Collaborative Research: SaTC: CORE: Medium: Rethinking the Fundamentals of Tunneling Technologies for Security, Privacy, and Usability

虚拟专用网络（vpn）是数千万美国人以及世界各地保护美国利益并帮助执行美国外交政策的活动人士、记者和非政府组织的安全和隐私实践的重要组成部分。尽管VPN生态系统已经发展成为一个价值数十亿美元的产业，但在实践中，VPN安全和隐私的许多方面仍然没有得到充分的研究和审查。如果攻击者能够对VPN背后隐藏的流量做出有根据的猜测，那么VPN保护用户的效果如何？如何可行是隐藏VPN流量，使其不被阻止？vpn满足用户对隐私和安全的期望吗？VPN提供商遵循安全和隐私最佳实践的频率是多少？应该采取的其他安全和隐私最佳实践是什么？本项目通过技术评估、精心设计的测量以及详细的定量和定性研究来回答这些问题。虚拟专用网（vpn）可以有效地形成一条加密隧道来保护用户的流量。本项目旨在通过以下四个方面的努力，为VPN安全和隐私开发智力理解、技术和实用解决方案：(1)建立方法，从道德上衡量需要保护的用户元数据和未加密数据中包含的内容；(2)分析隧道技术的各层如何以易受攻击的方式相互作用，类似于研究得更好的网络入侵检测系统的理论限制；(3)通过对不同掘进工具的自动化系统探索，绘制出不断演变的隧道掘进生态系统；(4)利用定量和定性研究来了解利益相关者（用户、提供者、推荐者）的需求，找到促进预期结果的最佳途径。这些努力结合起来将提高OSI网络堆栈所有层隧道技术的安全性和隐私性，从物理、链路和路由一直到应用程序进入人的层。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Virtual Private Networks, or VPNs, are an important and integral part of the security and privacy practices of tens of millions of Americans, and of activists, journalists, and NGOs around the world that protect U.S. interests and help to carry out U.S. foreign policy. Despite the fact that the VPN ecosystem has expanded into a multi-billion dollar industry, there are many aspects of VPN security and privacy in practice that remain severely understudied and unvetted. How well does a VPN protect users against an attacker who can make educated guesses about what traffic is hidden behind the VPN? How feasible is it to hide VPN traffic so that it is not blocked? Do VPNs meet users' privacy and security expectations? How often do VPN providers follow security and privacy best practices? What are the other security and privacy best practices that should be put in place? This project is answering these questions through technical assessments, carefully designed measurements, and detailed quantitative and qualitative research.Virtual Private Networks, or VPNs, effectively form an encrypted tunnel to protect user traffic. This project aims to develop both intellectual understanding and technical and practical solutions for VPN security and privacy through four concurrent efforts: (1) building methods to ethically measure what is contained in users’ metadata and unencrypted data that needs protection; (2) analyzing how the layers of a tunnel technology interact in vulnerable ways, akin to the much better-studied theoretical limitations of network intrusion detection systems; (3) mapping out the evolving tunneling ecosystem by automating methodical exploration of different tunneling tools; (4) using quantitative and qualitative research to understand the stakeholders’ (users, providers, recommenders) needs to find the best ways to facilitate desired outcomes. These efforts combined will improve the security and privacy of tunnel technologies in all layers of the OSI network stack, from physical, link, and routing all the way through application into the human layer.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.