Patent Publication Number: US-11032257-B1

Title: Method for covertly delivering a packet of data over a network

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
     This application claims the benefit of U.S. Provisional Application Ser. No. 62/596,402 filed Dec. 8, 2017, the disclosures of which are hereby incorporated by reference in their entireties as if fully restated herein. 
    
    
     TECHNICAL FIELD 
     Exemplary embodiments of the present invention relate to covertly sending packets of data over a network. 
     BACKGROUND AND BRIEF SUMMARY OF THE INVENTION 
     TCP/IP is the basic communication protocol that makes up the Internet. All computers that send communication over the Internet must implement a complex stack of routines that breakdown and distribute the network communication to the individual programs that are communicating between machines. 
     The TCP/IP protocol was developed for the United States Advanced Research Projects Agency (ARPA). The TCP/IP protocol is a set of rules that enable different types of network-enabled or networked devices to communicate with each other. Those network devices communicate by using the TCP/IP standard, or format, to transfer or share data. TCP/IP rules are established and maintained by the Internet Engineering Task Force (IETF). The IETF is an international community of network designers, operators, vendors, and researchers concerned with the Internet&#39;s architecture and operation. The IETF&#39;s mission is to produce technical and engineering documents that influence the way people design, use and manage the Internet with the goal of improving its operations and efficiencies. These documents include protocol standards, best current practices and information updates of various kinds, and are commonly referred to as Request for Comments (RFC). 
     The IP layer actually performs the communication function between two networked hosts. The IP software receives data segments from the TCP layer, ensures that the segment is sized properly to meet the requirements of the transmission path and physical adapters (such as Ethernets and CTCs). IP changes the segment size if necessary by breaking it down into smaller IP datagrams, and transmits the data to the physical network interface or layer of the host. [RFC 791, 1981] 
     The IP layer uses a well defined and easily observed method for transporting data between two networked hosts; however, there are occasionally specialized applications that require the ability to transport this data in a discrete and covert way. This inventive process describes a method where communication may take place, using the well understood RFCs, but masks the existence of the communication to avoid observation, detection, and in many cases bypassing firewalls and sniffers. There may be any number of reasons to covertly transport such data including for privacy and confidentiality reasons. 
     The objectives of the covert transmission are to allow an external system to transmit a discrete unit of data into the TCP/IP stack, or IP layer, in a way that the IP layer can read and utilize, without observation. There are several important objectives: first is to avoid network behavior that can be reported by network sniffers; second, it is important to create communication traffic that will not be filtered out by firewalls, if possible; last, if the traffic is observed, it will appear as static or an unreadable communication error. 
     While firewalls can retard traffic, they generally have little or no effect upon some layers of communication. It is quite possible that a TCP/IP stack might have some ports that are open to a wide variety of traffic, while others are restricted; therefore, the covert communication will be confined to other layers of the protocol stack, so as to avoid these user-imposed restrictions. 
     Network sniffers collect and organize traffic based upon recognizable elements; therefore, the covert data will fall outside predefined standards, and have the appearance of network static or partial fragments. 
     In order for covert data to appear as static, it will need to be encrypted in a form that appears as disturbed transmission data. When information is out of place and modified into a form that is unreadable, it will not be observable as organized information. 
     An exemplary method for delivering covert data includes containing the covert data within a second fragment of a fragmented IP datagram. Since IP networks permit a datagram to be fragmented into multiple pieces, it would be necessary for a sniffer, or firewall, to first identify the first fragments section before it can eliminate or report the existence of the overall datagram. By transmitting only a second fragment from the overall sequence of fragments, the TCP/IP stack will be required to collect and retain the second piece, assuming that the first section will be arriving out of order. 
     Since the elements necessary for sniffer identification and firewall isolation would be contained within the first fragment, these processes will not be able to operate if no first fragment is ever transmitted. As the covert data is wholly contained within the second fragment, and potentially encrypted, any observation of the transmission will appear as a corrupted partial communication, and thus be discarded; however, since the TCP/IP stack can be designed to be aware of this type of transmission, communication can be covert over the IP network. 
    
    
     
       BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWINGS 
       Novel features and advantages of the present invention, in addition to those mentioned above, will become apparent to those skilled in the art from a reading of the following detailed description in conjunction with the accompanying drawings wherein identical reference characters refer to identical parts and in which: 
         FIG. 1  is a visual representation of an exemplary hypothetical datagram for transmission on an IP network; 
         FIG. 2  is a visual representation of a first fragment of the datagram of  FIG. 1 ; 
         FIG. 3  is a visual representation of a second fragment containing encrypted data of the datagram of  FIG. 1 ; 
         FIG. 4  is a visual representation of a third fragment of the datagram of  FIG. 1 ; 
         FIG. 5  is a simplified block diagram illustrating an exemplary method in accordance with the present invention; and 
         FIG. 6  is a simplified block diagram illustrating another exemplary method in accordance with the present invention. 
     
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
       FIG. 1  illustrates an exemplary datagram  100 . The datagram  100  may be configured for use on a network, such as without limitation, an IP based network. The datagram  100  provides an exemplary layout of a properly formatted IP datagram  100 , that must be complete in order for sniffers, observers, or firewalls to properly detect and analyze the datagram  100 . The illustrated exemplary datagram  100  is 1500 bytes in length (as indicated at item  116 ), because this is the expected length of an ethernet frame, however, any size datagram  100  is contemplated. The datagram  100  may comprise an IP header  110 , a TCP header  112 , and data  114 . The length of the datagram  100  and various components thereof are merely exemplary and are not intended to be limiting. Any size datagram  100 , and components thereof, is contemplated. 
     Under current protocols TCP/IP stacks are required to process datagrams that have a minimum length of 576 bytes. If the illustrated datagram  100  was transmitted normally, even if it was encrypted, its existence would be recorded by sniffers, and the protocol and port would be examined by firewalls. However, it is contemplated that current protocols could be modified and the methods illustrated and described herein can be likewise modified accordingly. 
     The datagram  100  may be broken down into smaller fragments. In this hypothetical example, the datagram  100  is fragmented such that no fragment is larger than a predetermined size. In exemplary embodiments the predetermined size is 576 bytes, however any size is contemplated. The predetermined size may be selected such that no fragment is larger than the size required to be recorded. This will produce a series of smaller datagram fragments. Fragmentation may be performed along an eight byte boundary, though any size boundary is contemplated. In the illustrated example, the 1500 byte datagram  100  may be broken into three smaller datagram fragments  200 ,  300 , and  400 . 
       FIG. 2  illustrates the layout and structure of the first fragment  200  of the hypothetical datagram  100 . The first fragment  200  may comprise, for example without limitation, an IP header  210 , for transportation, a TCP header  212  for port connection, and a first portion of data  214  for the TCP application. In this example, the first portion of data  214  comprises 532 bytes of data, though any amount of data is contemplated. In the illustrated example, this first fragment  200  will not be sent. Since this fragment  200  will never be transmitted, the electronic Internet path will never have an opportunity to determine which TCP port the data is destined for, and therefore, gateways will not be able to properly filter. Likewise, sniffers will be unable to categorize, display, and report the information as this required first fragment  200  will never arrive. 
       FIG. 3  illustrates the layout and structure of the second fragment  300  of the hypothetical datagram  100 . The second fragment  300  may comprise an IP header  310 . This second fragment  300  may also comprise a second portion of data  314 . This second portion of data  314  may comprise the covert data. In the illustrated example, this second fragment  300  is the only fragment  100 ,  200 ,  300  sent. Since this is the only fragment  100 ,  200 ,  300  that will be transmitted, the second fragment  300  will be collected by the destination TCP/IP stack, and stored while waiting for the rest of the datagram fragments  200  and  400  to arrive. If this were normal operations, the three fragments  200 ,  300 , and  400  ( FIGS. 2-4 ) would be reassembled, so that the complete datagram  100  and corresponding data payload could be passed to the waiting TCP port; however, since the second fragment  300  is the only one to actually be transmitted, the lone second fragment  300  would eventually be discarded as data assumed to be transmitted in error. As the TCP/IP stack is responsible for collecting and reassembling the hypothetical datagram  100 , the second portion of data  314  in the second datagram fragment  300  may be decrypted and passed to a specialized application without observation. If this second fragment  300  is noticed, it will appear as unusable corrupted network data. In the illustrated embodiment, the second fragment  300  may comprise 552 bytes of data, though any amount of data is contemplated. 
       FIG. 4  illustrates the third fragment  400  of the hypothetical datagram  100 . In this example, and like the first fragment  200 , this third fragment  400  is never transmitted. The third fragment  400  may comprise an IP header  410  and a third data portion  414  of any size. 
       FIG. 5  is a simplified block diagram illustrating an exemplary method in accordance with the present invention. A datagram of any size may be received or otherwise identified for transmission. A portion of the received datagram may be identified for covert delivery. The received datagram may then be fragmented. In exemplary embodiments, the received datagram is fragmented such that no fragment exceeds a predetermined maximum size. The predetermined maximum size may be selected to be less than what is normally processed by TCP/IP stacks. The fragmentation may be done along any size boundary. The fragment containing the identified data may then be transmitted. In exemplary embodiments, only this fragment is transmitted. The transmitted fragment may be received by a remote device and passed to a specialized application for opening. In exemplary embodiments the transmitted fragment may be encrypted and the additional step of decrypting the fragment upon receipt may be performed. 
       FIG. 6  is a simplified block diagram illustrating another exemplary method in accordance with the present invention. The datagram may be entirely comprised of data not designated for covert delivery. Instead, the datagram may be comprised of arbitrary or normal data. The data desired for covert delivery may instead be inserted into one of the fragments for delivery. 
     Of course, the provided example is merely exemplary. It is contemplated that any size datagram may be fragmented into any number and size fragments without departing from the spirit or scope of the invention. It is also contemplated that as new protocols are used, or existing protocols are modified, the illustrated and described methods may be updated accordingly. 
     The system and method described herein may comprise one or more electronic storage devices which comprise executable software instructions and one or more processors for executing said executable software instructions. The execution of said executable software instructions may configure the processor to perform one or more functions described herein. 
     Any embodiment of the present invention may include any of the optional or preferred features of the other embodiments of the present invention. The exemplary embodiments herein disclosed are not intended to be exhaustive or to unnecessarily limit the scope of the invention. The exemplary embodiments were chosen and described in order to explain some of the principles of the present invention so that others skilled in the art may practice the invention. Having shown and described exemplary embodiments of the present invention, those skilled in the art will realize that many variations and modifications may be made to the described invention. Many of those variations and modifications will provide the same result and fall within the spirit of the claimed invention. It is the intention, therefore, to limit the invention only as indicated by the scope of the claims.