Refine
Document Type
Language
- English (15)
Keywords
- Anonymous Communication (1)
- Onion Routing (1)
- Onion Routing; Website Fingerprinting; Multipath Traffic; Privacy (1)
- Privacy (1)
- Routing, Internet of Things, Protocols, Cryptography, Servers (1)
- TLS Performance, Efficient Secure Communication, TLS Session Resumption, Network Security, Security and Privacy, Mobile Networking, 5G and IoT (1)
- Traffic Analysis (1)
- Traffic Analysis;Website Fingerprinting; Privacy; Anonymous Communication; Onion Routing; Web Privacy (1)
- Web Privacy (1)
- Website Fingerprinting (1)
Institute
High packet rates at ≥ 10 GBit/s challenge the packet processing performance of network stacks. A common solution is to offload (parts of) the user-space packet processing to other execution environments, e.g., into the device driver (kernel-space), the NIC or even from virtual machines into the host operating system (OS), or any combination of those. While common wisdom states that offloading optimizes performance, neither benefits nor negative effects are comprehensively studied. In this paper, we aim to shed light on the benefits and shortcomings of eBPF/XDP-based offloading from the user-space to i) the kernel-space or ii) a smart NIC-including VM virtualization. We show that offloading can indeed optimize packet processing, but only if the task is small and optimized for the target environment. Otherwise, offloading can even lead to detrimental performance.
Users of an onion routing network, such as Tor, depend on its anonymity properties. However, especially malicious entry nodes, which know the client’s identity, can also observe the whole communication on their link to the client and, thus, conduct several de-anonymization attacks. To limit this exposure and to impede corresponding attacks, we propose to multipath traffic between the client and the middle node to reduce the information an attacker can obtain at a single vantage point. To facilitate the deployment, only clients and selected middle nodes need to implement our approach, which works transparently for the remaining legacy nodes. Furthermore, we let clients control the splitting strategy to prevent any external manipulation.
Website fingerprinting (WFP) aims to infer information about the
content of encrypted and anonymized connections by observing
patterns of data flows based on the size and direction of packets. By
collecting traffic traces at a malicious Tor entry node — one of the
weakest adversaries in the attacker model of Tor — a passive eavesdropper can leverage the captured meta-data to reveal the websites visited by a Tor user. As recently shown, WFP is significantly more effective and realistic than assumed. Concurrently, former WFP defenses are either infeasible for deployment in real-world settings or defend against specific WFP attacks only.
To limit the exposure of Tor users to WFP, we propose novel
lightweight WFP defenses, TrafficSliver, which successfully counter
today’s WFP classifiers with reasonable bandwidth and latency
overheads and, thus, make them attractive candidates for adoption
in Tor. Through user-controlled splitting of traffic over multiple
Tor entry nodes, TrafficSliver limits the data a single entry node
can observe and distorts repeatable traffic patterns exploited by
WFP attacks.We first propose a network-layer defense, in which we
apply the concept of multipathing entirely within the Tor network.
We show that our network-layer defense reduces the accuracy from
more than 98% to less than 16% for all state-of-the-art WFP attacks
without adding any artificial delays or dummy traffic. We further
suggest an elegant client-side application-layer defense, which is
independent of the underlying anonymization network. By sending
single HTTP requests for different web objects over distinct Tor
entry nodes, our application-layer defense reduces the detection
rate of WFP classifiers by almost 50 percentage points. Although it
offers lower protection than our network-layer defense, it provides
a security boost at the cost of a very low implementation overhead and is fully compatible with today's Tor network.
In recent years, the amount of traffic protected
with Transport Layer Security (TLS) has significantly increased
and new protocols such as HTTP/2 and QUIC further foster
this emerging trend. However, protecting traffic with TLS has
significant impacts on network entities. While the restrictions for
middleboxes have been extensively studied, addressing the impact
of TLS on clients and servers has been mostly neglected so far.
Especially mobile clients in emerging 5G and IoT deployments
suffer from significantly increased latency, traffic, and energy
overheads when protecting traffic with TLS. In this paper,
we address this emerging topic by thoroughly analyzing the
impact of TLS on clients and servers and derive opportunities
for significantly decreasing latency of TLS communication and
downsizing TLS management traffic, thereby also reducing TLSinduced
server load. We propose a protocol compatible redesign
of TLS session management to use these opportunities and
showcase their potential based on mobile device traffic and mobile
web-browsing traces. These show promising potentials for latency
improvements by up to 25.8% and energy savings of up to 26.3%.
Website fingerprinting (WFP) attacks on the anonymity network Tor have become ever more effective. Furthermore, research discovered that proposed defenses are insufficient or cause high overhead. In previous work, we presented a new WFP defense for Tor that incorporates multipath transmissions to repel malicious Tor nodes from conducting WFP attacks. In this demo, we showcase the operation of our traffic splitting defense by visually illustrating the underlying Tor multipath transmission using LED-equipped Raspberry Pis.