System and method for evaluating and enhancing source anonymity for encrypted web traffic

• US 20050157706A1
• Filed: 02/24/2005
• Published: 07/21/2005
• Est. Priority Date: 04/23/2002
• Status: Active Grant

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Sun, Oixiang, Simon, Daniel R., Wang, Yi-Min, Padmanabhan, Venkata N., Qiu, Lili, Russell, Wilfred
• Granted Patent: US 7,640,215 B2
• Time in Patent Office: Days
• US Class Current: 370/352
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/102 Bill distribution or payments
• CPC Class Codes: G06Q 20/1085 involving automatic teller machines [ATMs]
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A system and method is provided for evaluating the effectiveness of data encryption for hiding the identity of the source of Web traffic. A signature is constructed from encrypted Web traffic for a Web page sent by a target Web site, and the signature is compared with archived traffic signatures obtained by accessing various Web pages of interest in advance. If the signature of the detected encrypted Web traffic matches a stored traffic signature beyond a pre-set statistical threshold, a positive match is found, and the source of the traffic is identified. Countermeasures for reducing the reliability of source identification based on traffic signature matching are provided.

Claims

1-25. -25. (canceled)

26. In a networking environment, a method for an Internet client to access a Web page, the Web page comprising a plurality of objects, the method comprising:

sending a request to access the Web page;

receiving a plurality of objects of the Web page, the received objects encrypted and padded;

decrypting the plurality of objects; and

removing padding from each decrypted object.

27. The method of claim 26 further comprising:

receiving at least one encrypted extraneous object, the extraneous object not of the Web page;

decrypting the extraneous object; and

discarding the extraneous object.

28. A computer-readable medium containing computer-executable instructions for a method for an Internet client to access a Web page, the Web page comprising a plurality of objects, the method comprising:

sending a request to access the Web page;

receiving a plurality of objects of the Web page, the received objects encrypted and padded;

decrypting the plurality of objects; and

removing padding from each decrypted object.

29. In a networking environment, a system for accessing a Web page, the Web page comprising a plurality of objects, the system comprising:

the Web page;

an Internet client configured for sending a request to access the Web page;

for receiving a plurality of objects of the Web page, the received objects encrypted and padded;

for decrypting the plurality of objects; and

for removing padding from each decrypted object; and

a Web server configured for receiving a request to access the Web page;

for padding each object of the Web page;

for encrypting the padded objects of the Web page; and

for transmitting the encrypted and padded objects.

30. The system of claim 29:

wherein the Internet client is further configured for receiving at least one encrypted extraneous object, the extraneous object not of the Web page;

for decrypting the extraneous object; and

for discarding the extraneous object; and

wherein the Web server is further configured for creating the extraneous object;

for encrypting the extraneous object; and

for transmitting the encrypted extraneous object.

31. A computer-readable medium having stored thereon a Web page data structure, the Web page data structure comprising:

a first data field containing data representing a first encrypted, padded object of a Web page; and

a second data field containing data representing a second encrypted, padded object of the Web page.

32. The computer-readable medium of claim 31 wherein the Web page data structure further comprises:

a third data field containing an encrypted extraneous object, the extraneous object not of the Web page.