What can be a theoretical and efficient way of protecting traffic metadata (packet size, timestamps, packet count) of enterprise when traffic is redirected to the SGX enclave residing in a cloud provider for processing. I have setup an IPSEC tunnel between the gateway located in enterprise domain and enclave but after I did some debugging it seems that metadata are not protected. One simple way of protecting packet size is using padding making all packets the same size but this way is not efficient and also does not protect timestamps and packet counts.
Is there any efficient solution to protect such metadata? Any answer is appreciated.