Link Encryption Approach
With the use of link encryption, network-layer headers (e.g.,
frame or cell header) are encrypted, reducing the opportunity for traffic
analysis. However, it is still possible in those circumstances for an attacker
to assess the amount of traffic on a network and to observe the amount of
traffic entering and leaving each end system. An effective countermeasure to
this attack is traffic padding
Traffic padding produces ciphertext output continuously, even
in the absence of plaintext. A continuous random data stream is generated. When
plaintext is available, it is encrypted and transmitted. When input plaintext is
not present, random data are encrypted and transmitted. This makes it impossible
for an attacker to distinguish between true data flow and padding and therefore
impossible to deduce the amount of traffic.
End-to-End Encryption Approach
Traffic padding is essentially a link encryption function. If
only end-to-end encryption is employed, then the measures available to the
defender are more limited. For example, if encryption is implemented at the
application layer, then an opponent can determine which transport entities are
engaged in dialogue. If encryption techniques are housed at the transport layer,
then network-layer addresses and traffic patterns remain accessible.
One technique that might prove useful is to pad out data units
to a uniform length at either the transport or application level. In addition,
null messages can be inserted randomly into the stream. These tactics deny an
opponent knowledge about the amount of data exchanged between end users and
obscure the underlying traffic pattern.
No comments:
Post a Comment