Traffic flow analysis mitigation using a cover signal
View Patent ↗Network communications face security issues including traffic flow analysis attacks. Such attacks include deduction of information about networks through analysis of transmitted traffic volume or statistics, even if the traffic is encrypted. For example, an adversary may deduce operational information from traffic volume, or its timing. Described herein are security techniques that can provide transmission security with an obfuscating “cover” signal for any contention-based multiple access system by employing signal interference cancellation techniques, but are not so limited. The cover signal is transmitted on the same frequency band used by terminals on the network. Using “known-signal” and/or self-interference cancellation techniques, the cover signal can be removed by authorized terminals that have appropriate cover signal information and timing synchronization. An adversary cannot distinguish between real traffic and the cover signal while authorized terminals can recover transmissions without impact to network capacity.
1. A method for inhibiting traffic flow analysis attacks in a wireless, multiple access communications network, the method comprising:
receiving, within the wireless, multiple access communications network, a composite signal comprising a cover signal and one or more real user transmissions over a period of time;
cancelling the cover signal from the composite signal to produce the one or more real user transmissions, the cancelling comprising:
determining one or more signal characteristics of the cover signal,
re-creating a copy of the cover signal based at least in part on the determined one or more signal characteristics, and
subtracting the copy of the cover signal from the composite signal to produce the one or more real user transmissions;
demodulating the one or more real user transmissions;
generating the cover signal, the cover signal comprising a number of simulated user transmissions over the period of time; wherein the cover signal is generated such that the composite signal comprises a total number of simulated and real user transmissions over the period of time that is varying regardless of a number of the one or more real user transmissions, wherein the simulated user transmissions and real user transmissions comprise similar preambles, and wherein the simulated user transmissions are generated to comprise fake traffic following the preambles to generate false remote terminals; and
transmitting the cover signal.
2. The method of claim 1 , wherein a first device receives the composite signal and a second device generates the cover signal and further comprising coordinating information regarding the cover signal between the first device and the second device.
3. The method of claim 1 , wherein the one or more real user transmissions are transmitted by one or more user terminals having transmit beam characteristics, and wherein the cover signal is transmitted by a terminal having similar transmit beam characteristics.
4. The method of claim 3 , wherein the terminal transmitting the cover signal is in proximity of at least one of the one or more user terminals, and wherein the one or more user terminals transmit the one or more real user transmissions using at least a first antenna of a first size, and the terminal transmits the cover signal using at least a second antenna of approximately the same size.
5. The method of claim 1 , wherein a traffic volume of the cover signal is varied over time in a manner based at least in part on a traffic volume of the real user transmissions.
6. The method of claim 1 , further comprising generating the cover signal such that the composite signal comprises spikes in encoded traffic that are not based on the one or more user terminal transmissions.
7. The method of claim 1 , further comprising
receiving the composite signal on a satellite; and
generating and transmitting the cover signal from the satellite.
8. The method of claim 1 , further comprising generating the cover signal such a number of simulated users is random and time-varying.
9. A system for inhibiting traffic flow analysis attacks in a wireless, multiple access communications network, the system comprising:
one or more user terminals configured to transmit a plurality of real user transmissions over a period of time within the wireless, multiple access communications network;
a cover signal generator configured to generate a cover signal comprising a number of simulated user transmissions over the period of time; and
a cover signal canceller configured to:
receive a composite signal comprising the cover signal and the one or more real user transmissions; and
cancel the cover signal from the composite signal to produce the one or more real user transmissions by:
determining one or more signal characteristics of the cover signal;
re-creating a copy of the cover signal based at least in part on the determined one or more signal characteristics; and
subtracting the copy of the cover signal from the composite signal to produce the one or more real user transmissions,
wherein the cover signal generator is further configured to generated the cover signal such that the composite signal comprises a total number of simulated and real user transmissions over the period of time that is varying regardless of a number of the one or more real user transmissions, and
wherein the cover signal generator is further configured to generate the simulated user transmissions to comprise preambles similar to the preambles of the real user transmissions, and wherein the cover signal generator is further configured to generate the simulated user transmissions to comprise fake traffic following the preambles to generate false remote terminals.
10. The system of claim 9 , wherein a hub terminal comprises the cover signal generator and the cover signal canceller.
11. The system of claim 9 , wherein the user terminals and the cover signal generator have similar transmit beam characteristics.
12. The system of claim 11 , wherein the user terminals and the cover signal generator use transmit antennas of similar size.
13. The system of claim 9 , wherein the cover signal generator is configured to transmit coordinating information regarding the cover signal to the cover signal canceller.
14. An apparatus for inhibiting traffic flow analysis attacks in a wireless, multiple access communications network, the apparatus comprising:
a receiver configured to receive, within the wireless, multiple access communications network, a composite signal comprising a cover signal and one or more real user transmissions over a period of time;
a cover signal generator configured to generate the cover signal, the cover signal comprising a number of simulated user transmissions over the period of time, wherein the cover signal generator is further configured to generate the cover signal such that the composite signal comprises a total number of simulated and real user transmissions over the period of time that is varying regardless of a number of the one or more real user transmissions,
wherein the cover signal generator is further configured to generate the simulated user transmissions to comprise preambles similar to the preambles of the real user transmissions, and wherein the cover signal generator is further configured to generate the simulated user transmissions to comprise fake traffic following the preambles to generate false remote terminals;
at least a first antenna configured to transmit the cover signal;
a canceller configured to cancel the cover signal from the composite signal to produce the one or more real user transmissions by:
determining one or more signal characteristics of the cover signal;
re-creating a copy of the cover signal based at least in part on the determined one or more signal characteristics; and
subtracting the copy of the cover signal from the composite signal to produce the one or more real user transmissions; and
a demodulator configured to demodulate the one or more real user transmissions.
15. The apparatus of claim 14 , comprising user terminals transmitting the real user transmissions, wherein the user terminals and the cover signal generator have similar transmit beam characteristics.
16. The apparatus of claim 15 , wherein the user terminals and the cover signal generator use transmit antennas of similar size.
17. The apparatus of claim 14 , wherein a traffic volume of the cover signal is varied over time in a manner based at least in part on a traffic volume of the real user transmissions.