EAGER: Towards a Traffic Analysis Resistant Internet Architecture

许多民族国家通过分析互联网用户的流量来限制公民通过互联网获取信息，然后封锁被认为有争议或与民族国家观点相反的流量。该项目探索了另一种端到端网络架构，消除了公民对流量分析的脆弱性。研究人员提出了可替代的互联网架构和协议设计，评估了这些设计对互联网利益相关者的影响，并提供了可替代设计的正确性、性能和可扩展性的评估方法。该项目广泛影响多个领域和研究社区，从网络安全和反审查社区到那些设计和运行互联网的人。确保世界各地的个人可以轻松地通过互联网访问信息是这个项目背后的核心和驱动原则之一。流量分析使用数据包元数据和侧通道来推断在网络上运行的通信会话的信息，无论是否加密。代理服务通过在数据包源和目的地之间插入中间节点，使流量分析变得困难，但其成功程度有限。它们可以被检测和阻止。核心概念将通信会话绑定到动态的、短暂的、看似随机的Internet Protocol （IP）地址。这从根本上影响了互联网的多个方面：域名系统（DNS）、IP寻址/路由和数据包转发。这个EAGER项目将探索解决方案空间（范围、能力、影响），确定实现策略，并开发一个原型来评估方法的关键属性。该项目的智力优势包括基于短暂的、伪随机的IP地址、IPv6寻址和域间路由以及SDX架构/功能的主机和网络方法。

Many nation states restrict citizen access to information over the Internet by analyzing Internet users' traffic and then blocking traffic deemed controversial or antithetical to the views of the nation state. This project explores an alternative end-to-end network architecture that removes the vulnerability of citizens to traffic analysis. The researchers propose alternative Internet architecture and protocol designs, assesses the impact of such designs on Internet stakeholders, and provide assessment methods for correctness, performance, and scalability of the alternative design. The project broadly impacts multiple domains and research communities, from the network security and anti-censorship communities to those who design and run the Internet. Assuring that individuals around the world can easily access information over the Internet is one of the core, driving principles behind this project.Traffic analysis uses packet meta-data and side-channels to infer information about communication sessions, encrypted or not, running over a network. Proxy services make traffic analysis difficult by inserting intermediate nodes between packet source and destination, but their success is limited. They can be detected and blocked. The core concept binds communications sessions to dynamic, short-lived, and seemingly random Internet Protocol (IP) addresses. This fundamentally impacts multiple aspects of the Internet: the domain name system (DNS), IP addressing/routing, and packet forwarding. This EAGER project will explore the solution space (scope, capabilities, impact), identify strategies for realization, and develop a prototype to assess key properties of the approach. The project's intellectual merit includes host and network methods based on ephemeral, pseudo-random IP addresses, IPv6 addressing and inter-domain routing, and SDX architecture/functions.