NeTS: Small: Collaborative Research: Practical HTTPS Traffic Manipulation At Middleboxes

加密网络流量的使用正以前所未有的速度增长。在增强用户隐私的同时，安全超文本传输协议(HTTPS)使得互联网服务提供商和移动运营商常用的中间盒难以操作，因为许多有益的中间盒功能(例如，缓存、网页优化)依赖于访问未加密的流量内容。为了克服这一挑战，该项目开发了一个系统，旨在开发一种实用的、随时可以部署的解决方案，允许中间盒有选择地检查和操纵HTTPS流量，同时仍尊重用户的隐私要求。这项研究将导致网络服务方面的新的、持续的创新，这些创新是今天很难或不可能实现的。该系统有两个突出的特点。首先，它只部署在客户机上作为操作系统(OS)服务，以及部署在中间盒上。除了对应用程序透明之外，它不会更改加密协议或服务器端的任何内容。因此，该系统可以通过例如由移动运营商推送的定期操作系统更新来容易地部署。其次，该系统允许客户控制中间盒可以访问的信息。这样做为中间盒提供了执行其功能的最少特权。此外，建议的系统易于使用、安全，并且开销较低。开发这些技术将有助于我们理解可能的设计空间，以允许协调、安全和高效地处理HTTPS流量，最终改善互联网用户体验和隐私。PIS将把本项目开发的知识和成果纳入网络、移动计算和网络安全的本科生和研究生课程。

Use of encrypted Web traffic is growing at an unprecedented rate. While enhancing user privacy, Secure Hypertext Transfer Protocol (HTTPS) makes it difficult for middleboxes that are commonly used by Internet service providers and mobile carriers to operate, because numerous beneficial middlebox functions (e.g., caching, web page optimization) rely on accessing the unencrypted traffic content. To overcome this challenge, this project develops a system aiming for a practical, ready-to-deploy solution that allows middleboxes to selectively inspect and manipulate HTTPS traffic while still respect the privacy requirements of users. This research will lead to new and continuous innovations in network services that are hard or impossible to achieve today. The system has two prominent features. First, it is only deployed at client hosts as an operating system (OS) service, as well as on middleboxes. In addition to being transparent to applications, it does not change the encryption protocol or anything on the server side. Therefore, the system can be easily deployed by, for example, regular OS update pushed by mobile carriers. Second, the system allows clients to control what information the middlebox can access. Doing so provides least privileges to middleboxes for performing their functions. In addition, the proposed system is easy to use, secure, and incurs low overhead. Developing these technologies will facilitate our understanding of the possible design space to allow coordinated, secure, and efficient manipulation of HTTPS traffic, ultimately leading to improved Internet user experience and privacy. The PIs will incorporate knowledge and results developed in this project into both undergraduate and graduate courses in networking, mobile computing and network security.