Blind Host Covert Data Transmission and Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current communication protocols, such as TCP/IP, do not effectively mask the origin of a data payload during transmission, making it possible to trace back the source even with encryption, and there is a need for a method to detect covert transmissions using techniques like the blind bounce back method.

Innovation Solution

Implementing a system that utilizes the TCP/IP protocols to transmit data through a blind host, making it appear as if the data originated from the blind host, and using error messages to conceal the true origin, while also detecting such covert transmissions by monitoring patterns of digital behavior.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If data is transmitted using standard TCP/IP protocols, then communication reliability is improved, but the origin of the data payload can be traced back making covert transmission impossible

Engineering Contradiction:

Improvecommunication reliabilityVSAvoidtraceability of data origin

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent introduces a blind host as an intermediary that relays data between the true origin host and destination host. The blind host strips identifying information from packets and replaces it with its own identifying information, making the data appear to originate from the blind host rather than the true origin host. This mediator approach maintains communication reliability while enabling covert transmission by masking the true origin.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Loss of information

If encryption is used to mask data content, then data confidentiality is improved, but the origin of the payload remains detectable

Engineering Contradiction:

Improvedata confidentialityVSAvoiddetectability of payload origin

Core Design Contradiction:

Loss of informationVSObject-affected harmful factors

Solution Approach 1:

The blind host acts as an intermediary that not only handles encrypted data but also strips and replaces identifying information in packet headers. This dual function maintains data confidentiality through encryption while simultaneously masking the payload origin through header manipulation, resolving the contradiction between these two security requirements.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent segments the communication process into distinct phases: encryption of data content, stripping of identifying information, and replacement with blind host identifying information. This segmentation allows independent handling of confidentiality and origin masking requirements, enabling both to be satisfied simultaneously.

Inventive Principle:

Principle #1Segmentation

3Object-affected harmful factors

If covert transmission methods are implemented, then origin masking is improved, but detection of covert payloads becomes more difficult

Engineering Contradiction:

Improvemasking of true originVSAvoiddetection of covert payloads

Core Design Contradiction:

Object-affected harmful factorsVSDifficulty of detecting and measuring

Solution Approach 1:

The blind host changes the 'color' or identifying information in packet headers by replacing the true origin host's identifying information with its own. This makes the packets appear to come from a different source, effectively masking the true origin while maintaining normal-appearing communication patterns that are harder to detect as covert.

Inventive Principle:

Principle #32Color changes

4Object-affected harmful factors

If blind bounce back method is used for covert transmission, then origin concealment is improved, but network security monitoring becomes more challenging

Engineering Contradiction:

Improveconcealment of originVSAvoidnetwork security monitoring complexity

Core Design Contradiction:

Object-affected harmful factorsVSDevice complexity

Solution Approach 1:

The blind host serves as a mediator in the blind bounce back method, receiving data from the true origin host and forwarding it to the destination host with modified identifying information. This intermediary approach conceals the origin while creating a relatively simple monitoring architecture where the blind host's traffic patterns can be monitored to detect covert transmissions without requiring complex analysis of all network traffic.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS11689543B2System and method for detecting transmission of a covert payload of data

Publication Date: 2023.06.27 RANKIN LABS LLC

AI summary

Systems and methods for detecting transmission of covert payloads of data are provided. A datagram is received at a host within a network. A determination is made that processing the datagram creates an error condition. A determination is made that that the datagram contains a payload intended for covert transmission where at least one suspicious condition is present. The suspicious conditions include an encrypted payload, a destination not matching any known address for hosts within the network, a time to live value matching the number of gateways traversed by the datagram within the network, and a particular type of error condition.