面向中文搜索的网络加密流量侧信道分析方法

Network Encrypted Traffic Side-channel Analysis on Chinese Search

搜索引擎中的增量式搜索服务通过发送实时请求为用户更新建议列表。针对搜索加密流量存在的信息泄露,该文提出一种面向中文搜索的侧信道分析方法,利用搜索请求数据包长度增量和时间间隔的可区分性,构建了3阶段的分析模型以实现对用户输入查询的识别。实验结果表明,该方法在4个常用中文搜索引擎中的识别性能均达到理论量化值,对包含1.4×10^(5)查询监控集的综合识别准确率达到76%。最后通过评估4种针对性的缓解机制,证明了通过阻断信息泄露来源可有效防御侧信道分析。

Incremental search services in search engines update the suggestion list for users by sending real-time requests.Focusing on the information leakage of encrypted search traffic,a side-channel analysis method on Chinese search is proposed.Leveraging the distinguishability of packet length increments and time intervals,a three-stage analysis model is constructed to identify user queries.Experimental results show that the performance in four commonly used Chinese search engines achieves the theoretical quantified value.The identification accuracy for the set containing 1.4×10^(5) monitored queries reaches 76%.Finally,four mitigation methods are evaluated to demonstrate that side-channel analysis can be effectively defended by blocking the information leakage sources.