Methods, systems and computer program products for obscuring traffic in a distributed system

• US 20060041653A1
• Filed: 10/21/2004
• Published: 02/23/2006
• Est. Priority Date: 08/23/2004
• Status: Active Grant

• Current Assignee: LinkedIn Corporation (Microsoft Corporation)
• Original Assignee: Bellsouth Intellectual Property Corporation (AT&T, Inc.)
• Inventors: Aaron, Jeffrey A.
• Granted Patent: US 7,747,774 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: G09B 7/00 Electrically-operated teaching apparatus or devices working with questions and answers mechanically operated G09B3/00; computing arrangements G06F
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002

Abstract

Methods for obscuring real traffic in a distributed network are provided. In particular, obscuring traffic associated with ones of a plurality of components is generated on the distributed network. The generated obscuring traffic is transmitted to the ones of the plurality of components so as to obscure the real traffic from intruders of the distributed network. Related systems and computer program products are also provided.

Claims

1. A method for obscuring real traffic in a distributed network, comprising:

generating obscuring traffic associated with ones of a plurality of components coupled to the distributed network; and

transmitting the generated obscuring traffic to the ones of the plurality of components so as to obscure the real traffic from intruders of the distributed network.

2. The method of claim 1, further comprising maintaining knowledge of the obscuring traffic so as to allow differentiation between the generated obscuring traffic and the real traffic in the distributed network.

3. The method of claim 2, wherein maintaining knowledge comprises transmitting update messages to the ones of the plurality of components so as to allow the components to distinguish between the generated obscuring traffic and the real traffic.

4. The method of claim 3, wherein transmitting update messages further comprises transmitting a first update message for a first time period and transmitting a second update message for a second time period before expiration of the first time period.

5. The method of claim 1, further comprising:

receiving the transmitted obscuring traffic at the ones of the plurality of components; and

discarding the received obscuring traffic at the ones of the plurality of components.

6. The method of claim 1, wherein generating the obscuring traffic comprises randomly generating dummy traffic for the ones of the plurality of components and wherein transmitting the generated obscuring traffic comprises transmitting the generated dummy traffic.

7. The method of claim 6, wherein randomly generating dummy traffic comprises randomly generating the dummy traffic using pseudo-random codes (PRCs) and/or pseudo-random number (PRNs) codes.

8. The method of claim 7, wherein generating the dummy traffic comprises generating a plurality of dummy packets and wherein generating the dummy packets comprises generating the dummy packets using a sequence formed from a start position and a data field length in the PRC that identifies a dummy message for the dummy packet and a start position and data field length in the PRC that identifies a time to release the dummy message.

9. The method of claim 1, wherein generating the obscuring traffic comprises generating a list of messages to be included in dummy packets and wherein transmitting the generated obscuring traffic comprises transmitting dummy packets including messages from the list.

10. The method of claim 9, further comprising generating update messages including a message identifier referring to a message in the list of messages, a source identifier, a destination identifier and a transmit time for the associated dummy packet and wherein generating the obscuring traffic comprises generating the dummy packets using a script or sequencing method that utilizes the message identifier, the source identifier and the transmit time.

11. The method of claim 1, wherein generating the obscuring traffic comprises generating a dummy packet including data from a previously transmitted real packet and wherein transmitting the generated obscuring traffic comprises transmitting the dummy packet including the data from the previously sent real packet.

12. The method of claim 1, wherein generating the obscuring traffic comprises generating the obscuring traffic using a mathematical algorithm.

13. The method of claim 1, further comprising increasing or decreasing an amount of generated obscuring traffic responsive to a perceived threat to the distributed network.

14. The method of claim 1, wherein generating obscuring traffic comprises generating different obscuring traffic for each of the ones of a plurality of components coupled to the distributed network.

15. A system for obscuring real traffic in a distributed network, comprising:

a deceiver circuit configured to generate obscuring traffic associated with ones of a plurality of components coupled to the distributed network; and

a transmission circuit configured transmit the generated obscuring traffic to the ones of the plurality of components so as to obscure the real traffic from intruders of the distributed network.

16. The system of claim 15, wherein the deceiver circuit is further configured to maintain knowledge of the obscuring traffic so as to allow differentiation between the generated obscuring traffic and the real traffic in the distributed network.

17. The system of claim 16, wherein the deceiver circuit is further configured to maintain knowledge of the obscuring traffic by transmitting update messages to the ones of the plurality of components so as to allow the components to distinguish between the generated obscuring traffic and the real traffic.

18. The system of claim 17, wherein the deceiver circuit is further configured to transmit a first update message for a first time period and transmit a second update message for a second time period before expiration of the first time period.

19. The system of claim 15, further comprising:

a receiver circuit configured to receive the transmitted obscuring traffic at the ones of the plurality of components; and

a data handling circuit configured discard the received obscuring traffic at the ones of the plurality of components.

20. The system of claim 15, wherein the deceiver circuit is further configured to randomly generate dummy traffic for the ones of the plurality of components and wherein transmission circuit is further configured to transmit the generated dummy traffic.

21. The system of claim 20, wherein the deceiver circuit is further configured to randomly generate the dummy traffic using pseudo-random codes (PRCs) and/or pseudo-random number (PRNs) codes.

22. The system of claim 21, wherein the deceiver circuit is further configured to generate a plurality of dummy packets using a sequence formed from a start position and a data field length in the PRC that identifies a dummy message for the dummy packet and a start position and data field length in the PRC that identifies a time to release the dummy message.

23. The system of claim 15, wherein the deceiver circuit is configured to generate a list of messages to be included in dummy packets and wherein the transmission circuit is further configured to transmit the dummy packets including messages from the list.

24. The system of claim 23, wherein the deceiver circuit is further configured to generate update messages including a message identifier referring to a message in the list of messages, a source identifier, a destination identifier and a transmit time for the associated dummy packet and generate the obscuring traffic using a script or sequencing method that utilizes the message identifier, the source identifier and the transmit time.

25. The system of claim 15, wherein the deceiver circuit is further configured to generate a dummy packet including data from a previously transmitted real packet and wherein the deceiver circuit is further configured to transmit the dummy packet including the data from the previously sent real packet.

26. The system of claim 15, wherein the deceiver circuit is further configured to generate the obscuring traffic using a mathematical algorithm.

27. The system of claim 15, wherein the deceiver circuit is further configured to increase or decrease an amount of generated obscuring traffic responsive to a perceived threat to the distributed network.

28. The system of claim 15, wherein the deceiver circuit is further configured to generate different obscuring traffic for each of the ones of a plurality of components coupled to the distributed network.

29. A system for obscuring real traffic in a distributed network, comprising:

means for generating obscuring traffic associated with ones of a plurality of components coupled to the distributed network; and

means for transmitting the generated obscuring traffic to the ones of the plurality of components so as to obscure the real traffic from intruders of the distributed network.

30. The system of claim 29, further comprising means for maintaining knowledge of the obscuring traffic so as to allow differentiation between the generated obscuring traffic and the real traffic in the distributed network.

31. The system of claim 30, further comprising:

means for receiving the transmitted obscuring traffic at the ones of the plurality of components; and

means for discarding the received obscuring traffic at the ones of the plurality of components.

32. A computer program product for obscuring real traffic in a distributed network, the computer program product comprising:

a computer readable medium having computer readable program code embodied therein, the computer readable program product comprising;

computer readable program code configured to generate obscuring traffic associated with ones of a plurality of components coupled to the distributed network; and

computer readable program code configured to transmit the generated obscuring traffic to the ones of the plurality of components so as to obscure the real traffic from intruders of the distributed network.

33. The computer program product of claim 32, further comprising computer readable program code configured to maintain knowledge of the obscuring traffic so as to allow differentiation between the generated obscuring traffic and the real traffic in the distributed network.

34. The computer program product of claim 33, further comprising computer readable program code configured to transmit update messages to the ones of the plurality of components so as to allow the components to distinguish between the generated obscuring traffic and the real traffic.

35. The computer program product of claim 34, wherein the computer readable program code configured to transmit update messages further comprises computer readable program code configured to transmit a first update message for a first time period and transmit a second update message for a second time period before expiration of the first time period.

36. The computer program product of claim 32, further comprising:

computer readable program code configured to receive the transmitted obscuring traffic at the ones of the plurality of components; and

computer readable program code configured to discard the received obscuring traffic at the ones of the plurality of components.

37. The computer program product of claim 32, further comprising:

computer readable program code configured randomly generate dummy traffic for the ones of the plurality of components; and

computer readable program code configured to transmit the generated obscuring traffic comprises transmitting the generated dummy traffic.

38. The computer program product of claim 37, further comprising computer readable program code configured to randomly generate the dummy traffic using pseudo-random codes (PRCs) and/or pseudo-random number (PRNs) codes.

39. The computer program product of claim 38, wherein the computer readable program code configured to generate the dummy traffic comprises computer readable program code configured to generate a plurality of dummy packets and computer readable program code configured to generate the dummy packets comprises computer readable program code configured to generate the dummy packets using a sequence formed from a start position and a data field length in the PRC that identifies a dummy message for the dummy packet and a start position and data field length in the PRC that identifies a time to release the dummy message.

42. The computer program product of claim 32, further comprising:

computer readable program code configured to generate a dummy packet including data from a previously transmitted real packet; and

computer readable program code configured to transmit the dummy packet including the data from the previously sent real packet.

43. The computer program product of claim 32, further comprising computer readable program code configured to generate the obscuring traffic using a mathematical algorithm.

44. The computer program product of claim 32, further comprising computer readable program code configured to increase or decrease an amount of generated obscuring traffic responsive to a perceived threat to the distributed network.

45. The computer program product of claim 32, further comprising computer readable program code configured to generate different obscuring traffic for each of the ones of a plurality of components coupled to the distributed network.

40. The computer program product of 32, further comprising:

computer readable program code configured to generate a list of messages to be included in dummy packets; and

computer readable program code configured to transmit dummy packets including messages from the list.

41. The computer program product of claim 40, further comprising computer readable program code configured to generate update messages including a message identifier referring to a message in the list of messages, a source identifier, a destination identifier and a transmit time for the associated dummy packet, wherein the computer readable program code configured to generate comprises computer readable program code configured to generate the obscuring traffic using a script or sequencing method that utilizes the message identifier, the source identifier and the transmit time.

46. A method of obscuring real traffic in a distributed network, comprising:

transmitting true data packets from a first component to a second component in the distributed network;

generating obscuring data packets; and

transmitting the generated obscuring data packets from the first component to the second component so as to obscure the true data packets from intruders of the distributed network.

47. The method of claim 46, further comprising maintaining knowledge of the obscuring data packets so as to allow differentiation between the generated obscuring data packets and the true data packets in the distributed network.

48. The method of claim 46, further comprising:

receiving the transmitted obscuring data packets at the second components; and

discarding the received obscuring data packets at the ones of the plurality of components.

49. The method of claim 46, wherein generating the obscuring data packets comprises randomly generating dummy traffic.

50. The method of claim 49, wherein randomly generating dummy traffic comprises randomly generating the dummy traffic using pseudo-random codes (PRCs) and/or pseudo-random number (PRNs) codes.

51. The method of claim 46, wherein generating the obscuring data packets comprises generating a list of messages to be included in the obscuring data packets.