What can be a theoretical and efficient way of protecting traffic metadata (packet size, timestamps, packet count) of enterprise when traffic is redirected to the SGX enclave residing in a cloud provider for processing. I have setup an IPSEC tunnel between the gateway located in enterprise domain and enclave but after I did some debugging it seems that metadata are not protected. One simple way of protecting packet size is using padding making all packets the same size but this way is not efficient and also does not protect timestamps and packet counts.

Is there any efficient solution to protect such metadata? Any answer is appreciated.

  • $\begingroup$ random MTU and fragmentation, random padding $\endgroup$ – super Feb 11 '20 at 18:05
  • $\begingroup$ @super this is not an efficient way since you need to do it for every packet, I am asking for any solution for metadata protection which works before you send the packets over IPSEC $\endgroup$ – ENIO MARKU Feb 11 '20 at 18:10
  • $\begingroup$ what are you trying to hide anyways? $\endgroup$ – super Feb 11 '20 at 18:11
  • $\begingroup$ @user I am trying to protect information pertaining to individual packets $\endgroup$ – ENIO MARKU Feb 11 '20 at 18:13
  • $\begingroup$ The only way to 100% relieably hide this information is to send equal-sized packets in constant intervals such that you achieve enough bandwidth. More probabilistic methods probably require a more precise model of distribution of the random variables you're worried about (so packet size, packet frequency?, time stamps?, packet count?). $\endgroup$ – SEJPM Feb 11 '20 at 18:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.