Collaborative Research: SaTC: CORE: Medium: Rethinking the Fundamentals of Tunneling Technologies for Security, Privacy, and Usability

虚拟专用网络（VPN）是数千万美国人以及世界各地保护美国利益并帮助执行美国外交政策的活动家，记者和非政府组织的安全和隐私实践的重要组成部分。 尽管VPN生态系统已经扩展到一个价值数十亿美元的行业，但实际上VPN安全和隐私的许多方面仍然受到严重的研究和揭露。 VPN如何保护用户免受攻击者的攻击，攻击者可以对VPN背后隐藏的流量进行有根据的猜测？隐藏VPN流量以使其不被阻止的可行性如何？ VPN是否满足用户的隐私和安全期望？ VPN提供商多久遵循一次安全和隐私最佳实践？还有哪些安全和隐私最佳实践应该到位？ 该项目通过技术评估、精心设计的测量以及详细的定量和定性研究来回答这些问题。虚拟专用网络（VPN）有效地形成加密隧道来保护用户流量。 该项目旨在通过以下四个方面的努力，为VPN安全和隐私开发知识理解以及技术和实用解决方案：（1）建立方法，以道德方式衡量用户元数据和未加密数据中包含的需要保护的内容;（2）分析隧道技术的各层如何以脆弱的方式相互作用，类似于网络入侵检测系统的更好研究的理论局限性：（3）通过自动化不同隧道工具的系统探索来绘制不断发展的隧道生态系统;（4）利用定量和定性研究，了解利益攸关方（用户、提供者、供应商）的需求，以找到促进预期成果的最佳途径。 这些努力的结合将提高隧道技术在OSI网络堆栈的所有层的安全性和隐私性，从物理，链路和路由一直到应用程序到人类层。这个奖项反映了NSF的法定使命，并已被认为是值得通过使用基金会的智力价值和更广泛的影响审查标准进行评估的支持。

Virtual Private Networks, or VPNs, are an important and integral part of the security and privacy practices of tens of millions of Americans, and of activists, journalists, and NGOs around the world that protect U.S. interests and help to carry out U.S. foreign policy. Despite the fact that the VPN ecosystem has expanded into a multi-billion dollar industry, there are many aspects of VPN security and privacy in practice that remain severely understudied and unvetted. How well does a VPN protect users against an attacker who can make educated guesses about what traffic is hidden behind the VPN? How feasible is it to hide VPN traffic so that it is not blocked? Do VPNs meet users' privacy and security expectations? How often do VPN providers follow security and privacy best practices? What are the other security and privacy best practices that should be put in place? This project is answering these questions through technical assessments, carefully designed measurements, and detailed quantitative and qualitative research.Virtual Private Networks, or VPNs, effectively form an encrypted tunnel to protect user traffic. This project aims to develop both intellectual understanding and technical and practical solutions for VPN security and privacy through four concurrent efforts: (1) building methods to ethically measure what is contained in users’ metadata and unencrypted data that needs protection; (2) analyzing how the layers of a tunnel technology interact in vulnerable ways, akin to the much better-studied theoretical limitations of network intrusion detection systems; (3) mapping out the evolving tunneling ecosystem by automating methodical exploration of different tunneling tools; (4) using quantitative and qualitative research to understand the stakeholders’ (users, providers, recommenders) needs to find the best ways to facilitate desired outcomes. These efforts combined will improve the security and privacy of tunnel technologies in all layers of the OSI network stack, from physical, link, and routing all the way through application into the human layer.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.