Decoy Routing System for Covert Channel Bonding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for avoiding IP filtering and monitoring on the Internet are inadequate, as they often rely on visible proxy server lists and encryption techniques that can be easily detected and blocked by adversaries, compromising privacy and communication security.
Innovation Solution
The implementation of decoy routing systems and methods that use decoy routers and proxies to transmit packets with decoy destination IP addresses, allowing communications to appear as if they are intended for permissible destinations, thereby circumventing IP filtering and monitoring, while using secure communication channels like TLS, SSL, and VoIP to maintain privacy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional proxy servers and encryption techniques are used to avoid IP filtering, then communication privacy is improved, but the system becomes easily detectable and blockable by adversaries
Solution Approach 1:
The patent introduces decoy routers and decoy proxies as intermediary components between the client and the covert destination. These intermediaries create a layered communication path where the adversary sees only decoy traffic patterns, not the actual communication flow. The decoy router receives packets from the client and forwards them to the decoy proxy, which then communicates with the covert destination, effectively hiding the true communication path from the adversary.
Solution Approach 2:
The system dynamically changes communication parameters by switching between multiple decoy destinations and varying the timing and patterns of packet transmission. The client can select from multiple decoy destinations, and the system can adjust communication parameters such as packet intervals, sizes, and protocols to match legitimate traffic patterns, making detection by the adversary more difficult.
2Reliability
If decoy routing is implemented to circumvent IP filtering, then communication security is improved, but system complexity increases due to multiple decoy routers and proxies
Solution Approach 1:
The decoy router and decoy proxy are designed to perform multiple functions within a single system. The decoy router not only routes packets but also establishes communication channels, manages packet forwarding, and coordinates with the decoy proxy. The decoy proxy similarly handles multiple tasks including receiving packets from the decoy router, forwarding them to the covert destination, and managing the communication channel. This multi-functionality reduces the need for separate specialized components.
Solution Approach 2:
The patent combines the functions of routing, proxying, and channel establishment into integrated components. The decoy router and decoy proxy work as a unified system where the boundary between routing and proxying is blurred. The communication channel establishment is merged with the packet forwarding process, and the management of multiple decoy destinations is integrated into the core routing logic, reducing overall system complexity.
3Productivity
If multiple communication channels are used for covert channel bonding, then bandwidth is improved, but latency may increase due to packet assembly and routing through multiple channels
Solution Approach 1:
The system performs preliminary actions by pre-establishing communication channels and pre-routing packets through the decoy infrastructure before the actual covert communication begins. The decoy router and proxy are configured in advance, and the communication pathways are tested and validated beforehand. This preliminary setup reduces the time required for packet assembly and routing during actual communication, minimizing latency while maintaining high bandwidth through the bonded channels.
Data Source
AI summary
Systems, methods, and devices for decoy routing and covert channel bonding are described. The decoy routing system includes a client computing device, a decoy router, and a decoy proxy such that packets addressed to a decoy destination are re-routed by the decoy router to a covert destination via the decoy proxy. The decoy routing method may be applied to a covert channel bonding process, in which a plurality of packet data streams are sent to one or more decoy destinations, re-routed appropriately via one or more decoy routers and/or decoy proxies, and assembled together into a single packet data stream at either a decoy proxy, or a final covert destination.