IPSecOPEP: IPSec over PEPs architecture, for secure and optimized communications over satellite links

Djeddai, Lekhemissi; Liu, Rong Ke

doi:10.1109/icsess.2016.7883063

Cited by 10 publications

(10 citation statements)

References 6 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In contrast with lower level approaches, interactions with TCP PEPs must now be considered directly. Many replicate traditional VPN software with bespoke modifications -for example by creating a modified IPSec with special encapsulating headers visible to PEP appliances [27], [28]. Proprietary "satellite VPNs" also exist which, while public information on their design is limited, are likely similar in design [29], [30].…”

Section: Existing Security Approachesmentioning

confidence: 99%

“…This ability for customers to protect their traffic between two arbitrary endpoints without trusting their ISP makes QPEP's security properties most comparable to prior satellite VPN protocol proposals [27], [28]. However, QPEP's design differs from these tools which still reveal limited portions of the TCP header to ISP PEPs for optimization (e.g.…”

Section: A Qpep Design Objectivesmentioning

confidence: 99%

See 1 more Smart Citation

QPEP: An Actionable Approach to Secure and Performant Broadband From Geostationary Orbit

Pavur

Strohmeier²,

Lenders³

et al. 2021

Proceedings 2021 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

Satellite broadband services are critical infrastructures, bringing connectivity to the most remote regions of the globe. However, due to performance concerns, many geostationary satellite broadband services are unencrypted and vulnerable to long-range eavesdropping attacks. This paper delves into the underlying cause of these issues, presenting the case that the widespread use of Performance Enhancing Proxies (PEPs) for TCP optimization has created a security/performance trade-off. A review of previous mitigation proposals finds limited real-world adoption due to a variety of factors ranging from misaligned commercial incentives to the prevalence of unverified "black-box" encryption products. To address these shortcomings, we design and implement a fully open-source and encrypted-by-default PEP/VPN hybrid, called QPEP. Built around the QUIC standard, QPEP enables individuals to encrypt satellite traffic without ISP involvement. Additionally, we present an open and replicable Docker-based testbed for benchmarking QPEP, and other PEP applications, through simulation. These experiments show that QPEP enables satellite customers to encrypt their TCP traffic with up to 72% faster page load times (PLTs) compared to traditional VPN encryption. Even relative to other unencrypted PEPs, QPEP offers up to 54% faster PLTs while also protecting communications in transit. We briefly discuss how QPEP might leverage bespoke modifications to the QUIC protocol for further optimization. Ultimately, our experiments suggest that QPEP's hybrid architecture represents a promising new technique for bringing both security and performance to satellite broadband while avoiding costly alterations to status-quo networks.

show abstract

Section: Existing Security Approachesmentioning

confidence: 99%

Section: A Qpep Design Objectivesmentioning

confidence: 99%

QPEP: An Actionable Approach to Secure and Performant Broadband From Geostationary Orbit

Pavur

Strohmeier²,

Lenders³

et al. 2021

Proceedings 2021 Network and Distributed System Security Symposium

View full text Add to dashboard Cite

show abstract

“…Many seek to replicate traditional VPN software with bespoke modifications -for example by creating a modified IPSec with special encapsulating headers visible to PEP appliances [10,13]. Proprietary satellite VPNs also exist which, while public information on their design is limited, are likely similar in principle [12,15].…”

Section: Network and Transport-layer Approachesmentioning

confidence: 99%

QPEP: A QUIC-Based Approach to Encrypted Performance Enhancing Proxies for High-Latency Satellite Broadband

Pavur,

Strohmeier,

Lenders

et al. 2020

Preprint

View full text Add to dashboard Cite

Satellite broadband services are critical infrastructures enabling advanced technologies to function in the most remote regions of the globe. However, status-quo services are often unencrypted by default and vulnerable to eavesdropping attacks. In this paper, we challenge the historical perception that over-the-air security must trade off with TCP performance in high-latency satellite networks due to the deep-packet inspection requirements of Performance Enhancing Proxies (PEPs).After considering why prior work in this area has failed to find wide adoption, we present an open-source encryptedby-default PEP -QPEP -which seeks to address these issues. QPEP is built around the open QUIC standard and designed so individual customers may adopt it without ISP involvement. QPEP's performance is assessed through simulations in a replicable docker-based testbed. Across many benchmarks and network conditions, QPEP is found to avoid the perceived security-encryption trade-off in PEP design. Compared to unencrypted PEP implementations, QPEP reduces average page load times by more than 30% while also offering over-the-air privacy. Compared to the traditional VPN encryption available to customers today, QPEP more than halves average page load times. Together, these experiments lead to the conclusion that QPEP represents a promising new approach to protecting modern satellite broadband connections.

show abstract

“…At present, several mechanisms have been developed, mainly focusing on the improvement of transmission performance or security, such as [3,4,5]. However, these schemes lack system city and versatility, and the computational overhead and communication overhead are relatively high.…”

Section: Motivationmentioning

confidence: 99%

“…The researchers are mitigating these problems in the satellite environment primarily by improving traditional solutions. [3] applies IPSec in the performance-enhanced gateway PEP of the satellite IP network, which improves the performance of TCP/IP on the satellite IP network, and enhances the security of the satellite network. [4] Introduces a layered architecture extension in IPSec, called CL-IPSec, to provide authentication and integrity services.…”

Section: Introductionmentioning

confidence: 99%

Toward Bandwidth-efficient Data Distribution in Satellite Networks

Xu¹,

Wang²,

Chen³

et al. 2018

Proceedings of the 2018 International Conference on Transportation &Amp; Logistics, Information &Amp; Communication, Smart City

View full text Add to dashboard Cite

In the satellite communication system, the satellite-ground link acts as an intermediary connecting the space network with the terrestrial network. Unfortunately, this link has become a bottleneck due to bandwidth fatigue, which seriously threatens the availability of network services. Besides, as a typical open channel, the satellite-ground link faces numerous security threats, such as signal interception and interference. In response, solutions have been developed to mitigate such a bottleneck. However, the existing schemes cannot achieve the security and efficiency of transmission concurrently. In this paper, we propose a lightweight data distribution mechanism, which economizes the satellite-ground link bandwidth through request aggregation and service subscription. Meanwhile, it enables the secure transmission by employing digital signature technology. Further, to reduce the service delay, we design a caching mechanism based on resource popularity prediction. Simulation experiments validate the higher bandwidth efficiency of our solution, and thus greatly improving the availability of satellite services.

show abstract

IPSecOPEP: IPSec over PEPs architecture, for secure and optimized communications over satellite links

Cited by 10 publications

References 6 publications

QPEP: An Actionable Approach to Secure and Performant Broadband From Geostationary Orbit

QPEP: An Actionable Approach to Secure and Performant Broadband From Geostationary Orbit

QPEP: A QUIC-Based Approach to Encrypted Performance Enhancing Proxies for High-Latency Satellite Broadband

Toward Bandwidth-efficient Data Distribution in Satellite Networks

Contact Info

Product

Resources

About