Background Knowledge-Resistant Traffic Padding for Preserving User Privacy in Web-Based Applications
2013 IEEE 5th International Conference on Cloud Computing Technology and Science (2013)
Bristol, United Kingdom United Kingdom
Dec. 2, 2013 to Dec. 5, 2013
While enjoying the convenience of Software as a Service (SaaS), users are also at an increased risk of privacy breaches. Recent studies show that a Web-based application may be inherently vulnerable to side-channel attacks which exploit unique packet sizes to identify sensitive user inputs from encrypted traffic. Existing solutions based on packet padding or packet-size rounding generally rely on the assumption that adversaries do not possess prior background knowledge about possible user inputs. In this paper, we propose a novel random ceiling padding approach whose results are resistant to such adversarial knowledge. Specifically, the approach injects randomness into the process of forming padding groups, such that an adversary armed with background knowledge would still face sufficient uncertainty in estimating user inputs. We formally present a generic scheme and discuss two concrete instantiations. We then confirm the correctness and performance of our approach through both theoretic analysis and experiments with two real world applications.
Privacy, Uncertainty, Cancer, Transient analysis, Diseases, Measurement, Servers
W. M. Liu, L. Wang, K. Ren and M. Debbabi, "Background Knowledge-Resistant Traffic Padding for Preserving User Privacy in Web-Based Applications," 2013 IEEE 5th International Conference on Cloud Computing Technology and Science(CLOUDCOM), Bristol, United Kingdom United Kingdom, 2013, pp. 679-686.