Network traffic obfuscation
Examples of the disclosure provide for a scatter network device. In some examples, the scatter network device includes a non-transitory memory, at least one processor, and a key exchange application stored in the non-transitory memory. When executed by the at least one processor, the key exchange application generates a key exchange request encrypted according to a public encryption key of a first network endpoint, wherein the encrypted key exchange request is indistinguishable from uniform random noise, and transmits the key exchange request to the first network endpoint via a first communication band, wherein the scatter network device transmits authenticated messages via a second communication band.
1. A scatter network device, comprising:
a non-transitory memory;
at least one processor; and
a key exchange application stored in the non-transitory memory that, when executed by the at least one processor:
generates a key exchange request encrypted according to a public encryption key of a first network endpoint, wherein the encrypted key exchange request is indistinguishable from uniform random noise;
transmits the key exchange request to the first network endpoint via a first communication band, wherein the first communication band is separate from a second communication band over which the scatter network device transmits authenticated messages;
responsive to transmitting the key exchange request, receive an encrypted key exchange response, wherein the encrypted key exchange response is indistinguishable from uniform random noise; and
decrypt the encrypted key exchange response according to a private encryption key of the scatter network device.
2. The scatter network device of claim 1 , wherein the encrypted key exchange response is a padded uniform random blob.
3. The scatter network device of claim 1 , wherein the encrypted key exchange request is a padded uniform random blob.
4. The scatter network device of claim 3 , wherein the encrypted key exchange request is obfuscated by embedding the encrypted key exchange request in unrelated communications via steganography.
5. The scatter network device of claim 1 , wherein the encrypted key exchange request is padded with dummy data to obfuscate a length of the key exchange request.
6. The scatter network device of claim 1 , wherein the encrypted key exchange request includes no discernible metadata.
7. A method of secure data routing, comprising:
receiving, at a first network endpoint in a scatter network, an encrypted key exchange request from a client device via a first communication band other than a second communication band used by the client device for transmitting authenticated messages in the scatter network, the encrypted key exchange request being indistinguishable from uniform random noise, wherein the key exchange request is asymmetrically encrypted according to a public encryption key of the first network endpoint;
decrypting the key exchange request according to a private encryption key of the first network endpoint to obtain an identifier of the client device;
generating a shared encryption key based on the private encryption key of the first network endpoint and the public encryption key of the client;
storing the shared encryption key with an association to the identifier of the client device in a data store;
generating an encrypted key exchange response, the encrypted key exchange response being indistinguishable from uniform random noise, wherein the key exchange response includes the public encryption key of the first network endpoint; and
transmitting, to the client device, the encrypted key exchange response, wherein the key exchange response is asymmetrically encrypted according to a public key of the client device.
8. The method of claim 7 , wherein the encrypted key exchange request is padded to obfuscate a length of the key exchange request.
9. The method of claim 7 , wherein the encrypted key response is padded to obfuscate a length of the key exchange response.
10. The method of claim 7 , further comprising:
receiving a symmetrically encrypted communication from the client device via the second communication band; and
decrypting the symmetrically encrypted communication according to the shared encryption key.
11. The method of claim 7 , further comprising extracting the encrypted key exchange request from unrelated communication in which the client device embedded the encrypted key exchange request.
12. The method of claim 7 , further comprising embedding the encrypted key exchange response via steganography in communication unrelated to performing a key exchange.
13. A computing device, comprising:
a non-transitory memory;
at least one processor; and
a key exchange application stored in the non-transitory memory that, when executed by the at least one processor:
receives an asymmetrically encrypted key exchange request from a client device, the asymmetrically encrypted key exchange request encrypted according to a public encryption key of the computing device to be indistinguishable from uniform random noise;
decrypts the asymmetrically encrypted key exchange request according to a private encryption key of the computing device to obtain an identifier of the client device;
transmits an asymmetrically encrypted key exchange response to the client device, the asymmetrically encrypted key exchange response encrypted according to a public encryption key of the client device to be indistinguishable from uniform random noise, the public encryption key of the client device determined according to the identifier of the client device; and
generates a symmetric encryption key according to the public encryption key of the client device and a private encryption key of the computing device.
14. The computing device of claim 13 , wherein executing the key exchange application further causes the processor to generate the asymmetrically encrypted key exchange response including one or more endpoint validation tokens uniquely identifying the client device.
15. The computing device of claim 14 , wherein the asymmetrically encrypted key exchange request and the asymmetrically encrypted key exchange response are padded with dummy data to obfuscate a length of the encrypted key exchange request and the encrypted key exchange response.
16. The computing device of claim 13 , wherein the asymmetrically encrypted key exchange request is received from the client device via a communication band other than that which the client device transmits authenticated messages.
17. The computing device of claim 13 , wherein the asymmetrically encrypted key exchange request is received from the client device via a bandwidth constrained communication protocol.