Refine
Document Type
- Doctoral Thesis (2)
Language
- English (2)
Has Fulltext
- no (2)
Keywords
- P2P (1)
- network traffic (1)
- string matching (1)
- traffic classification (1)
- traffic obfuscation (1)
Cyberspace: a world at war. Our privacy, freedom of speech, and with them the very foundations of democracy are under attack. In the virtual world frontiers are not set by nations or states, they are set by those, who control the flows of information. And control is, what everybody wants.
The Five Eyes are watching, storing, and evaluating every transmission. Internet corporations compete for our data and decide if, when, and how we gain access to that data and to their pretended free services. Search engines control what information we are allowed - or want - to consume. Network access providers and carriers are fighting for control of larger networks and for better ways to shape the traffic. Interest groups and copyright holders struggle to limit access to specific content. Network operators try to keep their networks and their data safe from outside - or inside - adversaries.
And users? Many of them just don’t care. Trust in concepts and techniques is implicit. Those who do care try to take back control of the Internet through privacy-preserving techniques.
This leads to an arms race between those who try to classify the traffic, and those who try to obfuscate it. But good or bad lies in the eye of the beholder, and one will find himself fighting on both sides.
Network Traffic Classification is an important tool for network security. It allows identification of malicious traffic and possible intruders, and can also optimize network usage. Network Traffic Obfuscation is required to protect transmissions of important data from unauthorized observers, to keep the information private. However, with security and privacy both crumbling under the grip of legal and illegal black hat crackers, we dare say that contemporary traffic classification and obfuscation techniques are fundamentally flawed. The underlying concepts cannot keep up with technological evolution. Their implementation is insufficient, inefficient and requires too much resources.
We provide (1) a unified view on the apparently opposed fields of traffic classification and obfuscation, their deficiencies and limitations, and how they can be improved. We show that (2) using multiple classification techniques, optimized for specific tasks improves overall resource requirements and subsequently increases classification speed. (3) Classification based on application domain behavior leads to more accurate information than trying to identify communication protocols. (4) Current approaches to identify signatures in packet content are slow and require much space or memory. Enhanced methods reduce these requirements and allow faster matching. (5) Simple and easy to implement obfuscation techniques allow circumvention of even sophisticated contemporary classification systems. (6) Trust and privacy can be increased by reducing communication to a required minimum and limit it to known and trustworthy communication partners.
Our techniques improve both security and privacy and can be applied efficiently on a large scale. It is but a small step in taking back the Web.
Efficient privacy-preserving configurationless service discovery supporting multi-link networks
(2017)
Data is the pollution problem of the information age, and protecting privacy is the environmental challenge — this quotation from Bruce Schneier laconically illustrates the importance of protecting privacy. Protecting privacy — as well as protecting our planet — is fundamental for humankind. Privacy is a basic human right, stated in the 12th article of the United Nations’ Universal Declaration of Human Rights. The necessity to protect human rights is unquestionable. Nothing ever threatened privacy on a scale comparable to today’s interconnected computers. Ranging from small sensors over smart phones and notebooks to large compute clusters, they collect, generate and evaluate vast amounts of data. Often, this data is distributed via the network, not only rendering it accessible to addressees, but also — if not properly secured — to malevolent parties. Like a toxic gas, this data billows through networks and suffocates privacy. This thesis takes on the challenge of protecting privacy in the area of configurationless service discovery. Configurationless service discovery is a basis for user-friendly applications. It brings great benefits, allowing the configurationless network setup for various kinds of applications; e.g. for communicating, sharing documents and collaborating, or using infrastructure devices like printers. However, while today’s various protocols provide some means of privacy protection, typical configurationless service discovery solutions do not even consider privacy. As configurationless service discovery solutions are ubiquitous and run on almost every smart device, their privacy problems affect almost everyone. The quotation aligns very well with configurationless service discovery. Typically, configurationless service discovery solutions realize configurationlessness by using cleartext multicast messages literally polluting the local network and suffocating privacy. Messages containing private cleartext data are sent to everyone, even if they are only relevant for a few users. The typical means for mitigating the network pollution problem caused by multicast per se, regardless of the privacy aspects, is confining multicast messages to a single network link or to the access network of a WiFi access point; institutions often even completely deactivate multicast. While this mitigates the privacy problem, it also strongly scales configurationless service discovery down, either confining it or rendering it completely unusable. In this thesis, we provide an efficient configurationless service discovery framework that protects the users’ privacy. It further reduces the network pollution by reducing the number of necessary multicast messages and offers a mode of operation that is completely independent of multicast. Introducing a multicast independent mode of operation, we also address the problem of the limited range in which services are discoverable. Our framework comprises components for device pairing, privacy-preserving service discovery, and multi-link scaling. These components are independent and — while usable in a completely separated way — are meant to be used as an integrated framework as they work seamlessly together. Based on our device pairing and privacy-preserving service discovery components, we published IETF Internet drafts specifying a privacy extension for DNS service discovery over multicast DNS, a wildly used protocol stack for configurationless service discovery. As our drafts have already been adopted by the dnssd working group, they are likely to become standards.