System and method for evaluating and enhancing source anonymity for encrypted web traffic

Abstract

A system and method is provided for evaluating the effectiveness of data encryption for hiding the identity of the source of Web traffic. A signature is constructed from encrypted Web traffic for a Web page sent by a target Web site, and the signature is compared with archived traffic signatures obtained by accessing various Web pages of interest in advance. If the signature of the detected encrypted Web traffic matches a stored traffic signature beyond a pre-set statistical threshold, a positive match is found, and the source of the traffic is identified. Countermeasures for reducing the reliability of source identification based on traffic signature matching are provided.

Description

TECHNICAL FIELD OF THE INVENTION [0001] This invention relates generally to communications over a computer network, and more particularly to the evaluation of the vulnerability of Web traffic to attempts to identify the sources of the Web traffic, and to the provision of effective countermeasures against such privacy attacks. BACKGROUND OF THE INVENTION [0002] Protecting communication privacy is an important issue for all types of electronic communication, especially when the communication data are sent over a large network, such as the Internet, where an adverse party can easily intercept the communication data. The recent rise of the World Wide Web on the Internet has triggered serious concerns about the possible threats to privacy associated with Web browsing. The browsing user's location or other types of personal information may be inadvertently disclosed if the communication data traffic is intercepted by an adverse observer. Even partial revelation of such information can cau...

AI Technical Summary

Benefits of technology

[0008] The present invention also provides various ways to make it more difficult to identify the source of the encrypted Web traffic based on statistical matching of traffic signatures of the encrypted Web traffic. The countermeasures generally include three types of traffic-shaping schemes: padding, mimicking, and morphing. In particular, countermeasures including exponential padding of object sizes, padding by adding objects, mimicking other Web pages, random blocking of Web advertisement objects, and using multiple browsers to fetch randomly selected Web pages at the same time to mix objects of various Web pages in the traffic, can be used to modify the pattern of encrypted Web traffic for a Web page to reduce the uniqueness of the traffic signature.

Problems solved by technology

Protecting communication privacy is an important issue for all types of electronic communication, especially when the communication data are sent over a large network, such as the Internet, where an adverse party can easily intercept the communication data.

The recent rise of the World Wide Web on the Internet has triggered serious concerns about the possible threats to privacy associated with Web browsing.

The browsing user's location or other types of personal information may be inadvertently disclosed if the communication data traffic is intercepted by an adverse observer.

Even partial revelation of such information can cause embarrassment and / or financial detriments or even compromise safety.

For instance, a user found to be browsing Web pages containing certain types of medical or financial information may inadvertently reveal, through implied interest in that information, embarrassing or confidential financial information about himself.

As another example, a user may reveal that he is out of town, thereby making his home vulnerable to burglary, simply by accessing a private home security Web server from abroad.

Even with the combination of data encryption and using intermediate proxies, Web traffic anonymity is still not guaranteed.

Generally, even when multiple proxies are used, the first link on the routing chain (i.e., the link between the user and the first proxy) is the most vulnerable to attack, since an attacker (which may be the first proxy itself, the user's ISP, or perhaps an eavesdropper, especially on a wireless link) can immediately determine the user's network address.

Images