WO2013174869A1

WO2013174869A1 - Method and system for making electronic messages anonymous

Info

Publication number: WO2013174869A1
Application number: PCT/EP2013/060516
Authority: WO
Inventors: Leif Harald AUKE; Thor Henning HETLAND
Original assignee: Norsk Tillitsmann Asa
Priority date: 2012-05-24
Filing date: 2013-05-22
Publication date: 2013-11-28
Also published as: NO20120611A1; NO333683B1

Abstract

Method, system and computer program product for obfuscating sending of a specific real message on a network. The method comprises the steps of generating and sending fake messages from a sender node on the network, and merging and sending the real message with the fake messages, where the real message includes information of the node of a recipient of the message.

Description

Method and system for making electronic messages anonymous

Introduction

The present invention concerns communication over a network. In particular the invention concerns a method and system for communication over a public or private network for sending a message on the network without revealing specific sender activity and hindering backtracking of the sender.

Background

In different companies and under different working conditions there might be a need for anonymous alerting of unwanted incidents or activities. Alerting may make the management of a company aware of incidents and activities that need to be corrected or improved.

Depending on the type of industry an incident or activity to be alerted may comprise economic crime, corruption, bribes, illegal purchases, fraud, theft, embezzlement, insider dealing breach of duty of confidentiality, discrimination, racism,

harassment, unworthy working conditions etc.

Known methods for alerting such incidents or activities comprise using the old fashioned post box, using e-mail, inform a superior, using a lawyer etc.

These solutions are more focused on keeping the content of a message anonymous and not the anonymity of the person alerting. When alerting it is the content of the message that is important, and not the identity of the sender.

It is well known that persons refrain from reporting or alerting an incident if they know that their identity will be known.

One aspect of the present invention is to provide an efficient and easy to use method and system for hiding a sender from a receiver when the sender sends a message or data to a known receiver.

Another aspect of the present invention is to hide the fact that a sender is sending any message to a receiver, i.e. hide or obfuscate any change in sending activity from a sending node, thus making backtracking of the sender is very hard.

When an employee knows that alerting of unwanted incidents is kept anonymous, he or she will be most likely be motivated to send a message describing a specific incident.

The reputation of a company is expected to be improved when an anonymous alerting service according to the present invention is provided for the employees. The invention is not limited to be performed by a specific operating system or on a specific hardware platform.

List of drawings

Further aspects and embodiments of the present invention will become apparent in the light of the following description with reference to the accompanying drawings, in which:

Fig. 1 shows the overall concept for hiding a sender from recipient;

Fig. 2 shows an example of possible routes for a message from a sender to a receiver;

Fig. 3 shows the sending process with no backtracking;

Fig. 4 shows and encrypting content of an end user message;

Fig. 5 shows raid sending of real messages, and

Fig. 6 shows a 4 level model for securing message delivery.

Short description of the invention

The present invention comprises a method for obfuscating sending of a specific real message on a network. The method comprises the following steps:

- generating and sending fake messages from a sender node on the network;

- merging and sending the real message with the fake messages, where the real message include information of the node of the recipient of the message.

The invention further comprises a system and a computer program product for obfuscating sending of a specific real message on a network.

The present invention is defined by the features in the main claims and with additional features defined in the dependent claims.

Detailed description of the invention

The present invention concerns a method, a system and computer program product that enables obfuscation of the sending of a specific real message to a recipient without revealing any change in network activity of the node sending the message. In the setting of this disclosure, a real message means an alerting message with information of unwanted incidents or activities. The invention makes backtracking to the sender of such messages very hard. Fig. 1 shows the overall concept for hiding a sender from a network system. A message or data is sent from a sender node via one or more cooperating nodes comprised in a network, where each node only knows the identity of the previous sending node and the next receiving node in the node trace jumping until the destination node of one or more recipients of messages. The destination is typically a trusted third party recipient of alert messages.

The communication can for instance be over a public or private network using TCP/IP or UDP/IP.

Fig. 2 shows an example of possible routes for a message sent from a sender to a receiver. A sender sends an end user message to an end user receiver via nodes on a network. The nodes comprise other computers through which the message is routed to the recipient. The message is sent into a mesh of nodes, jumping from node to node, until it reaches a destination receiver.

The figure shows part 1 to part x of messages sent via a sending process on a network of nodes. The sending process and the different parts that are different copies of the message sent will be explained below.

Data traffic between nodes is peer to peer. This means that the communication is based on lookup in a table of possible routes in a central server used for indexing functions and to bootstrap the entire system of nodes between the sender and receiver. Communication is performed directly between each node that is acting as sender and receiver. Nodes might communicate via some proxy or act as proxy nodes on a package level if needed, but message level communication is peer to peer.

When a data message is sent it will jump from a starting node, which is typically a computer where the data message is created by an end user. From here it will be forwarded via other nodes. Each node only knows where a message is sent from, i.e. the sender node, and which node a message is to be sent to.

Fig. 3 shows an embodiment of an implementation of the present invention for providing a method for obfuscating sending of a specific message on a network. The obfuscation will make it very hard to backtrack the sender of the message.

The figure shows an end user process where an end user sends a real message (source 1). In the setting of the present invention a real message comprises the content of an alert message intended for a dedicated recipient of such messages.

When a real message is sent it will be merged in a merging process with fake messages which are generated from a fake message generator. The purpose of sending fake messages is to generate a constant sending activity with an ongoing stream of data from the computer node of the end user that might send a real alert message. By doing this the network will not detect any change in sending activity when a real message is merged into the stream of fake messages that are sent on the network. The real message will get priority in the ongoing stream, so that the real message is sent first without any delaying peaks.

At network level, fake and real data will look the same. All messages contain message id, data and metadata whether they are real or fake messages. By examining the content of each mail, fake messages can be ignored at the node of the recipient since fake messages are marked with an internal flag.

The purpose of sending fake traffic is to hide the footprint of a real message sent. The stream of fake data can be a constant data stream, or a random variable stream regardless of the presence of real message data mixed into the stream.

In one embodiment of the invention the fake messages are messages filled with a specific or arbitrary content and that have the same recipient id to the receiving node of the recipient of the real messages. Such fake messages are called real fake messages, and they will be filtered and rejected based on inspection of the presence of said internal flag. Real fake messages are generated by source 2 in fig. 3.

In another embodiment of the invention the fake messages are messages filled with a specific or arbitrary content but have another recipient id than the receiving node of the recipient of the real messages. The recipient id for such messages can be to a node having the purpose of receiving and rejecting such fake messages. Fake messages are generated by source 3 in fig. 3.

In yet another embodiment the fake messages comprise a mix of said fake messages and real fake messages.

In one embodiment of the invention the real message travels through the network in a random order. In another embodiment of the invention the real message travel through the network in a semi random order guided by a set of possible routes, defined in said indexed lookup table for the network, for keeping the number of jumps between nodes less than a fixed number.

For the purpose of securing the content of the real message, the message is encrypted. Fig. 4 shows an example of encrypted content of end user messages. An end user message is encrypted at sender node with the public key of the receiver. When arriving at the node of the recipient the real message is decrypted with a private key.

For securing safe delivery of a real message, it can be sent several times. Fig. 5 illustrates the concept of raid sending of messages. Several copies of a real message can be sent as sub messages which are set up as raid sending. The receiver of the messages will pick up sub messages as they arrive and rebuild the end user message. Duplicate arrived messages will be discarded. Before starting sending of an alert message from a sender node in a network, fake messages are generated and sent on the network connected to the sending node.

The method of sending fake messages can be set up to automatically start when a computer is turned on. In this way, sending a particular real message will not be seen as a sudden sending activity from that node comprised in a network.

Fig. 6 shows an overview of a 4 level model for securing message delivery. Level 0 illustrates peer to peer communication between nodes. Level 1 illustrates the sending of sub messages of an end user message via jumps in a mesh of nodes comprised in the network. Level 2 illustrates the raid level where the same message is sent more than once. Level 3 illustrates the use of public keys for sending an encrypted message. The data flow in each level is independent of each other.

The 4 level model ensures that a message will be securely delivered to the intended recipient.

The present invention is further defined by a system for obfuscating sending of a specific real message on a network, where the system comprises a sending computer node and a receiving computer node connected to a mesh of network nodes carrying the real message, and where the sending computer node comprises a computer program product for:

- generating and sending fake messages from a sender node on the network, and - merging and sending the real message with the fake messages, where the real message include information of the node of a recipient of the message.

When the stream of messages arrives at the receiver node, the messages will be interpreted as they arrive. Fake messages will be filtered and discarded and real messages will be rebuilt from one or more sub messages.

In one embodiment of the invention, the receiver node will comprise a list of user public keys used in the communication between the sender and receiver. The keys are read from a local storage and based on the key identity inside the message the end user message will be distributed to the recipients listed on the key specification.

In one embodiment of the invention, the message sent might contain a list of recipient ids to be excluded for delivery in order to avoid if user decide to reduce the default recipient list specified in the key.

The present invention is also defined by a computer program product comprising a computer useable medium including a computer readable program, wherein the computer readable program when executed on a computer causes the computer to obfuscate sending of a specific real message on a network, where the computer program product comprises instructions for:

- generating and sending fake messages from a sender node on the network, and - merging and sending the real message with the fake messages, where the real message include information of the node of the recipient of the message.

The computer running the program can be set up such that the program will start running when the computer is turned on, or when manually started by the end user.

Claims

1. A computer implemented method for obfuscating sending of a specific real message on a network, where the method comprises the following steps:

- generating and sending configurable fake messages from a sender node on the network, and

- merging and sending the real message with the fake messages, where the real message include information of the node of a recipient of the message.

2. A method according to claim 1 , where the fake messages are empty or filled with an arbitrary content or a mix of these.

3. A method according to claim 1 , where the stream of fake messages is configured to be constant stream.

4. A method according to claim 1 , where the stream of fake messages is configured to be random variable stream.

5. A method according to claim 1 , where the real message travel through the network in a random order.

6. A method according to claim 1 , where the real message travel through the network in a semi random order guided by a set of possible routes for keeping the number of jumps between nodes less than a fixed number.

7. A method according to claim 1 , where the real message is encrypted.

8. A method according to claim 1 , where delivery of the real message is secured by raid sending several identical real messages.

9. A system for obfuscating sending of a specific real message on a network, where the system comprises a sending computer node and a receiving computer node connected to a mesh of network nodes carrying the real message, and where the sending computer node comprises a computer program product for: - generating and sending configurable fake messages from a sender node on the network, and

10. A system according to claim 9, where the receiving computer node

comprises a computer program product for filtering and discarding fake messages and rebuilding real messages from one or more sub messages.

1 1. A computer program product comprising a computer useable medium

including a computer readable program, wherein the computer readable program when executed on a computer causes the computer to obfuscate sending of a specific real message on a network, where the computer program product comprises instructions for: