Deep Packet Inspection is a potentially serious issue. It gets us one step closer to Big Brother Amerika and the International Police State. The potential has always been there. It’s in the way that packets are constructed. So, this isn’t exactly new. What is new are hardware devices that can interpret these packets, at full wire-speed, and at reasonable cost.
However, this isn’t quite as bad as it sounds . The statements made are from a naive assessment of the technology, in the original article. It also misleads one into believing that this technology can penetrate encrypted streams, Short answer: it can’t.
What are Packets? or How this works.
In order to send data, the file is broken up into uniform data chunks (about 1024 bytes) and wrapped with an envelope . This is called a network data packet. Each time this packet goes through an intermediate processor, like a switch or router, another envelope gets wrapped around it. Once at the destination, each envelope is carefully unpacked, and the data chunks are carefully reassembled.
A data packet can have many envelopes wrapped around it and usually has at least three. I won’t bore you with the details. Just know that there are multiple concentric layers of these envelopes on each packet and that they have to be there. It is these layers of envelopes that get the packets to where they have to go. On normal Internet packets, DPI can inspect, they claim, down to the MAC layer. The MAC (Media Access Control) layer is the lowest level of envelope and after that it is a pure data chunk. They can then reassemble these chunks themselves, effectively reconstructing a clean copy of the message.
Deployment; Where can they use it?
In order for this to be effective, the DPI device must be placed on a choke-point, to make sure that it captures 100% of your traffic. An ISP would probably want to place DPI devices on your upstream gateway, as well as their outbound gateway. Attaching one of these devices to just a switch in the LAN wouldn’t work because it will not see all the traffic, it has to be on a router.
Impact Analysis: Threat assessment
If you are not using any encryption or obfuscation mechanisms, this will let any ISP in the connection decode and assemble all your data packets, as claimed. The possibility for doing this has always been there but the devices for doing this, at Internet scales, are only now becoming available. Where it is less of a threat is when trivial encryption technologies are used, like SSL or SSH. However, because it enables them to positively identify such packets, it still let’s them kill such packets, even if they are securely encrypted. This threatens to make your connection less reliable but it will not give them the access credentials for your online bank or PayPal account. Neither will it let them tap into an encrypted VPN pipe. However, this does get them uncomfortably closer to that goal.
With DPI, they can now identify your secure traffic, as secure traffic, at least well enough to block it or re-prioritize it, if they so chose. They can also copy your encrypted stream for later decoding. This is undetectable and you will never know unless they tell you. This satisfies CALEA.
Countermeasures
I’ve been saying this for over ten years; encrypt everything! If possible, always use a VPN pipe to access your Enterprise systems, from outside of the Enterprise.
Conclusion
From an encryption standpoint, DPI isn’t much more of a threat than is already assumed by modern encryption protocols. However, your personal emails are not safe, if they ever were. Your SSL protected accounts are still relatively safe, even if slightly less robust.
From an ISP standpoint; DPI let’s them claim CALEA compliance without opening them up to the legal liabilities arising from actually penetrating sensitive data streams .
From a law enforcement standpoint; This has to be frustrating because, all well known criminal organizations access and use the same encryption technologies that banks and Enterprises use.
From an Internet user’s standpoint; If you didn’t know that your privacy was in the state of burnt toast, know it now.
This is yet another chip in the fortress of your private data and can provide the basis of a full attack but it does not constitute, by itself, a successful attack. It is more of an annoyance.
Article Reference
Notes:
——–
–> Sorry, due to spammers, I am only taking comments at LiveJournal, for now. Thank you, The Slamlander