Encrypted Traffic Obfuscation for DoH Length and Timing Analysis
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing DNS-over-HTTPS (DoH) traffic analysis attacks can infer user web browsing activities through machine-learning-based techniques that exploit unencryptable features such as query/response lengths and timing, despite encryption, rendering null-byte padding ineffective.
Innovation Solution
A combination of compression-aware padding, fake query injection, and random delaying of queries is employed to obfuscate query/response lengths, counts, and timings, using a processor to adjust data packets with obfuscation payloads before encryption and transmission.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If DNS queries are encrypted using DoH protocol, then user browsing privacy is protected from direct inspection, but traffic analysis attacks can still infer browsing activities through packet length and timing analysis
Solution Approach 1:
The system performs preliminary actions by injecting fake DNS queries and responses before the actual browsing traffic occurs. These pre-injected queries establish baseline traffic patterns that mask the characteristics of real browsing activities, making it difficult for attackers to distinguish between fake and real traffic patterns during analysis
Solution Approach 2:
The system introduces an intermediary layer of obfuscation by injecting fake queries and responses that act as mediators between the actual browsing traffic and the network observer. These intermediary elements modify the traffic characteristics to hide the true browsing patterns while maintaining legitimate DNS functionality
2Object-affected harmful factors
If null-byte padding is applied to DNS queries as recommended in RFC 8467, then some obfuscation is provided, but machine-learning-based traffic analysis attacks can still achieve over 95% accuracy in identifying visited websites
Solution Approach 1:
The system changes multiple parameters simultaneously including packet length distribution, timing intervals, and query frequency by injecting varying numbers of fake queries with different characteristics. This multi-parameter approach creates a more complex traffic pattern that cannot be easily distinguished from legitimate browsing activity by machine learning models
Solution Approach 2:
The system creates a composite traffic pattern by combining real DNS queries with multiple types of fake queries and responses. This composite approach mixes different traffic characteristics together, making it difficult for attackers to identify which components are genuine and which are obfuscation elements
3Reliability
If fake DNS queries and responses are injected to obfuscate traffic patterns, then traffic analysis attack accuracy is reduced to below 9%, but additional network overhead is introduced
Solution Approach 1:
The system applies partial obfuscation by injecting a limited number of fake queries strategically designed to provide sufficient protection without overwhelming the network with excessive traffic. The obfuscation level is calibrated to achieve the necessary privacy protection while minimizing the quantity of additional traffic generated
Data Source
AI summary
A system and methods to obfuscate encrypted data packets from traffic analysis attacks are disclosed. At a high level, a processing device: executes an application or protocol for receiving traffic associated with the application or protocol; selects an obfuscation interval duration for a next transmission of a data packet; determines, at the obfuscation interval duration, if a queue for transmission of a next data packet associated with the application or protocol is: i) empty, or ii) has a next data packet associated with an application or protocol; and transmits, based on the determination, at least one of: i) a length-adjusted next encrypted data packet, or ii) an encrypted obfuscation data packet. In The transmitted length-adjusted encrypted next data packet can be generated using the next data packet and is adjusted in length with an obfuscation payload prior to encryption and subsequent transmission.