面向中文搜索的网络加密流量侧信道分析方法  

Network Encrypted Traffic Side-channel Analysis on Chinese Search

作　　者：李玎 林伟 芦斌[1,2] 祝跃飞 LI Ding;LIN Wei;LU Bin;ZHU Yuefei(PLA Information Engineering University,Zhengzhou 450001,China;State Key Laboratory of Mathematical Engineering and Advanced Computing,Zhengzhou 450001,China)

机构地区：[1]战略支援部队信息工程大学,郑州450001 [2]数学工程与先进计算国家重点实验室,郑州450001

出　　处：《电子与信息学报》2022年第5期1763-1772,共10页Journal of Electronics & Information Technology

基　　金：国家重点研发计划(2019QY1302)。

摘　　要：搜索引擎中的增量式搜索服务通过发送实时请求为用户更新建议列表。针对搜索加密流量存在的信息泄露,该文提出一种面向中文搜索的侧信道分析方法,利用搜索请求数据包长度增量和时间间隔的可区分性,构建了3阶段的分析模型以实现对用户输入查询的识别。实验结果表明,该方法在4个常用中文搜索引擎中的识别性能均达到理论量化值,对包含1.4×10^(5)查询监控集的综合识别准确率达到76%。最后通过评估4种针对性的缓解机制,证明了通过阻断信息泄露来源可有效防御侧信道分析。Incremental search services in search engines update the suggestion list for users by sending real-time requests.Focusing on the information leakage of encrypted search traffic,a side-channel analysis method on Chinese search is proposed.Leveraging the distinguishability of packet length increments and time intervals,a three-stage analysis model is constructed to identify user queries.Experimental results show that the performance in four commonly used Chinese search engines achieves the theoretical quantified value.The identification accuracy for the set containing 1.4×10^(5) monitored queries reaches 76%.Finally,four mitigation methods are evaluated to demonstrate that side-channel analysis can be effectively defended by blocking the information leakage sources.

关 键 词：加密流量 侧信道分析 搜索引擎 信息增益 

分 类 号：TN915[电子电信—通信与信息系统] TN918[电子电信—信息与通信工程]