Encrypted Packet Inspection Based on Oblivious Transfer

Abstract

Deep packet inspection (DPI) is widely used in detecting abnormal traffic and suspicious activities in networks. With the growing popularity of secure hypertext transfer protocol (HyperText Transfer Protocol over Secure Socket Layer, HTTPS), inspecting the encrypted traffic is necessary. The traditional decryption-and-then-encryption method has the drawback of privacy leaking. Decrypting encrypted packets for inspection violates the confidentiality goal of HTTPS. Now, people are faced with a dilemma: choosing between the middlebox’s ability to perform detection functions and protecting the privacy of their communications. We propose OTEPI, a system that simultaneously provides both of those properties. The approach of OTEPI is to perform the deep packet inspection directly on the encrypted traffic. Unlike machine and deep learning methods that can only classify traffic, OTEPI is able to accurately identify which detection rule was matched by the encrypted packet. It can facilitate network managers to manage their networks at a finer granularity. OTEPI achieves the function through a new protocol and new encryption schemes. Compared with previous works, our approach achieves rule encryption with oblivious transfer (OT), which allows our work to achieve a better balance between communication traffic consumption and computational resource consumption. And our design of Oblivious Transfer and the use of Natural Language Processing tools make OTEPI outstanding in terms of computational consumption.

SoK: Content Moderation for End-to-End Encryption

“…A typical setting is to detect or block specific keywords, websites, or content in TLS traffic, usually with no special hardware. MPC or Searchable Encryption [54,55,108,150,182,215,216,226,274,295,304,305,336] (total: 13) Trusted Execution Environment [328] (total: 1)…”

“…sexual or drug-related. However the technology used tends to be more highly related to the corporate network monitoring methods-we found many papers for which the technical scheme was self-described for use in both settings [54,55,108,150,182,215,216,226,274,336,336].…”

“…MPC or Searchable Encryption [8,36,54,55,59,94,107,108,150,153,182,199,215,216,225,226,228,246,273,274,295,309,311,336,382] (total: 25) Trusted Execution Environment [78,104,157,158,213,271,294,295,328,339,356,357,369,380] (total: 14) Other [137,295,310,337,387] (total: 5)…”

“…Exact matching was primarily used for detecting malware-hosting web URLs, malware itself, or performing exact queries within TLS network monitoring. The TLS middlebox functions generally provided partial client privacy [182,228], but all other systems provided full client privacy.…”