1. ZHAW digitalcollection
  2. School of Engineering
  3. Publikationen
  4. Publikationen School of Engineering
Please use this identifier to cite or link to this item: https://doi.org/10.21256/zhaw-1538
Full metadata record
DC FieldValueLanguage
dc.contributor.authorKühlewind, Mirja-
dc.contributor.authorBühler, Tobias-
dc.contributor.authorTrammell, Brian-
dc.contributor.authorNeuhaus, Stephan-
dc.contributor.authorMüntener, Roman-
dc.contributor.authorFairhurst, Gorry-
dc.date.accessioned2017-12-19T15:11:33Z-
dc.date.available2017-12-19T15:11:33Z-
dc.date.issued2017-
dc.identifier.isbn978-3-901882-98-2de_CH
dc.identifier.urihttps://digitalcollection.zhaw.ch/handle/11475/1892-
dc.description.abstractThe deployment of encrypted transport protocols imposes new challenges for network operations. Key in-network functions such as those implemented by firewalls and passive measurement devices currently rely on information exposed by the transport layer. Encryption, in addition to improving privacy, helps to address ossification of network protocols caused by middleboxes that assume certain information to be present in the clear. However, “encrypting it all” risks diminishing the utility of these middleboxes for the traffic management tasks for which they were designed. A middlebox cannot use what it cannot see. We propose an architectural solution to this issue, by introducing a new “path layer” for transport-independent, in-band signaling between Internet endpoints and network elements on the paths between them, and using this layer to reinforce the boundary between the hop-by-hop network layer and the end-to- end transport layer. We define a path layer header on top of UDP to provide a common wire image for new, encrypted transports. This path layer header provides information to a transport- independent on-path state machine that replaces stateful handling currently based on exposed header flags and fields in TCP; it enables explicit measurability of transport layer performance; and offers extensibility by sender-to-path and path-to-receiver communications for diagnostics and management. This provides not only a replacement for signals that are not available with encrypted traffic, but also allows integrity-protected, enhanced signaling under endpoint control. We present an implementation of this wire image integrated with the QUIC protocol, as well as a basic stateful middlebox built on Vector Packet Processing (VPP) provided by FD.io.de_CH
dc.language.isoende_CH
dc.publisherIEEEde_CH
dc.rightsLicence according to publishing contractde_CH
dc.subjectNetworkingde_CH
dc.subjectMeasurementde_CH
dc.subjectEncryptionde_CH
dc.subjectMiddleboxde_CH
dc.subject.ddc004: Informatikde_CH
dc.titleA path layer for the internet : enabling network operations on encrypted protocolsde_CH
dc.typeKonferenz: Paperde_CH
dcterms.typeTextde_CH
zhaw.departementSchool of Engineeringde_CH
zhaw.organisationalunitInstitut für Informatik (InIT)de_CH
dc.identifier.doi10.21256/zhaw-1538-
zhaw.conference.detailsInternational Conference on Network and Service Management, Tokyo, Japan, 26-30 November 2017de_CH
zhaw.funding.euinfo:eu-repo/grantAgreement/EC/H2020/688421//Measurement and Architecture for a Middleboxed Internet/MAMIde_CH
zhaw.originated.zhawYesde_CH
zhaw.publication.statusacceptedVersionde_CH
zhaw.publication.reviewPeer review (Publikation)de_CH
zhaw.title.proceedingsProceedings of the International Conference on Network and Service Management (CNSM)de_CH
zhaw.webfeedInformation Securityde_CH
Appears in collections:Publikationen School of Engineering

Files in This Item:
File Description SizeFormat 
PID5022959.pdf368.12 kBAdobe PDFThumbnail
View/Open
Show simple item record
Kühlewind, M., Bühler, T., Trammell, B., Neuhaus, S., Müntener, R., & Fairhurst, G. (2017). A path layer for the internet : enabling network operations on encrypted protocols. Proceedings of the International Conference on Network and Service Management (CNSM). https://doi.org/10.21256/zhaw-1538
Kühlewind, M. et al. (2017) ‘A path layer for the internet : enabling network operations on encrypted protocols’, in Proceedings of the International Conference on Network and Service Management (CNSM). IEEE. Available at: https://doi.org/10.21256/zhaw-1538.
M. Kühlewind, T. Bühler, B. Trammell, S. Neuhaus, R. Müntener, and G. Fairhurst, “A path layer for the internet : enabling network operations on encrypted protocols,” in Proceedings of the International Conference on Network and Service Management (CNSM), 2017. doi: 10.21256/zhaw-1538.
KÜHLEWIND, Mirja, Tobias BÜHLER, Brian TRAMMELL, Stephan NEUHAUS, Roman MÜNTENER und Gorry FAIRHURST, 2017. A path layer for the internet : enabling network operations on encrypted protocols. In: Proceedings of the International Conference on Network and Service Management (CNSM). Conference paper. IEEE. 2017. ISBN 978-3-901882-98-2
Kühlewind, Mirja, Tobias Bühler, Brian Trammell, Stephan Neuhaus, Roman Müntener, and Gorry Fairhurst. 2017. “A Path Layer for the Internet : Enabling Network Operations on Encrypted Protocols.” Conference paper. In Proceedings of the International Conference on Network and Service Management (CNSM). IEEE. https://doi.org/10.21256/zhaw-1538.
Kühlewind, Mirja, et al. “A Path Layer for the Internet : Enabling Network Operations on Encrypted Protocols.” Proceedings of the International Conference on Network and Service Management (CNSM), IEEE, 2017, https://doi.org/10.21256/zhaw-1538.


Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.