Traffic flow identifiers resistant to traffic analysis
A network device receives packets for one or more traffic flows to be sent into a network. The network device computes a flow identifier for each of the one or more traffic flows based on information contained in one or more headers of the packets for each of the one or more traffic flows and based on at least one value that is changed on an ongoing basis. The packets for each of the one or more traffic flows are encrypted to produce encrypted packets for each of the one or more traffic flows. An encapsulation is added to the encrypted packets for the one or more traffic flows. The flow identifier is included in a field of the encapsulation for a corresponding traffic flow.
1. A method comprising:
at a network device that is to supply packets of one or more traffic flows to a network:
computing a flow identifier for each of the one or more traffic flows based on information contained in one or more headers of the packets for each of the one or more traffic flows and based on at least one value that is changed on an ongoing basis at a frequency that is based on a level of security for the one or more traffic flows;
encrypting the packets for each of the one or more traffic flows to produce encrypted packets for each of the one or more traffic flows;
adding an encapsulation to the encrypted packets for the one or more traffic flows; and
including the flow identifier in a field of the encapsulation for a corresponding traffic flow.
2. The method of claim 1 , further comprising storing the flow identifier for each of the one or more traffic flows.
3. The method of claim 1 , wherein the at least one value is a nonce.
4. The method of claim 1 , wherein computing comprises computing the flow identifier for each of the one or more traffic flows based on a hash computation of source information and destination information obtained from the one or more headers of the packets and the at least one value.
5. The method of claim 1 , wherein the flow identifier is included in a source port field of a User Datagram Protocol (UDP) header.
6. The method of claim 1 , wherein the flow identifier is included in a field of a tag of a packet encapsulated according to an Ethernet tagging protocol.
7. One or more non-transitory computer readable storage media encoded with software comprising computer executable instructions and when the software is executed operable to:
compute a flow identifier for each of one or more traffic flows based on information contained in one or more headers of packets for each of the one or more traffic flows and based on at least one value that is changed on an ongoing basis at a frequency that is based on a level of security for the one or more traffic flows;
encrypt the packets for each of the one or more traffic flows to produce encrypted packets for each of the one or more traffic flows;
add an encapsulation to the encrypted packets for the one or more traffic flows; and
include the flow identifier in a field of the encapsulation for a corresponding traffic flow.
8. The computer readable storage media of claim 7 , further comprising instructions operable to store the flow identifier for each of the one or more traffic flows.
9. The computer readable storage media of claim 7 , wherein the at least one value is a nonce.
10. The computer readable storage media of claim 7 , wherein the instructions operable to compute the flow identifier comprise instructions operable to compute the flow identifier for each of the one or more traffic flows based on a hash computation of source information and destination information obtained from the one or more headers of the packets and the at least one value.
11. The computer readable storage media of claim 7 , wherein the flow identifier is included in a source port field of a User Datagram Protocol (UDP) header.
12. The computer readable storage media of claim 7 , wherein the flow identifier is included in a field of a tag of a packet encapsulated according to an Ethernet tagging protocol.
13. An apparatus comprising:
a plurality of network ports configured to receive packets and to send packets into a network; and
a processor configured to:
compute a flow identifier for each of one or more traffic flows based on information contained in one or more headers of packets for each of the one or more traffic flows and based on at least one value that is changed on an ongoing basis at a frequency that is based on a level of security for the one or more traffic flows;
encrypt the packets for each of the one or more traffic flows to produce encrypted packets for each of the one or more traffic flows;
add an encapsulation to the encrypted packets for the one or more traffic flows; and
include the flow identifier in a field of the encapsulation for a corresponding traffic flow.
14. The apparatus of claim 13 , wherein the processor is configured to store the flow identifier for each of the one or more traffic flows.
15. The apparatus of claim 13 , wherein the processor is configured to compute the flow identifier for each of the one or more traffic flows based on a hash computation of source information and destination information obtained from the one or more headers of the packets and the at least one value.
16. The apparatus of claim 13 , wherein the at least one value is a nonce.
17. The apparatus of claim 13 , wherein the flow identifier is included in a source port field of a User Datagram Protocol (UDP) header.
18. The apparatus of claim 13 , wherein the flow identifier is included in a field of a tag of a packet encapsulated according to an Ethernet tagging protocol.