[saag] Ubiquitous Encryption: content filtering

[Natasha Rooney <[e-mail]>]

Hi all,

I have a new submission for the Ubiquitous Encryption draft. I must admit, this one is a little controversial, and certainly is not something I believe in. However, I had a good think about it, and figured that this is an "effect" of ubiquitous encryption, and maybe would be beneficial for the draft. I am not expecting anything comes out of adding it past education for members of the IETF community that this is an issue for some organisations, governments and maybe users. Please feel free to tweet me if you want to discuss personal views! Anyway, here we go:


2.3.X Content Filtering
Law agencies may request Service Providers to block access to particular sites such as online betting and gambling, sites promoting anorexia, or access to dating sites. Content filtering in the mobile network usually occurs in the core network. A proxy is installed which analyses the transport metadata of the content users are viewing and either filters content based on a blacklist of sites or based on the user’s pre-defined profile (e.g. for age sensitive content). Although filtering can be done by many methods one common method occurs when a DNS lookup reveals a URL which appears on a government or recognised block-list. The subsequent requests to that domain will be re-routed to a proxy which checks whether the full url matches a blocked url on the list, and will return a 404 if a match is found. All other requests should complete.

Even in encrypted connections transport and lower layer metadata is able to be viewed so for many systems content filtering should be able to continue. Cases when they may not work is when TLS proxies are being used which obscure metadata with the proxy metadata, and future versions in HTTP and TCP may encrypt metadata again stopping content filtering software from working (this is currently not the case and has not been standardised).

Some sites involve a mixture of universal and age-sensitive content and filtering software in these cases may use more granular (application layer) metadata to analyse and block; this will not work on encrypted content.


I do have a few questions about what I have written, maybe someone can answer:
[1] Does HTTP2 multiplexing do anything to content filtering software, i.e. when sending multiple requests for one webpage (loading images in particular). I don’t think it does it’s just that my brain isn’t working this afternoon...
[2] Is it fair to mention future versions of HTTP and TCP when nothing has been standardised yet? I don’t think so in which case maybe this should be removed.

Hope this didn’t ruin everyones morning! Thanks!

Natasha


Natasha Rooney | Web Technologist | GSMA | [e-mail]<mailto:[e-mail]> | [phone] | @thisNatasha | Skype: [e-mail]<mailto:[e-mail]>
Tokyo, Japan



This email and its attachments are intended for the above named only and may be confidential. If they have come to you in error you must take no action based on them, nor must you copy or show them to anyone; please reply to this email or call [phone] and highlight the error.