IAB workshop on Management Techniques in Encrypted Networks (M-TEN) (mtenws)

Our proposal is to provide performance information in a uniform way for connections using protocols which encrypt the application payload, such as TLS, without the need to decrypt the payload. This preserves the privacy of the payload. PDMv2 also provides performance information for connections which encrypt the Transport Layer header, such as QUIC, again while preserving the privacy of the payload as well as Transport Header.

Context: Quality of Experience (QoE) monitoring (from passive measurements, at the network side) for multimedia services (video streaming, web browsing, mobile apps) is a daunting yet critical task for Internet Service Providers (ISPs), who need to shed light on the performance of their networks as perceived by their customers, to avoid churn due to quality dissatisfaction.

Problem: While ISPs have traditionally relied on the usage of Deep Packet Inspection (DPI) techniques to understand the performance of web services from the NETWORK SIDE (monitoring at the end-device is out of scope here, as it does not scale and has many associated limitations, in particular strongly limits visibility), the wide adoption of end-to-end traffic encryption has drastically reduced their visibility.

Some network operators use content filtering, via DNS filtering and other network-based mechanisms, as a way to prevent their networks from being used to access content that violates their policies. For example, these networks will filter out malware or objectionable content.

Simultaneously, client devices and applications want to protect users from networks collecting sensitive and private information about their activity. Techniques here include encrypting TLS metadata, encrypting DNS traffic and selecting trusted DNS resolvers, and employing proxies or VPNs.

Although the mechanisms employed for user privacy and security can interfere with the mechanisms traditionally used for network-based content filtering, the objectives of the networks and clients are not fundamentally in conflict. Client devices and applications likely don’t want their users exposed to bad content, users likely don’t want to violate any network terms and conditions, and network operators usually don’t want to collect private information to track users.

In this paper, we suggest an approach to designing collaborative solutions for network-informed content filtering.

To protect your privacy online, researchers are looking increasingly into relay mechanisms – allowing your data to be encrypted more often and passed through more parts until it reaches its final host. Could this be the future of secure communication? Find out below.

This paper initiates research on zero-knowledge middleboxes (ZKMBs). A ZKMB is a network middlebox that enforces network usage policies on encrypted traffic. Clients send the middlebox zero-knowledge proofs that their traffic is policy-compliant; these proofs reveal nothing about the client’s communication except that it complies with the policy. We show how to make ZKMBs work with unmodified encrypted-communication protocols (specifically TLS 1.3), making ZKMBs invisible to servers. As a contribution of independent interest, we design optimized zero-knowledge proofs for TLS 1.3 session keys.

We apply the ZKMB paradigm to several case studies. Experimental results suggest that in certain settings, performance is in striking distance of practicality; an example is a middlebox that filters domain queries (each query requiring a separate proof) when the client has a long-lived TLS connection with a DNS resolver. In such configurations, the middlebox’s overhead is 2–5 ms of running time per proof, and client latency to create a proof is several seconds. On the other hand, clients may have to store hundreds of MBs depending on the underlying zero-knowledge proof machinery, and for some applications, latency is tens of seconds.

Quickly and accurately classify applications is important for network congestion control and network service assurance. However with the increased usage of data encryption, privacy enhancing technologies, it became difficult to obtain metadata or sample labels for private enterprise applications. This position papers discusses encrypted traffic classification through deep learning technology. A flow-based classification mechanism is proposed, which only relies on the statistical characteristics of packets, such as time series characteristics, 5 tuple information for feature extraction.

Over the past several decades, the Internet infrastructure has evolved in many ways and one notable trend is encrypted transport which renders conventional traffic classification methods increasingly less effective. In this position paper, we point out that existing classifiers for encrypted network traffic are suffering from crucial problems associated with inadequate efficiency for real-life deployment and low model transferability. We propose potential research directions to address these challenges by reducing the feature space required for such classifiers and exploiting robust network-level features across multiple datasets across time and space.

The continual increase in encrypted Internet traffic has brought network operational management challenges. In this paper, I discuss preliminary results of a project at USC/ISI designed to quickly predict what type of traffic may be contained within encrypted tunnels for the purpose of applying traffic prioritization techniques to low-latency and other critical flows. Our results show that basic traffic analysis can be used with a reasonable level confidence when making decisions about possible actions to take in adjusting prioritization techniques of encrypted flows

Increased use of encryption at the transport, network, or application layer impacts how
networks are operated, managed, and secured, especially existing traffic management practices.
This position paper analyzes impacts on network management protocols and
functionalities, encrypted traffic identification process and a collection of encryption techniques
and Internet traffic categorization in the existing traffic management. Encrypted traffic
identification processes appear to be hard since Application-layer and transport-layer encryption
make the traffic class estimation more complex and less accurate and therefore might be not
effective as input information to the queue management. To make network management in
support traffic encryption, the various metadata information exchange and storage appears to be
useful, especially size and time related data. These data will be more effective to be used in the
flow based traffic identification and classification, which can detect the traffic class without
decryption. This position paper also discuss the future direction, in order to support modern data
driven traffic management at the network layer, more coordination between the management
plane and data plane or between application layer and network layer is required to support
more fine granularity network control on various different application traffic.

Internet measurement is important to researchers from industry, academia and civil society. While measurement of the internet can give insight into the functioning and usage of the Internet, it can present risks to user privacy. This document describes briefly those risks and proposes guidelines for ensuring that internet measurements can be carried out safely, with examples.