# US 11,310,078 B2 · Cipher stream based secure packet communications with key stream transmission over diverse paths

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,310,078 B2
- Document ID: US11310078B2
- Status: Granted
- Kind: B2
- Application number: 16/244,177
- Filed: 2019-01-10
- Published: 2019-07-11
- Granted: 2022-04-19
- Earliest claimed: 2018-01-11
- Assignees: Wesley Rogers
- Applicants: nexVortex, Inc.
- Inventors: Randall Paul Joseph Ethier; Anatoly Y. Rodionov; Jordan Steven Feldman
- Web page: https://patentgrep.com/patent/US11310078B2

## CPC

- H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)}
- H04L 9/0618: {Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation}
- H04L 9/065: {Encryption by serially and continuously modifying data stream elements, e.g. stream cipher systems, RC4, SEAL or A5/3}
- H04L 45/50: using label swapping, e.g. multi-protocol label switch [MPLS]
- H04L 47/825: {Involving tunnels, e.g. MPLS}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

Techniques for sending encrypted data includes establishing a plurality of different links between a first node and a different second node. The different links are different physical layer links or different virtual private network (VPN) links or some combination. The method also includes encrypting plaintext using a first value for an encryption parameter to produce ciphertext. Further, the method includes sending a first plurality of messages that indicate the ciphertext using at least one link of the plurality of different links. Still further, the method includes sending a different second plurality of messages that indicate the first value for the encryption parameter using at least one different link of the plurality of different links without introducing a random bit error.

## Claims

### Claim 1

A method implemented on a processor for sending ciphertext over a network, the method comprising:
establishing a plurality of diverse paths between a single sending node and a different single receiving node, wherein the diverse paths are different physical layer links or different virtual private network (VPN) links or some combination;
encrypting plaintext at the sending node using a first value for an encryption parameter to produce ciphertext and determining a key configured to convert the ciphertext to the plaintext;
fragmenting at the sending node a cipher stream of cipher packets that indicates the ciphertext over at least two paths of the plurality of diverse paths; and
sending from the sending node a key stream of key packets that indicates the key over at least one path of the plurality of diverse paths without introducing a random bit error, wherein no particular key packet is configured to decrypt any cipher packet on a same path as the particular key packet.

### Claim 2 (depends on 1)

The method as recited in claim 1, wherein:
the key is a keystream nonce for XOR encryption that is the same keystream nonce for XOR decryption; and
the cipher-packets and the key packets alternate over the diverse paths, but a cipher packet and a corresponding key packet are not sent over the same path.

### Claim 3 (depends on 2)

The method as recited in claim 2, wherein the cipher packets and the key packets alternate randomly over the plurality of diverse paths.

### Claim 4 (depends on 1)

The method as recited in claim 1, wherein each cipher packet and each key packet includes a sequence number and the cipher packets are not sent in the same sequence order.

### Claim 5 (depends on 1)

The method as recited in claim 1, wherein each cipher packet and each key packet also includes data that indicates a session identifier that indicates a packet belongs to the plaintext and not to a different plaintext.

### Claim 6 (depends on 1)

The method as recited in claim 1, wherein each cipher and each key packet also includes data that indicates a group identifier that indicates a path over which the packet is sent belongs to the plurality of diverse paths.

### Claim 7 (depends on 1)

The method as recited in claim 1, wherein an encryption algorithm that uses the key is different for different packets or for different plaintext.

### Claim 8 (depends on 1)

The method as recited in claim 1, wherein the plurality of diverse paths includes at least one unidirectional link.

### Claim 9 (depends on 1)

The method as recited in claim 1, wherein the cipher packets are sent during a first time interval and the key packets are sent during a different second time interval.

### Claim 10 (depends on 9)

The method as recited in claim 9, wherein the first time interval and the second time interval do not overlap in time.

### Claim 11

A non-transitory computer-readable medium carrying one or more sequences of instructions, wherein execution of the one or more sequences of instructions by one or more processors causes the one or more processors to perform the steps of:
establishing a plurality of diverse paths between a single sending node and a different single receiving node, wherein the diverse paths are different physical layer links or different virtual private network (VPN) links or some combination;
encrypting plaintext using a first value for an encryption parameter to produce ciphertext and determining a key configured to convert the ciphertext to the plaintext;
fragmenting at the sending node a cipher stream of cipher packets that indicates the ciphertext over at least two paths of the plurality of diverse paths; and
sending a key stream of key packets that indicates the key over at least one path of the plurality of diverse paths without introducing a random bit error, wherein no particular key packet is configured to decrypt any cipher packet on a same path as the particular key packet.

### Claim 12

A system comprising:
at least one processor;
a plurality of communication links; and
at least one memory including one or more sequences of instructions,
the at least one memory and the one or more sequences of instructions configured to, with the at least one processor, cause the apparatus to perform at least the following,
establishing a plurality of diverse paths between a single sending node and a different single receiving node, wherein the diverse paths are different physical layer links or different virtual private network (VPN) links or some combination;
encrypting plaintext at the sending node using a first value for an encryption parameter to produce ciphertext and determining a key configured to convert the ciphertext to the plaintext;
fragmenting a cipher stream of cipher packets that indicates the ciphertext over at least two paths of the plurality of diverse paths; and
sending a key stream of key packets that indicates the key over at least one path of the plurality of diverse paths without introducing a random bit error, wherein no particular key packet is configured to decrypt any cipher packet on a same path as the particular key packet.