Encrypted Media Detection via Traffic Statistics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods fail to detect media data streams among encrypted and tunneled data due to the randomness of encrypted traffic, which hinders the application of quality improvement techniques such as forward error correction and congestion control in real-time communications.
Innovation Solution
The system employs a tunneling client and server to establish a tunnel for real-time communications, using statistical analysis of inter-frame delay, payload size, and entropy to detect encrypted media data streams, enabling the application of enhancement features like forward error correction and congestion control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encrypted tunneling is used for real-time communications, then security and privacy are improved, but the ability to detect media data streams is worsened due to the randomness of encrypted traffic
Solution Approach 1:
The patent changes the parameters used for media detection from content-based analysis to statistical analysis of traffic characteristics. By monitoring payload size, inter-frame delay, and payload entropy over time, the system can detect media streams without decrypting the encrypted content, thus maintaining security while enabling detection.
Solution Approach 2:
The patent introduces an intermediary detection mechanism that operates at the tunnel level rather than requiring access to the encrypted content. The tunneling server or client acts as an intermediary that collects statistical data about the encrypted traffic and uses this information to identify media streams, bridging the gap between encryption and detection needs.
2Difficulty of detecting and measuring
If statistical analysis is performed on encrypted traffic to detect media streams, then media detection capability is improved, but system complexity increases due to the need to collect and analyze multiple parameters
Solution Approach 1:
The patent makes the tunneling server or client perform multiple functions: it simultaneously handles the encryption/decryption of real-time communications and the statistical analysis for media detection. This multi-functionality reduces the need for separate dedicated detection systems, thereby managing complexity while improving detection capability.
Solution Approach 2:
The system performs self-detection by having the tunneling endpoints (server or client) themselves collect and analyze the statistical parameters of their own traffic. This self-service approach eliminates the need for external monitoring systems, reducing overall system complexity while maintaining effective media detection.
Data Source
AI summary
A system that performs encrypted media detection for real-time communications (“RTC”) establishes a tunnel by a tunneling server with a tunneling client of a user equipment (“UE”). The system receives a request from the UE to enable the encrypted media detection for the tunnel and sends a response back to the UE to indicate that the encrypted media detection is enabled for the tunnel. For each encrypted frame transmitted over the tunnel, the system stores corresponding data that includes at least one of a payload size, an inter-frame delay or a payload entropy. Based on stored corresponding data, the system determines if the encrypted frame includes an encrypted media data frame.