Towards practical infrastructure for decoy routing

Abstract

Network censorship and surveillance generally involves ISPs working under the orders of repressive regimes, monitoring (and sometimes filtering) users’ traffic, often using powerful networking devices, e.g. routers capable of performing Deep Packet Inspection (DPI). Such routers enables their operators to observe contents of network flows (traversing their routers) having specific byte sequences. Tor, a low-latency anonymity network has also been widely used to circumvent censorship and surveillance. However, recent efforts have shown that all anti-censorship measures employable using Tor, e.g. Bridges (unadvertised relays) or camouflaging Tor traffic as unfiltered protocol messages (e.g. SkypeMorph), are detectable. To bypass this arms race, several recent efforts propose network based anticensorship systems, collectively and colloquially referred to as Decoy Routers. Decoy Routing systems, relying on “friendly” network routers, aid users behind censorious ISPs to covertly access filtered networks. These Decoy Routers, otherwise operating as “normal” network routers, can on-demand double as Decoy Routers, forwarding network traffic of censored users to covert destinations. Such architectures however assume complex functionalities and programmable capabilities in commodity network routers, that currently seem infeasible. However Software Defined Networking (SDN), the emergent network design and management paradigm, involving centralized control over a network of switches, seems well suited for such requirements. In this position paper, we present the overview of a network based anti-censorship system consisting of several centrally co-ordinated switches, operating as Decoy Routers. Deploying centrally controlled switches, that double as Decoy Routers, could potentially have several advantages over existing proposal, that have until now only been prototyped through commodity desktops – efficiency to switch traffic at line speeds, detecting misbehaving switches, cascading multiple Decoy Routers to assume a hybrid posture for both anonymity and censorship resistance, load-balancing, and automatic failover.