0
$\begingroup$

What can be a theoretical and efficient way of protecting traffic metadata (packet size, timestamps, packet count) of enterprise when traffic is redirected to the SGX enclave residing in a cloud provider for processing. I have setup an IPSEC tunnel between the gateway located in enterprise domain and enclave but after I did some debugging it seems that metadata are not protected. One simple way of protecting packet size is using padding making all packets the same size but this way is not efficient and also does not protect timestamps and packet counts.

Is there any efficient solution to protect such metadata? Any answer is appreciated.

Improve this question
$\endgroup$
5
  • $\begingroup$ random MTU and fragmentation, random padding $\endgroup$
    – super
    Commented Feb 11, 2020 at 18:05
  • $\begingroup$ @super this is not an efficient way since you need to do it for every packet, I am asking for any solution for metadata protection which works before you send the packets over IPSEC $\endgroup$
    – ENIO MARKU
    Commented Feb 11, 2020 at 18:10
  • $\begingroup$ what are you trying to hide anyways? $\endgroup$
    – super
    Commented Feb 11, 2020 at 18:11
  • $\begingroup$ @user I am trying to protect information pertaining to individual packets $\endgroup$
    – ENIO MARKU
    Commented Feb 11, 2020 at 18:13
  • $\begingroup$ The only way to 100% relieably hide this information is to send equal-sized packets in constant intervals such that you achieve enough bandwidth. More probabilistic methods probably require a more precise model of distribution of the random variables you're worried about (so packet size, packet frequency?, time stamps?, packet count?). $\endgroup$
    – SEJPM
    Commented Feb 11, 2020 at 18:58

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.