Variable Padding for Encrypted Packet Size Masking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing padding techniques for encrypted packets in communication networks are inefficient in masking shorter packet sizes, allowing unauthorized parties to identify them, and result in excessive bandwidth consumption when padding all packets to a maximum size.
Innovation Solution
A method that randomly selects a padding size for each plaintext packet between a minimum and maximum size, ensuring that packets smaller than a predefined minimum size are padded to a range inferiorly limited by that size, thereby masking shorter packet sizes effectively while reducing bandwidth usage.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If all plaintext packets are padded to the maximum transmission unit (MTU) size, then shorter packet sizes are effectively masked, but bandwidth consumption increases significantly
Solution Approach 1:
The patent changes the padding parameter from a fixed value (MTU) to a variable value selected from multiple possible sizes. The system dynamically adjusts the padding size based on the original packet size, applying different padding amounts to different packets rather than uniformly padding all packets to MTU size. This resolves the contradiction by maintaining size masking effectiveness while reducing unnecessary bandwidth consumption.
Solution Approach 2:
The patent introduces dynamic selection of padding sizes from a set of available sizes. Instead of a static padding approach where all packets are padded to the same maximum size, the system dynamically chooses appropriate padding sizes based on the characteristics of each plaintext packet. This dynamic approach allows the system to adapt to different packet sizes, effectively masking short packets while minimizing bandwidth waste on larger packets.
2Device complexity
If deterministic padding is applied based on packet size, then encryption processing is simplified, but traffic pattern analysis can reveal information about communicated content
Solution Approach 1:
The patent changes the padding size parameter from being deterministically derived from packet size to being selected from multiple possible sizes. This introduces variability into the padding process, making it harder for traffic pattern analysis to reveal information about the original packet sizes or communicated content, while still maintaining manageable processing complexity through the use of predefined size options.
3Loss of information
If random padding size is selected from multiple options, then traffic pattern analysis becomes more difficult, but padding process complexity increases
Solution Approach 1:
The patent employs parameter changes by selecting padding sizes from a predefined set of options rather than using arbitrary random values. This approach enhances traffic pattern concealment while controlling complexity through the use of discrete, manageable size options. The system balances security requirements with implementation feasibility by working with a finite set of padding size parameters.
Solution Approach 2:
The patent applies partial randomization by selecting from a limited set of padding sizes rather than using full random padding. This partial approach provides sufficient obfuscation to prevent traffic pattern analysis while avoiding the excessive complexity of completely random padding schemes. The system achieves adequate security with minimal additional complexity.
Data Source
AI summary
A method is provided for transmitting encrypted packets from a first node to a second node of a communication network. The first node pads each plaintext packet with a respective padding content. The padded plaintext packets are then encrypted and transmitted to the second node. For each plaintext packet, the first node randomly selects the padding size in a range comprised between a minimum padding size and a maximum padding size. If the size of a plaintext packet is lower than a predefined minimum packet size, the minimum padding size is set equal to the difference between predefined minimum packet size and the plaintext packet size.