Secure data routing and randomization
AssigneeN3Xtwork, LLC
InventorJohn P. Keyerleber
Life of this patent
Estimating the term…
Abstract
A networked device creates a plurality of concurrent communication channels within a VPN tunnel between two networks, each channel being identifiable only by a set of IP addresses that are anonymized from the actual IP address of the communication endpoints. Traffic sent from the first network to the second may take any of a plurality of channels, with a randomized channel assignment on a per packet basis. By these means, the endpoints of communication are obfuscated. Further, transmitted data is spread apart or scattered across multiple channels, therefore, an eavesdropper would not have access to the entirety of a data communication.
Claims16
A network device comprising:
- a memory configured to store a data routing table;
- and
- one or more processing units configured to execute instructions stored in the one or more memories to perform steps comprising:
- (a) establishing, within a virtual private network (VPN) tunnel to a destination, a plurality of logical communication channels;
- (b) receiving, from a trusted source, a plurality of data packets;
- (c) randomly selecting, for each data packet of the plurality of data packets, a value from a set of possible values, the number of possible values in the set being equal to the number of established logical communication channels in the plurality of logical communication channels;
- (d) assigning, to each data packet of the plurality of data packets, metadata corresponding to the randomly selected value;
- (e) selecting, for each data packet of the plurality of data packets, based on the assigned metadata, a logical communication channel for egress;
- and
- (f) transmitting each of the plurality of data packets to the destination via the selected logical communication channel.
An apparatus operatively coupled to a private network and one or more public networks, the apparatus comprising:
- one or more network communication interfaces, and
- a processor configured to perform steps comprising:
- (a) establishing, for each of the one or more network communication interfaces, a plurality of logical communication channels to a remote private network, each logical communication channel corresponding to a unique transmission route between the private network and the remote private network via the one or more public networks;
- (b) receiving a plurality of data packets;
- (c) randomly selecting, for each data packet of the plurality of data packets, a value from a set of possible values, the number of possible values in the set being equal to the number of established logical communication channels in the plurality of logical communication channels;
- (d) assigning, to each data packet of the plurality of data packets, metadata corresponding to the randomly selected value;
- (e) selecting, for each data packet of the plurality of data packets, based on the assigned metadata, a logical communication channel for egress;
- and
- (f) transmitting each of the plurality of data packets to the destination via the selected logical communication channel.
A method comprising:
- establishing, by a device coupled to a first network, within a virtual private network (VPN) tunnel, a plurality of logical communication channels between the device coupled to a first network and a device coupled to a second network remote from the first network, each logical communication channel corresponding to a unique data transmission route between the first network and the second private network;
- (b) receiving, by the device coupled to the first network, a plurality of data packets;
- (c) randomly selecting, for each data packet of the plurality of data packets, a value from a set of possible values, the number of possible values in the set being equal to the number of established logical communication channels in the plurality of logical communication channels;
- (d) assigning, by the device coupled to the first network, to each data packet of the plurality of data packets, metadata corresponding to the randomly selected value;
- (e) selecting, for each data packet of the plurality of data packets, based on the assigned metadata, a logical communication channel for egress;
- and
- (f) transmitting, by the device coupled to the first network, each of the plurality of data packets to the device coupled to the second network, via the selected logical communication channel.
Dependencies are inferred from the claim text.