System and method for evaluating and enhancing source anonymity for encrypted web traffic

• US 7,640,215 B2
• Filed: 02/24/2005
• Issued: 12/29/2009
• Est. Priority Date: 04/23/2002
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Simon, Daniel R., Wang, Yi-Min, Padmanabhan, Venkata N., Qiu, Lili, Russell, Wilfred, Sun, Qixiang
• Primary Examiner(s): Fischer; Andrew J.
• Assistant Examiner(s): Winter; John M
• Application Number:
  US11/064,677
• Publication Number:
  US 20050157706A1
• Time in Patent Office: 1,769 Days
• Field of Search: 705/51, 705/1, 705/50
• US Class Current: 705/50
• CPC Class Codes: G06F 2221/2107 File encryption
• CPC Class Codes: G06F 2221/2119 Authenticating web pages, e.g. with suspicious links
• CPC Class Codes: G06Q 20/10 specially adapted for electronic funds transfer [EFT] systems; specially adapted for home banking systems
• CPC Class Codes: G06Q 20/102 Bill distribution or payments
• CPC Class Codes: G06Q 20/1085 involving automatic teller machines [ATMs]
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: H04L 63/0407 wherein the identity of one or more communicating identities is hidden cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

A system and method is provided for evaluating the effectiveness of data encryption for hiding the identity of the source of Web traffic. A signature is constructed from encrypted Web traffic for a Web page sent by a target Web site, and the signature is compared with archived traffic signatures obtained by accessing various Web pages of interest in advance. If the signature of the detected encrypted Web traffic matches a stored traffic signature beyond a pre-set statistical threshold, a positive match is found, and the source of the traffic is identified. Countermeasures for reducing the reliability of source identification based on traffic signature matching are provided.

Claims

1. A method for obfuscating Web traffic volume in a networking environment that is sent by a Web server in response to a request by an Internet client to access a Web page, the method comprising:

receiving, by the Web server, a request from the Internet client to access the Web page;

padding by the Web server each of a plurality of objects of the Web page, wherein the padding comprises altering an original size of the object by adding redundant data;

randomly selecting an object, by the Web server, via the Web server, to add to the Web page;

adding the randomly selected object to the Web page by the Web server encrypting the Web page, by the Web server, by encrypting both the padded object and randomly selected added object;

obfuscating the traffic pattern of the transmitted Web page via the padding and further via the adding the at least one randomly selected object;

transmitting by the Web server the encrypted Web page to the Internet client monitoring by the Web server, a traffic pattern of Web pages transmitted to the Internet client;

decrypting by the Internet client the transmitted Web page;

discarding by the Internet client the randomly selected added object;

removing by the Internet client at least portions of the padding from each decrypted object that contains padding; and

displaying by the Internet client the decrypted web page with the randomly objects and the padding removed.

2. The method of claim 1, wherein the randomly selected added object did not exist in the Web page prior to being added.

3. The method of claim 1, further comprising:

altering a format of at least one textual component of the Web page by translating the at least one textual component of the Web page from a primary language into a secondary language, the secondary language determined via the request sent from the Web server to the Internet client, the request further including a list of available translation languages.