Network Data Obfuscation via Message Segment Reordering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security methods, particularly those relying on encryption and certificate authorities, are vulnerable to attacks, especially when data is transmitted over unsecured networks, as compromised private or session keys can decrypt messages, and certificate authorities can be subverted, leading to potential data breaches.
Innovation Solution
The implementation of a network data obfuscation system that uses an obfuscation driver and gateway to reorder message segments and change obfuscation seeds with each message, providing an additional layer of security that makes messages undecipherable even with compromised keys, and can be seamlessly integrated into existing networks with low processing overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If encryption methods are used to secure network data transmission, then data security is improved, but vulnerability to attacks increases due to compromised keys and subverted certificate authorities
Solution Approach 1:
The patent segments the data transmission process by dividing messages into multiple segments and reordering them. This segmentation approach prevents attackers from obtaining meaningful information even if they compromise encryption keys, as the segmented and reordered data becomes unintelligible without the correct reordering sequence.
Solution Approach 2:
The patent introduces an intermediary obfuscation layer between the encryption layer and the network transmission. This intermediary layer performs message segmentation and reordering operations, adding an additional security barrier that is independent of the encryption keys and certificate authorities, thereby reducing vulnerability to attacks targeting those components.
2Reliability
If message segments are reordered for obfuscation, then security against key compromise is improved, but processing complexity increases
Solution Approach 1:
The patent divides messages into segments and applies reordering operations. While this increases processing steps, the segmentation allows for efficient implementation where each segment can be independently processed and stored, reducing the computational burden compared to processing entire messages as single units.
Solution Approach 2:
The patent performs message segmentation and reordering in advance before transmission. This preliminary action ensures that the obfuscation is already in place when data leaves the system, eliminating the need for complex real-time processing during transmission and reducing overall processing complexity.
3Reliability
If obfuscation layer is added to existing networks, then data security is enhanced, but integration complexity increases
Solution Approach 1:
The patent designs the obfuscation mechanism to work with existing encryption protocols and network infrastructure. The message segmentation and reordering functions can be implemented as a universal layer that operates independently of specific encryption algorithms or network protocols, allowing seamless integration into existing networks without requiring fundamental changes to the infrastructure.
4Reliability
If multiple obfuscation operations are performed on each message, then undecipherability is improved, but processing time increases
Solution Approach 1:
The patent applies segmentation to divide the obfuscation process into discrete, manageable operations. By segmenting both the data and the obfuscation operations, the system can efficiently process each segment independently, reducing the cumulative processing time compared to applying multiple complex operations on entire messages.
Solution Approach 2:
The patent performs obfuscation operations including segmentation and reordering in advance before data transmission. This preliminary processing ensures that undecipherability is established before data leaves the secure environment, eliminating the need for repeated processing operations during transmission and reducing overall processing time.
Data Source
AI summary
Network data obfuscation is disclosed. For example, an obfuscation driver is initialized in an endpoint device connected to an obfuscation gateway over a secure connection by collaboratively generating a unique machine identifier of the endpoint device. An obfuscated communication session is established between the obfuscation driver and the obfuscation gateway. Obfuscated messages including obfuscation seeds, de-obfuscation instructions and message payloads are exchanged between the obfuscation driver and the obfuscation gateway. Obfuscating and de-obfuscating a given message includes reordering a plurality of message segments of the message based on the de-obfuscation instructions. A de-obfuscated message from the obfuscation driver is forwarded to an application, and a response is obfuscated by the obfuscation gateway before being transmitted to the obfuscation driver. An obfuscation seed exchange occurs between the obfuscation gateway and the obfuscation driver while the application is processing the de-obfuscated message.