APPARATUS AND METHOD FOR PATTERN HIDING AND TRAFFIC HOPPING

• US 20130254364A1
• Filed: 12/31/2012
• Published: 09/26/2013
• Est. Priority Date: 03/22/2012
• Status: Active Grant

• Current Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Original Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Inventors: Sankalia, Anish, Moganti, Madhav, Pandit, Mayuresh
• Granted Patent: US 9,621,407 B2
• Time in Patent Office: Days
• US Class Current: 709/223
• CPC Class Codes: H04L 41/00 Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A secure communication mechanism is disclosed. The secure communication mechanism may utilize one or more secure communication capabilities to secure communications of various types of users in various types of networks. The secure communication capabilities may include one or more of a user pattern hiding capability (e.g., a user behavior pattern hiding capability, a user communication pattern hiding capability, a user browsing pattern hiding capability, or the like), a gateway hopping capability, or the like, as well as various combinations thereof. The users may include corporate users (e.g., for communications related to corporate matters or for communications related to personal matters), user associated with non-corporate entities, individuals not associated with a corporation or other type of entity (e.g., individual users, groups of users, or the like), or the like.

Claims

1. An apparatus, comprising:

a processor and a memory communicatively connected to the processor, the processor configured to;

maintain a virtual user space for a user, the virtual user space comprising a virtual user identity associated with the user and a virtual user device associated with a user device of the user, wherein the virtual user identity comprises virtual user information for the user that is at least partially different than real user information associated with the user, wherein the virtual user device comprises virtual user device information for the user device that is at least partially different than real user device information associated with the user device;

receive an indication of a communication action initiated at the user device of the user; and

process the communication action for the user based on at least one of the virtual user identity associated with the user or the virtual user device associated with the user device of the user.

2. The apparatus of claim 1, wherein the virtual user information comprises at least one of a virtual name for the user to be used in place of a real name of the user or a virtual address for the user to be used in place of a real address of the user.

3. The apparatus of claim 1, wherein the virtual user device information comprises at least one of a virtual device identifier to be used in place of a real device identifier of the user device, virtual user device type information to be used in place of real user device type information of the user device, or virtual device model information to be used in place of real user device model information of the user device,

4. The apparatus of claim 1, wherein the processor is configured to process the communication action for the user by:

propagating information toward at least one destination device specified in the indication of the action.

5. The apparatus of claim 4, wherein the information comprises at least one of a request for service, a request to establish a voice connection, a request to establish a data connection, an e-mail message, a text message, an instant message, or a request to use a network-based service.

6. The apparatus of claim 1, wherein the indication of the communication action comprises information, wherein the processor is configured to process the communication action for the user by:

replacing at least a portion of the information in the indication of the communication action with at least one of virtual user information of the virtual user identify or virtual user device information of the virtual user device.

7. The apparatus of claim 1, wherein the processor is configured to:

receive, from a device, a communication response intended for the user device of the user;

generate a communication action response, for the communication response received from the device, based on at least one of the virtual user identity and the virtual user device; and

propagate the communication action response toward the user device.

8. The apparatus of claim 7, wherein the processor is configured to generate the communication action response based on at least one of the virtual user identity and the virtual user device by:

replacing at least a portion of the information in the communication response received from the device with at least one of real user information associated with the virtual user identity or real user device information associated with the virtual user device.

9. The apparatus of claim 1, wherein the virtual user space is hosted within a service provider network.

10. An apparatus, comprising:

a processor and a memory communicatively connected to the processor, the processor configured to;

detect a communication action initiated for a user of a user device;

select a virtual user space from a plurality of available virtual user spaces associated with the user, wherein the virtual user space comprises a virtual user identity associated with the user and a virtual user device associated with a user device of the user, wherein the virtual user identity comprises virtual user information for the user that is at least partially different than real user information associated with the user, wherein the virtual user device comprises virtual user device information for the user device that is at least partially different than real user device information associated with the user device; and

propagate an indication of the communication action toward a virtual user server hosting the virtual user space.

11. An apparatus, comprising:

a processor and a memory communicatively connected to the processor, the processor configured to;

determine a pattern hiding function to be performed by a pattern hiding agent of a first device for hiding a pattern associated with content of a communication from the first device to a second device; and

determine a pattern reassembling function to be performed by a pattern reassembling agent of the second device for reassembling the content of the communication from the first device to the second device.

12. The apparatus of claim 11, wherein the pattern hiding function comprises partitioning the content of the communication and rearranging the partitioned content of the communication, wherein the pattern reassembling function comprises reordering the partitioned content of the communication and combining the reordered content of the communication.

13. The apparatus of claim 11, wherein the pattern hiding function comprises adding additional content to content of the communication, wherein the pattern reassembling function comprises removing the additional content from the content of the communication.

14. The apparatus of claim 11, wherein the pattern hiding function comprises partitioning the content of the communication and propagating the partitioned content toward a plurality of traffic gateways providing a respective plurality of routing paths to the second device, wherein the pattern reassembling function comprises reordering the partitioned content received via the plurality of routing paths and combining the reordered content to recover the content of the communication.

15. The apparatus of claim 11, wherein:

the pattern hiding function comprises receiving the content of the communication via a first session, generating a plurality of sub-sessions associated with the first session, and propagating a respective plurality of portions of the content of the communication via the plurality of sub-sessions;

the pattern reassembling function comprises receiving the plurality of portions of the content of the communication via the plurality of sub-sessions and combining the portions of the content of the communication to recover the content of the communication.

16. The apparatus of claim 11, wherein the processor is configured to perform at least one of:

propagating an indication of the pattern hiding function toward the first device and propagating an indication of the pattern reassembling function toward the second user device;

performing the pattern hiding function and propagating an indication of the pattern reassembling function toward the second user device;

or

propagating an indication of the pattern hiding function toward the first device and performing the pattern reassembling function.

17. An apparatus, comprising:

a processor and a memory communicatively connected to the processor, the processor configured to;

receive a real web browsing request initiated for a user, the real web browsing request comprising a real search term;

generate a fake web browsing request for the user, the fake web browsing request comprising a fake search term; and

propagate the real web browsing request and the fake web browsing request toward at least one web server.

18. The apparatus of claim 17, wherein the processor is configured to obtain the fake search term by:

selecting or generating the fake search term based on the real search term;

or

randomly selecting the fake search term independent of the real search term.

19. The apparatus of claim 17, wherein the processor is configured to:

receive, from the at least one web server, a real web browsing response associated with the real web browsing request and a fake web browsing response associated with the fake web browsing request;

filter the fake web browsing response for preventing presentation of the fake web browsing response to the user; and

propagate the real web browsing response for presentation to the user.

20. The apparatus of claim 17, wherein the processor and the memory are disposed in a user device or a network device.