1. Anticensorship in the Network Infrastructure Eric Wustrow University of Michigan

2. Background | Internet Censorship 2 Pervasive censorship Substantial censorship Changing situation Little or no censorship Selective censorship

3. 3 Censor… controls client’s network, but not external network … blocks according to a blacklist … allows HTTPS connections to non-blocked sites Threat Model

4. 4 Telex | Overview

5. 5

6. 6

7. 7

8. 8

9. 9

10. Prototype | Test Deployment Hosted sites 10 Single Telex Station on lab-scale “ISP” at Michigan Blocked.telex.cc Simulated censored site only reachable via Telex NotBlocked.telex.cc Unobjectionable content * Inline Blocking Asymmetric flows

11. Telex v2: Passive tap 11

12. ClientServerISP Proxy “GET / HTTP/1.1\r\nX-Ignore: \x81\x28\x66 …” ACK [seq=Y, ack=X] “PROXY OK” [seq=Y, ack=X, len=M] ACK [seq=X, ack=Y+M] ack != Y? “\x95\x1f\x6b\x27\xe2 … \xc8\x3f\x22 …” Tag: Plaintext: Ciphertext: Plaintext: “GET http://blocked.com/ …” [seq=X, ack=Y+M] Plaintext: “HTTP/1.1 200 OK … ….” Plaintext: New architecture -- passive ISP tap TLS Handshake

13. New architecture -- passive ISP tap Pros –No inline blocking required, only passive tap –Works with asymmetric flows (client -> server) Cons –Censor can use active attacks (though we can use “active defenses”) 13

14. Anticensorship in the Network Infrastructure Future work –Looking for ISPs willing to help Technical feedback Prototype deployment –Strategies for optimal deployment –Improving traffic analysis defense 14

15. https://telex.cc Anticensorship in the Network Infrastructure Eric Wustrow Colleen M. Swanson Scott Wolchok Ian Goldberg J. Alex Halderman