Packet Header Randomization via Nonce Substitution
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security measures fail to protect packet headers from intruders, who can use monitored traffic patterns to identify IP addresses and launch targeted attacks, despite payload encryption.
Innovation Solution
A system and method that randomizes packet headers using nonces, which are managed by a controller that provides routing rules to network devices, allowing packets to be routed without exposing actual source and destination addresses, and utilizes existing network infrastructure with minimal overhead.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Object-affected harmful factors
If packet headers are encrypted to protect source and destination addresses, then network security is improved, but packets become unroutable because network devices cannot read the headers
Solution Approach 1:
The patent introduces random nonce values as intermediary placeholders that replace actual source and destination addresses in packet headers. These nonces act as mediators that allow encrypted/proteced headers to still be routable, as network devices can forward packets based on nonce-based routing rules without needing to read the actual addresses.
Solution Approach 2:
The patent changes the parameter representation in packet headers by substituting traditional address fields with random nonce values. This parameter transformation allows the header structure to maintain routability while protecting the actual address information, resolving the contradiction between security and routing capability.
2Ease of operation
If actual source and destination addresses are used in packet headers, then packet routing is simplified, but intruders can monitor traffic patterns and identify IP addresses
Solution Approach 1:
Random nonce values serve as intermediary placeholders that decouple the routing function from the actual address information. Network devices use the nonces for routing decisions while the real addresses remain hidden, preventing intruders from monitoring traffic patterns and identifying IP addresses through header analysis.
Solution Approach 2:
The patent creates a copy of the address information in the form of random nonce values that are used for routing purposes. This copy allows network devices to perform routing operations without exposing the actual address data, thereby protecting against traffic pattern analysis while maintaining routing functionality.
3Object-affected harmful factors
If nonces are used in place of actual addresses, then traffic pattern detection is complicated, but network device complexity increases due to additional routing rule management
Solution Approach 1:
The patent merges the routing rule management function into the existing network device infrastructure by integrating nonce-based routing with standard routing protocols. This integration approach minimizes additional complexity while achieving the security benefit of obfuscating traffic patterns through nonce usage.
Data Source
AI summary
A system and method for the randomization of packet headers is disclosed. A controller is used to provide random values, also referred to as nonces, that replace the source and destination addresses that typically appear in a packet header. The controller also provides routing rules to the switches and routers in the network that allow these devices to properly route packets, even though the source and destination addresses are not present. In some embodiments, network devices that support software-defined networking (SDN) are employed. The number of times that a particular nonce is used may be variable. In some embodiments, a nonce is used for exactly one packet header. In this way, packets may traverse a network using nonces in place of actual source and destination addresses. Because the nonces are changed periodically, detection of traffic patterns is made significantly more difficult.