US6834310B2
Expired / Lapsed
US
⏱️ 0.0 years remaining
Preventing packet flooding of a computer on a computer network
Assignee: Virnetx Inc
•
Filing: 2002-02-26
•
Granted: 2004-12-21
•
Expires: 2022-02-26
Abstract
Abstract A plurality of computer nodes communicate using seemingly random Internet Protocol source and destination addresses. Data packets matching criteria defined by a moving window of valid addresses are accepted for further processing, while those that do not meet the criteria are quickly rejected. Improvements to the basic design include (1) a load balancer that distributes packets across different transmission paths according to transmission path quality; (2) a DNS proxy server that transparently creates a virtual private network in response to a domain name inquiry; (3) a large-to-small link bandwidth management feature that prevents denial-of-service attacks at system chokepoints; (4) a traffic limiter that regulates incoming packets by limiting the rate at which a transmitter can be synchronized with a receiver; and (5) a signaling synchronizer that allows a large number of nodes to communicate with a central node by partitioning the communication function between two separate entities.
Inventors
- 👤 Edmund Colby Munger
- 👤 Douglas Charles Schmidt
- 👤 Robert Dunham Short, III
- 👤 Victor Larson
Bibliographic Details
Application Number
—
Jurisdiction
US
Data Source
google_patents
Last Synchronized
2026-10-25 08:43
CPC Classifications
H; H04; H04L; H04L45/00; H04L45/24; H04L45/243; H04L45/28; H04L61/00; H04L61/35; H04L61/45; H04L61/4505; H04L61/4511; H04L61/50; H04L61/5007; H04L61/5076; H04L61/5092; H04L63/00; H04L63/02; H04L63/0272; H04L63/04; H04L63/0407; H04L63/0414; H04L63/0428; H04L63/08; H04L63/14; H04L63/1441; H04L63/1458; H04L63/1466; H04L63/1491; H04L65/00; H04L65/40; H04L65/403; H04L2101/00; H04L2101/60; H04L2101/604; H04L63/10
Claims Analysis
Total Claims: 22
Claim 1
Independent Claim
125 words
In a system including a high bandwidth link and a low bandwidth link, a method of preventing flooding of a receiving computer with data packets, comprising the steps of: (1) receiving data packets from the high bandwidth link that are ostensibly addressed to a computer residing on the low-bandwidth link; (2) for each data packet, determining whether the data packet is validly addressed to the computer on the low-bandwidth link; (3) in response to determining that the data packet is not validly addressed to the computer on the low-bandwidth link, rejecting the data packet; and (4) in response to determining that the data packet is validly addressed to the computer on the low-bandwidth link, forwarding the data packet to the computer over the low-bandwidth link.
Claim 2
Dependent Claim
125 words
In a system including a high bandwidth link and a low bandwidth link, a method of preventing flooding of a receiving computer with data packets, comprising the steps of: (1) receiving data packets from the high bandwidth link that are ostensibly addressed to a computer residing on the low-bandwidth link; (2) for each data packet, determining whether the data packet is validly addressed to the computer on the low-bandwidth link; (3) in response to determining that the data packet is not validly addressed to the computer on the low-bandwidth link, rejecting the data packet; and (4) in response to determining that the data packet is validly addressed to the computer on the low-bandwidth link, forwarding the data packet to the computer over the low-bandwidth link.
Claim 3
Dependent Claim
37 words
The method of claim 1 , wherein step (3) comprises the step of comparing a value in a header of each data packet to a set of valid values maintained for the computer on the low-bandwidth link.
Claim 4
Dependent Claim
30 words
The method of claim 2 , wherein step (3) comprises the step of comparing a value in a header of each data packet to a moving window of valid values.
Claim 5
Dependent Claim
46 words
The method of claim 3 , wherein step (3) comprises the step of comparing the IP address in the header of each data packet to a moving window of valid IP addresses, wherein the moving window is also maintained by the computer on the low-bandwidth link.
Claim 6
Dependent Claim
48 words
The method of claim 1 , wherein step (3) comprises the step of reducing a priority level of the packet in relation to other data packets, wherein the priority level determines whether a particular data packet will be transmitted before another data packet having a different priority level.
Claim 7
Dependent Claim
30 words
The method of claim 1 , wherein step (3) comprises the step of performing a cryptographic check on each data packet to determine whether each data packet is validly addressed.
Claim 8
Dependent Claim
31 words
The method of claim 1 , wherein step (3) comprises the step of receiving a message from the computer on the low-bandwidth link to stop accepting messages having a particular characteristic.
Claim 9
Dependent Claim
33 words
The method of claim 7 , wherein step (3) comprises the step of receiving a message from the computer on the low-bandwidth link to stop accepting messages addressed to a particular IP address.
Claim 10
Dependent Claim
27 words
The method of claim 1 , wherein step (3) comprises the step of determining that a packet transmission rate has been exceeded for a given packet parameter.
Claim 11
Dependent Claim
28 words
The method of claim 9 , wherein step (3) comprises the step of determining that a packet transmission rate has been exceeded for a given IP destination address.
Claim 12
Dependent Claim
101 words
In a system having a low bandwidth data link, a first computer coupled to the low bandwidth data link, and a high bandwidth data link, an improvement comprising: a second computer coupled between the low bandwidth data link and the high bandwidth data link, wherein the second computer receives data packets from the high bandwidth data link and, if they are addressed to the first computer, routes them to the first computer over the low bandwidth data link, wherein the second computer prevents invalid data packets ostensibly addressed to the first computer from being transmitted over the low bandwidth data link.
Claim 13
Dependent Claim
101 words
In a system having a low bandwidth data link, a first computer coupled to the low bandwidth data link, and a high bandwidth data link, an improvement comprising: a second computer coupled between the low bandwidth data link and the high bandwidth data link, wherein the second computer receives data packets from the high bandwidth data link and, if they are addressed to the first computer, routes them to the first computer over the low bandwidth data link, wherein the second computer prevents invalid data packets ostensibly addressed to the first computer from being transmitted over the low bandwidth data link.
Claim 14
Dependent Claim
47 words
The system of claim 11 , wherein the second computer prevents invalid data packets from being transmitted over the low bandwidth data link by comparing a discriminator field in a header of each data packet to a table of valid discriminator fields maintained for the first computer.
Claim 15
Dependent Claim
30 words
The system of claim 11 , wherein the second computer compares an Internet Protocol (IP) address in a header of each data packet to a table of valid IP addresses.
Claim 16
Dependent Claim
40 words
The system of claim 13 , wherein the second computer compares the IP address in the header of each data packet to a moving window of valid IP addresses, wherein the moving window is also maintained by the first computer.
Claim 17
Dependent Claim
46 words
The system of claim 11 , wherein the second computer reduces a priority level of a data packet in relation to other data packets, wherein the priority level determines whether a particular data packet will be transmitted before another data packet having a different priority level.
Claim 18
Dependent Claim
27 words
The system of claim 11 , wherein the second computer performs a cryptographic check on each data packet to determine whether each data packet is validly addressed.
Claim 19
Dependent Claim
30 words
The system of claim 11 , wherein the second computer receives a message from the first computer that causes the second computer to stop accepting messages having a particular characteristic.
Claim 20
Dependent Claim
27 words
The system of claim 17 , wherein the second computer receiving a message from the first computer to stop accepting messages addressed to a particular IP address.
Claim 21
Dependent Claim
28 words
The system of claim 11 , wherein the second computer rejects invalid packets by determining that a packet transmission rate has been exceeded for a given packet parameter.
Claim 22
Dependent Claim
25 words
The system of claim 19 , wherein the second computer determines that a packet transmission rate has been exceeded for a given IP destination address.
References Cited (Backward Citations)
US4933846A
Cited
US5367643A
Cited
US5588060A
Cited
US5878231A
Cited
US5689566A
Cited
US5842040A
Cited
EP0814589A2
Cited
US6016318A
Cited
US5892903A
Cited
GB2317792A
Cited
US6052788A
Cited
US5898830A
Cited
EP0838930A2
Cited
US5796942A
Cited
WO1998027783A1
Cited
US5805801A
Cited
US5905859A
Cited
US6301223B1
Cited
EP0858189A2
Cited
US6178505B1
Cited
WO1998055930A1
Cited
WO1998059470A2
Cited
WO1999038081A1
Cited
US6079020A
Cited
US6119171A
Cited
US6353614B1
Cited
WO1999048303A2
Cited
US6226751B1
Cited
DE19924575A1
Cited
US6286047B1
Cited
US6243749B1
Cited
US6006259A
Cited
US6332158B1
Cited
US6330562B1
Cited
WO2001050688A1
Cited
USPTO Annuity & Maintenance Windows
| Annuity Stage | Window Opens | Payment Deadline | Surcharge Period Until | Estimated Fee | Status |
|---|---|---|---|---|---|
| 3.5 Years (Year 4) | 2007-12-21 | 2008-06-21 | 2008-12-21 | $2000.00 | Window Closed / Lapsed |
| 7.5 Years (Year 8) | 2011-12-21 | 2012-06-21 | 2012-12-21 | $3760.00 | Window Closed / Lapsed |
| 11.5 Years (Year 12) | 2015-12-21 | 2016-06-21 | 2016-12-21 | $7700.00 | Window Closed / Lapsed |