QPEP: An actionable approach to secure and performant broadband from geostationary orbit
Satellite broadband services are critical infrastructures, bringing connectivity to the most remote regions of the globe. However, due to performance concerns, many geostationary satellite broadband services are unencrypted by default and vulnerable to long-range eavesdropping attacks. The result is...
| Main Authors: | , , , |
|---|---|
| Format: | Conference item |
| Language: | English |
| Published: |
Internet Society
2021
|
| _version_ | 1797101309735731200 |
|---|---|
| author | Pavur, JC Strohmeier, M Lenders, V Martinovic, I |
| author_facet | Pavur, JC Strohmeier, M Lenders, V Martinovic, I |
| author_sort | Pavur, JC |
| collection | OXFORD |
| description | Satellite broadband services are critical infrastructures, bringing connectivity to the most remote regions of the globe. However, due to performance concerns, many geostationary satellite broadband services are unencrypted by default and vulnerable to long-range eavesdropping attacks. The result is that deeply sensitive internet traffic is regularly broadcast in clear-text over vast coverage areas.
This paper delves into the underlying causes of this insecure network design, presenting the case that physical characteristics effecting TCP performance and the widespread use of Performance Enhancing Proxies (PEPs) have created the perception of a security/performance trade-off in these networks. A review of previous mitigation attempts finds limited real-world adoption due to a variety of factors ranging from misaligned commercial incentives to the prevalence of unverified ``black-box'' encryption products.
To address these shortcomings, we design and implement a fully open-source and encrypted-by-default PEP/VPN hybrid, call QPEP. Built around the QUIC standard, QPEP enables individuals to encrypt satellite traffic without ISP involvement. Additionally, we present an open and replicable Docker-based testbed for benchmarking satellite PEPs like QPEP through simulation. These experiments show that QPEP enables satellite customers to encrypt their TCP traffic with up to 65% faster page load times (PLTs) compared to traditional VPN encryption. Even relative to unencrypted PEPs, QPEP offers up to 45% faster PLTs while adding over-the-air security. We briefly evaluate additional tweaks to QUIC which may further optimize QPEP performance. Together, these assessments suggest that QPEP represents a promising new technique for bringing both security and performance to high-latency satellite broadband without requiring alterations to status-quo network implementations. |
| first_indexed | 2024-03-07T05:50:02Z |
| format | Conference item |
| id | oxford-uuid:e88a351a-1036-445f-b79d-3d953fc32804 |
| institution | University of Oxford |
| language | English |
| last_indexed | 2024-03-07T05:50:02Z |
| publishDate | 2021 |
| publisher | Internet Society |
| record_format | dspace |
| spelling | oxford-uuid:e88a351a-1036-445f-b79d-3d953fc328042022-03-27T10:47:36ZQPEP: An actionable approach to secure and performant broadband from geostationary orbitConference itemhttp://purl.org/coar/resource_type/c_5794uuid:e88a351a-1036-445f-b79d-3d953fc32804EnglishSymplectic ElementsInternet Society2021Pavur, JCStrohmeier, MLenders, VMartinovic, ISatellite broadband services are critical infrastructures, bringing connectivity to the most remote regions of the globe. However, due to performance concerns, many geostationary satellite broadband services are unencrypted by default and vulnerable to long-range eavesdropping attacks. The result is that deeply sensitive internet traffic is regularly broadcast in clear-text over vast coverage areas. This paper delves into the underlying causes of this insecure network design, presenting the case that physical characteristics effecting TCP performance and the widespread use of Performance Enhancing Proxies (PEPs) have created the perception of a security/performance trade-off in these networks. A review of previous mitigation attempts finds limited real-world adoption due to a variety of factors ranging from misaligned commercial incentives to the prevalence of unverified ``black-box'' encryption products. To address these shortcomings, we design and implement a fully open-source and encrypted-by-default PEP/VPN hybrid, call QPEP. Built around the QUIC standard, QPEP enables individuals to encrypt satellite traffic without ISP involvement. Additionally, we present an open and replicable Docker-based testbed for benchmarking satellite PEPs like QPEP through simulation. These experiments show that QPEP enables satellite customers to encrypt their TCP traffic with up to 65% faster page load times (PLTs) compared to traditional VPN encryption. Even relative to unencrypted PEPs, QPEP offers up to 45% faster PLTs while adding over-the-air security. We briefly evaluate additional tweaks to QUIC which may further optimize QPEP performance. Together, these assessments suggest that QPEP represents a promising new technique for bringing both security and performance to high-latency satellite broadband without requiring alterations to status-quo network implementations. |
| spellingShingle | Pavur, JC Strohmeier, M Lenders, V Martinovic, I QPEP: An actionable approach to secure and performant broadband from geostationary orbit |
| title | QPEP: An actionable approach to secure and performant broadband from geostationary orbit |
| title_full | QPEP: An actionable approach to secure and performant broadband from geostationary orbit |
| title_fullStr | QPEP: An actionable approach to secure and performant broadband from geostationary orbit |
| title_full_unstemmed | QPEP: An actionable approach to secure and performant broadband from geostationary orbit |
| title_short | QPEP: An actionable approach to secure and performant broadband from geostationary orbit |
| title_sort | qpep an actionable approach to secure and performant broadband from geostationary orbit |
| work_keys_str_mv | AT pavurjc qpepanactionableapproachtosecureandperformantbroadbandfromgeostationaryorbit AT strohmeierm qpepanactionableapproachtosecureandperformantbroadbandfromgeostationaryorbit AT lendersv qpepanactionableapproachtosecureandperformantbroadbandfromgeostationaryorbit AT martinovici qpepanactionableapproachtosecureandperformantbroadbandfromgeostationaryorbit |