheet 18 of 35
`
`US 7,490,151 B2
`
`‘_.
`
`FIG.15
`
`MANGROVE 1001
`
`L()
`05
`’
`
`EQ
`
`4095
`
`Z
`
`4095
`
`4095
`
`i
`
`0
`
`
`
`
`
`(ETHERNETLAN-TWOAADDRESSBLOCKS)
`
`MANGROVE 1001
`
`

`
`U.S. Patent
`
`Feb. 10, 2009
`
`Sheet 19 of 35
`
`US 7,490,151 B2
`
`I INACTIVE
`VA ACTIVE
`USED
`
`MANGROVE 1001
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`7//////////////////////4
`V//I///////////////////.
`7/////'/////////////////.
`
`7////////////////////I/A
`
`FIG. 17
`
`
`
`7//////////////////////A
`
`
`
`°
`.
`7//////////////////////A
`_'///////////////////////A
`
`,/////////////////////m
`7//////////////////////4
`
`
`000
`
`W|NDOW_S|ZE
`
`W|NDOW_S|ZE
`
`MANGROVE 1001
`
`

`
`U.S. Patent
`
`Feb. 10, 2009
`
`Sheet 20 of 35
`
`US 7,490,151 B2
`
`
`
`MANGROVE 1001
`
`—— 7
`
`/////////////////////A
`
`000
`
`W|NDOW_S|ZE
`
`7//////////////////////,
`0'///////////////////////.
` A
`,/////////////////////J
`
`
`W|NDOW_SlZE
`
`.:
`
`FIG. 18
`
`MANGROVE 1001
`
`

`
`U.S. Patent
`
`Feb. 10, 2009
`
`Sheet 21 of 35
`
`US 7,490,151 B2
`
`
`
`’
`
`VA ACTIVE
`
`000
`
`MANGROVE 1001
`
`
`
`
`
`
`
`.
`
`7
`
`,'/////////////////////fl
`_/////////////////////fl
`7/////////////////////fl
`
`
`
`
`
`
`
`000
`
`
`
`W|NDOW_S|ZE
`
`
`
`W////////////////////.
`
`V//////////////////////A
`
`
`
`W|NDOW_S|ZE
`
`:
`
`’.:
`
`
`
`
`7/////////////////////4
`
`FIG. 19
`
`MANGROVE 1001
`
`

`
`U.S. Patent
`
`Feb. 10, 2009
`
`Sheet 22 of 35
`
`US 7,490,151 B2
`
`2011
`
`FIG.20
`
`MANGROVE 1001
`
`
`
`COMPUTER #2
`
`2002
`
`
`
`
`
`COMPUTER #1
`
`2001
`
`2008
`
`2005
`
`MANGROVE 1001
`
`

`
`U.S. Patent
`
`Feb. 10, 2009
`
`Sheet 23 of 35
`
`US 7,490,151 B2
`
`MANGROVE 1001
`
`2101
`
`2102
`
`2103
`
`2104
`
`2105
`
`2106
`
`2107
`
`2108
`
`2109
`
`
`
`
`
`
`
`
`
`AD'LABLE
`
`IP1
`
`IP3
`
`|P2
`
`|P4
`
`AETABLE
`
`AFTABLE
`
`BDTABLE
`
`BETABLE
`
`T’
`V
`
`CDTABLE
`
`CETABLE
`
`CFTABLE
`
`
`
`LWKDOWN
`
`MANGROVE 1001
`
`

`
`U.S. Patent
`
`Feb. 10, 2009
`
`Sheet 24 of 35
`
`US 7,490,151 B2
`
`
`
`
`
`MEASURE
`
`QUALITY OF
`TRANSMISSION
`PATH X
`
`
`
`MORE
`
`THAN ONE
`
`TRANSMITTER
`TURNED
`ON?
`
`
`
`
`2209
`
`SET WEIGHT
`
`TO MIN. VALUE
`
`FIG. 22A
`
`MANGROVE 1001
`
`DECREASE
`WEIGHT FOR
`PATH X
`
`INCREASE WEIGHT
`FOR PATH X
`
`TOWARD STEADY
`
`
`STATE VALUE
`
`
`
`ADJUST WEIGHTS
`
`FOR REMAINING
`
`
`
`
`PATHS SO THAT
`WEIGHTS EQUAL ONE
`
`MANGROVE 1001
`
`

`
`U.S. Patent
`
`Feb. 10, 2009
`
`Sheet 25 of 35
`
`US 7,490,151 B2
`
`
`
`
`SET WEIGHT
`
`TO ZERO
`
`ADJUST WE|GHTS
`FOR REMAINING
`PATHS so THAT
`
`WEIGHTS EQUAL ONE
`
`FIG. 22B
`
`MANGROVE 1001
`
`(EVENT) TRANSMITTER
`FOR PATH x
`
`TURNS OFF
`
`AT LEAST
`
`DROP ALL PACKETS
`
`ONE TRANSMITTER
`
`UNTILATRANSMITTER
`
`TURNED ON?
`
`TURNS ON
`
`2210
`
`2211
`
`2212
`
`2313
`
`2214
`
`MANGROVE 1001
`
`

`
`U.S. Patent
`
`Feb. 10, 2009
`
`Sheet 26 of 35
`
`US 7,490,151 B2
`
`am
`
`82
`
`AA
`
`_.mv_o<..._
`
`$:__>_mz<E
`
`
`
` was._._s_mz<m_._./88
`
`
`
`wasm>_m_8m
`
`82\._Qm.
`
`mm.o:
`
`._._._m_.u_>>
`
`._.zm__E.m:3<
`
`zo_.Sz_.z
`
`
`
`>.:._<:ov_z_._
`
`._.zm__>_m_~=._m<m_s_
`
`zozoza
`
`MANGROVE 1001
`
`MANGROVE 1001
`
`
`
`
`
`

`
`U.S. Patent
`
`Feb. 10, 2009
`
`Sheet 27 of 35
`
`US 7,490,151 B2
`
`$5n__>_8
`
`%E.n_s_8
`
`Ea:
`
`MANGROVE 1001
`
`MANGROVE 1001
`
`

`
`U.S. Patent
`
`Feb. 10, 2009
`
`Sheet 28 of 35
`
`US 7,490,151 B2
`
`moms
`
`Ea$2
`
`$2
`
`mmmgomm
`
`mmd:
`
`E:maze
`
`MANGROVE 1001
`
`MANGROVE 1001
`
`

`
`U.S. Patent
`
`b.M
`
`0mm,
`
`Mnm
`
`US 7,490,151 B2
`
`88
`
`gamzo
`
`fizmm
`
`2o
`
`9:
`
`38
`
`.6.E_mm$_<E%$m
`
`88oz_&o_._n__
`
`:8maammzs
`
`Ha593
`
`om.0_u_
`
`9$nme_as
`
`s$502:5:
`
`mm;
`
`fimgomm
`
`MANGROVE 1001
`
`MANGROVE 1001
`
`
`
`
`

`
`U.S. Patent
`
`Feb. 10, 2009
`
`Sheet 30 of 35
`
`US 7,490,151 B2
`
`2701
`
`RECEIVE DNS
`REQUEST FOR
`
`TARGET SITE
`
`
`
`
`ACCESS TO
`SECURE SITE
`REQUESTED?
`
`
`
`
`
`
`YES
`
`2703
`
`PASS TH RU
`
`REQUEST TO
`DNS SERVER
`
`2705
`
`2702
`
`2704
`
`
`
`USER
`AUTHORIZED TO
`
`
`CONNECT?
`
`
`
`
`RETURN
`"HOST UNKNOWN"
`ERROR
`
`YES
`
`2706
`
`ESTABLISH
`VPN WITH
`
`TARGET SITE
`
`FIG. 27
`
`MANGROVE 1001
`
`MANGROVE 1001
`
`

`
`U.S. Patent
`
`Feb. 10, 2009
`
`Sheet 31 of 35
`
`US 7,490,151 B2
`
`$8$0:
`
`$58£mwazoo
`
`mmd:
`
`MANGROVE 1001
`
`MANGROVE 1001
`
`

`
`U.S. Patent
`
`hR
`
`W
`
`7m
`
`m0,
`
`2
`
`3mm.0_..._
`
`W25_._o_:ga32
`
`gags
`
`$59.
`
`+l
`
`§.§V:m_%mEa_>_8so:
`
`m2%
`
`EN22
`
`33:Em5%,_oo5%
`
`
`
`
`
`Mg22xE_ooo¢$5n_s_oS_ea<_._22
`
`MANGROVE 1001
`
`MANGROVE 1001
`
`
`
`
`

`
`U.S. Patent
`
`Feb. 10, 2009
`
`Sheet 33 of 35
`
`Us 7,490,151 B2
`
`$E_2mz<E
`
`m>_§m
`
`52cm._w_u_
`
`8%
`
`MANGROVE 1001
`
`MANGROVE 1001
`
`

`
`U.S. Patent
`
`Feb. 10, 2009
`
`Sheet 34 of 35
`
`US 7,490,151 B2
`
`3105
`
`3106
`
`3104
`
`CLIENT#2
`
`FIG.31
`
`
`
`
`TX/RXTX/RXTX/RX
`
`3102
`
`MANGROVE 1001
`
`(D
`Z
`1—-
`C’)
`
`I\
`3
`x—--
`O’?
`
`MANGROVE 1001
`
`

`
`U.S. Patent
`
`Feb. 10, 2009
`
`Sheet 35 of 35
`
`US 7,490,151 B2
`
`CLIENT
`
`SERVER
`
`SEND DATA PACKET
`USING CKPT_N
`CKPT_O=CKPT_N
`GENERATE NEW CKPT_N
`START TIMER, SHUT
`TRANSMITTER OFF
`
`IF CKPT_O IN SYNC_ACK
`MATCHES TRANSMITTER'S
`CKPT_O
`UPDATE RECEIVER'S
`CKPT_R
`KILL TIMER, TURN
`TRANSMITTER ON
`
`SEND DATA PACKET
`USING CKPT_N
`CKPT_O=CKPT_N
`GENERATE NEW CKPT_N
`START TIMER, SHUT
`TRANSMITTER OFF
`
`WHEN TIMER EXPIRES
`TRANSMIT SYNC_REQ
`USING TRANSMITTERS
`CKPT_O, START TIMER
`
`IF CKPT_O IN SYNC_ACK
`MATCHES TRANSMITTERS
`CKPT_O
`UPDATE RECEIVER'S
`CKPT_R
`KILL TIMER, TURN
`TRANSMITTER ON
`
`SYNC_REQ
`
`FIG. 32
`
`PASS DATA UP STACK
`CKPT_O=CKPT_N
`GENERATE NEW CKPT_N
`GENERATE NEW CKPT_R
`FOR TRANSMITTER SIDE
`TRANSMIT SYNC_ACK
`CONTAINING CKPT_O
`
`CKPT_O=CKPT_N
`GENERATE NEW CKPT_N
`GENERATE NEW CKPT_R
`FOR TRANSMITTER SIDE
`TRANSMIT SYNC_ACK
`CONTAINING CKPT_O
`
`MANGROVE 1001
`
`MANGROVE 1001
`
`

`
`US 7,490,151 B2
`
`1
`ESTABLISHMENT OF A SECURE
`COMMUNICATION LINK BASED ON A
`
`DOMAIN NAME SERVICE (DNS) REQUEST
`
`CROSS-REFERENCE TO RELATED
`APPLICATIONS
`
`This application is a divisional application of 09/504,783
`(filed Feb. 15, 2000), now U.S. Pat. No. 6,502,135, issued
`Dec. 31, 2002, which claims priority from and is a continua-
`tion-in-part of previously filed U.S. application Ser. No.
`09/429,643 (filed Oct. 29, 1999) now U.S. Pat. No. 7,010,604.
`The subject matter of the ’643 application, which is bodily
`incorporated herein, derives from provisional U.S. applica-
`tion No. 60/106,261 (filed Oct. 30, 1998) and 60/137,704
`(filed Jun. 7, 1999).
`
`GOVERNMENT CONTRACT RIGHTS
`
`This invention was made with Government support under
`Contract No. 360000-1999-000000-QC-000-000 awarded by
`the Central Intelligence Agency. The Government has certain
`rights in the invention.
`
`BACKGROUND OF THE INVENTION
`
`A tremendous variety of methods have been proposed and
`implemented to provide security and anonymity for commu-
`nications over the Internet. The variety stems, in part, from the
`different needs of different Internet users. A basic heuristic
`
`framework to aid in discussing these different security tech-
`niques is illustrated in FIG. 1. Two terminals, an originating
`terminal 100 and a destination terminal 110 are in communi-
`cation over the Internet. It is desired for the communications
`
`to be secure, that is, immune to eavesdropping. For example,
`terminal 100 may transmit secret information to terminal 110
`over the Internet 107. Also, it may be desired to prevent an
`eavesdropper from discovering that terminal 100 is in com-
`munication with terminal 1 10. For example, ifterminal 1 00 is
`a user and terminal 110 hosts a web site, terminal 100’s user
`may not want anyone in the intervening networks to know
`what web sites he is “visiting.” Anonymity would thus be an
`issue, for example, for companies that want to keep their
`market research interests private and thus would prefer to
`prevent outsiders from knowing which web-sites or other
`Internet resources they are “visiting.” These two security
`issues may be called data security and anonymity, respec-
`tively.
`Data security is usually tackled using some form of data
`encryption. An encryption key 48 is known at both the origi-
`nating and terminating terminals 100 and 110. The keys may
`be private and public at the originating and destination termi-
`nals 100 and 110, respectively or they may be symmetrical
`keys (the same key is used by both parties to encrypt and
`decrypt). Many encryption methods are known and usable in
`this context.
`
`To hide trafiic from a local administrator or ISP, a user can
`employ a local proxy server in communicating over an
`encrypted channel with an outside proxy such that the local
`administrator or ISP only sees the encrypted trafiic. Proxy
`servers prevent destination servers from determining the
`identities of the originating clients. This system employs an
`intermediate server interposed between client and destination
`server. The destination server sees only the Internet Protocol
`(IP) address ofthe proxy server and not the originating client.
`The target server only sees the address of the outside proxy.
`This scheme relies on a trusted outside proxy server. Also,
`
`10
`
`15
`
`20
`
`25
`
`30
`
`35
`
`40
`
`45
`
`50
`
`55
`
`60
`
`65
`
`2
`
`proxy schemes are vulnerable to trafiic analysis methods of
`determining identities of transmitters and receivers. Another
`important limitation of proxy servers is that the server knows
`the identities of both calling and called parties. In many
`instances, an originating terminal, such as terminal A, would
`prefer to keep its identity concealed from the proxy, for
`example, ifthe proxy server is provided by an Internet service
`provider (ISP).
`To defeat traffic analysis, a scheme called Chaum’s mixes
`employs a proxy server that transmits and receives fixed
`length messages, including dummy messages. Multiple origi-
`nating terminals are connected through a mix (a server) to
`multiple target servers. It is difficult to tell which of the
`originating terminals are communicating to which ofthe con-
`nected target servers, and the dummy messages confuse
`eavesdroppers’ efforts to detect communicating pairs by ana-
`lyzing traffic. A drawback is that there is a risk that the mix
`server could be compromised. One way to deal with this risk
`is to spread the trust among multiple mixes. If one mix is
`compromised, the identities of the originating and target ter-
`minals may remain concealed. This strategy requires a num-
`ber of alternative mixes so that the intermediate servers inter-
`
`posed between the originating and target terminals are not
`determinable except by compromising more than one mix.
`The strategy wraps the message with multiple layers of
`encrypted addresses. The first mix in a sequence can decrypt
`only the outer layer of the message to reveal the next desti-
`nation mix in sequence. The second mix can decrypt the
`message to reveal the next mix and so on. The target server
`receives the message and, optionally, a multi-layer encrypted
`payload containing return information to send data back in
`the same fashion. The only way to defeat such a mix scheme
`is to collude among mixes. If the packets are all fixed-length
`and intermixed with dummy packets, there is no way to do
`any kind of trafiic analysis.
`Still another anonymity technique, called ‘crowds,’ pro-
`tects the identity of the originating terminal from the inter-
`mediate proxies by providing that originating terminals
`belong to groups ofproxies called crowds. The crowd proxies
`are interposed between originating and target terminals. Each
`proxy through which the message is sent is randomly chosen
`by an up stream proxy. Each intermediate proxy can send the
`message either to another randomly chosen proxy in the
`“crowd” or to the destination. Thus, even crowd members
`carmot determine if a preceding proxy is the originator of the
`message or if it was simply passed from another proxy.
`ZKS (Zero-Knowledge Systems) Anonymous IP Protocol
`allows users to select up to any of five different pseudonyms,
`while desktop software encrypts outgoing trafiic and wraps it
`in User Datagrarn Protocol (UDP) packets. The first server in
`a 2+-hop system gets the UDP packets, strips off one layer of
`encryption to add another, then sends the traffic to the next
`server, which strips off yet another layer of encryption and
`adds a new one. The user is permitted to control the number of
`hops. At the final server, trafiic is decrypted with an untrace-
`able IP address. The technique is called onion-routing. This
`method can be defeated using trafiic analysis. For a simple
`example, bursts of packets from a user during low-duty peri-
`ods can reveal the identities of sender and receiver.
`
`Firewalls attempt to protect LANs from unauthorized
`access and hostile exploitation or damage to computers con-
`nected to the LAN. Firewalls provide a server through which
`all access to the LAN must pass. Firewalls are centralized
`systems that require administrative overhead to maintain.
`They can be compromised by virtual-machine applications
`(“applets”). They instill a false sense of security that leads to
`security breaches for example by users sending sensitive
`MANGROVE 1001
`
`MANGROVE 1001
`
`

`
`US 7,490,151 B2
`
`3
`information to servers outside the firewall or encouraging use
`of modems to sidestep the firewall security. Firewalls are not
`useful for distributed systems such as business travelers,
`extranets, small teams, etc.
`
`SUMMARY OF THE INVENTION
`
`A secure mechanism for communicating over the intemet,
`including a protocol referred to as the TunneledAgile Routing
`Protocol (TARP), uses a unique two-layer encryption format
`and special TARP routers. TARP routers are similar in func-
`tion to regular IP routers. Each TARP router has one or more
`IP addresses and uses normal IP protocol to send IP packet
`messages
`(“packets” or “datagrams”). The IP packets
`exchanged between TARP terminals via TARP routers are
`actually encrypted packets whose true destination address is
`concealed except to TARP routers and servers. The normal or
`“clear” or “outside” IP header attached to TARP IP packets
`contains only the address of a next hop router or destination
`server. That is, instead of indicating a final destination in the
`destination field of the IP header, the TARP packet’s IP
`header always points to a next-hop in a series of TARP router
`hops, or to the final destination. This means there is no overt
`indication from an intercepted TARP packet of the true des-
`tination of the TARP packet since the destination could
`always be next-hop TARP router as well as the final destina-
`tion.
`
`Each TARP packet’s true destination is concealed behind a
`layer of encryption generated using a link key. The link key is
`the encryption key used for encrypted communication
`between the hops intervening between an originating TARP
`terminal and a destination TARP terminal. Each TARP router
`
`can remove the outer layer of encryption to reveal the desti-
`nation router for each TARP packet. To identify the link key
`needed to decrypt the outer layer of encryption of a TARP
`packet, a receiving TARP or routing terminal may identify the
`transmitting terminal by the sender/receiver IP numbers in the
`cleartext IP header.
`
`Once the outer layer of encryption is removed, the TARP
`router determines the final destination. Each TARP packet
`140 undergoes a minimum number of hops to help foil trafiic
`analysis. The hops may be chosen at random or by a fixed
`value. As a result, each TARP packet may make random trips
`among a number of geographically disparate routers before
`reaching its destination. Each trip is highly likely to be dif-
`ferent for each packet composing a given message because
`each trip is independently randomly determined. This feature
`is called agile routing. The fact that different packets take
`different routes provides distinct advantages by m