论文标题
可编程网络内部混淆流量
Programmable In-Network Obfuscation of Traffic
论文作者
论文摘要
可编程开关硬件的最新进展为保护用户隐私提供了新的机会。本文介绍了Pinot，这是一种轻巧的网络匿名解决方案，该解决方案在硬件开关的内存和处理约束中以线速率运行。 Pinot使用有效的加密方案加密客户端的IPv4地址，以隐藏下游ASES和目标服务器的地址。 Pinot很容易部署，除了运行的受信任网络以外的网络不需要最终用户软件或合作。我们在赤脚的豆腐交换机上实现了黑皮诺的原型，在校园网络中部署黑皮诺，并在保护用户身份免受公共DNS，NTP和WireGuard VPN服务方面的结果。
Recent advances in programmable switch hardware offer a fresh opportunity to protect user privacy. This paper presents PINOT, a lightweight in-network anonymity solution that runs at line rate within the memory and processing constraints of hardware switches. PINOT encrypts a client's IPv4 address with an efficient encryption scheme to hide the address from downstream ASes and the destination server. PINOT is readily deployable, requiring no end-user software or cooperation from networks other than the trusted network where it runs. We implement a PINOT prototype on the Barefoot Tofino switch, deploy PINOT in a campus network, and present results on protecting user identity against public DNS, NTP, and WireGuard VPN services.
