Collaborative Research: SaTC: CORE: Medium: Rethinking the Fundamentals of Tunneling Technologies for Security, Privacy, and Usability

虚拟专用网络(VPN)是数以千万计的美国人以及世界各地保护美国利益和帮助执行美国外交政策的活动家、记者和非政府组织的安全和隐私实践的重要组成部分。尽管VPN生态系统已经扩展成一个价值数十亿美元的行业，但在实践中，VPN安全和隐私的许多方面仍然严重缺乏研究和审查。VPN能很好地保护用户免受攻击者的攻击，攻击者可以对VPN背后隐藏的流量做出有根据的猜测。隐藏VPN流量以使其不被阻止的可行性有多大？VPN是否满足用户的隐私和安全期望？VPN提供商多久遵循一次安全和隐私最佳实践？应该实施的其他安全和隐私最佳实践是什么？该项目正在通过技术评估、精心设计的测量以及详细的定量和定性研究来回答这些问题。虚拟专用网络(VPN)有效地形成了一条加密隧道来保护用户流量。该项目旨在通过四项同时进行的努力，为VPN安全和隐私开发智力理解以及技术和实践解决方案：(1)建立对用户元数据和需要保护的未加密数据中包含的内容进行伦理测量的方法；(2)分析隧道技术层如何以易受攻击的方式交互，类似于更好地研究网络入侵检测系统的理论局限性；(3)通过自动化对不同隧道工具的有条不紊的探索，规划不断演变的隧道生态系统；(4)使用定量和定性研究来了解利益相关者(用户、提供商和推荐者)需要找到促进预期结果的最佳方法。这些努力结合在一起，将提高OSI网络堆栈所有层中隧道技术的安全性和隐私，从物理、链路和路由一直到应用程序到人类层。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Virtual Private Networks, or VPNs, are an important and integral part of the security and privacy practices of tens of millions of Americans, and of activists, journalists, and NGOs around the world that protect U.S. interests and help to carry out U.S. foreign policy. Despite the fact that the VPN ecosystem has expanded into a multi-billion dollar industry, there are many aspects of VPN security and privacy in practice that remain severely understudied and unvetted. How well does a VPN protect users against an attacker who can make educated guesses about what traffic is hidden behind the VPN? How feasible is it to hide VPN traffic so that it is not blocked? Do VPNs meet users' privacy and security expectations? How often do VPN providers follow security and privacy best practices? What are the other security and privacy best practices that should be put in place? This project is answering these questions through technical assessments, carefully designed measurements, and detailed quantitative and qualitative research.Virtual Private Networks, or VPNs, effectively form an encrypted tunnel to protect user traffic. This project aims to develop both intellectual understanding and technical and practical solutions for VPN security and privacy through four concurrent efforts: (1) building methods to ethically measure what is contained in users’ metadata and unencrypted data that needs protection; (2) analyzing how the layers of a tunnel technology interact in vulnerable ways, akin to the much better-studied theoretical limitations of network intrusion detection systems; (3) mapping out the evolving tunneling ecosystem by automating methodical exploration of different tunneling tools; (4) using quantitative and qualitative research to understand the stakeholders’ (users, providers, recommenders) needs to find the best ways to facilitate desired outcomes. These efforts combined will improve the security and privacy of tunnel technologies in all layers of the OSI network stack, from physical, link, and routing all the way through application into the human layer.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.