面向服务端地理封锁绕过的显式QUIC代理
Explicit QUIC Proxies for Server-Side Geo-blocking Bypass
浏览论文内容
中文总结 AI 辅助
针对服务端地理封锁，提出利用QUIC连接迁移的Stork代理，通过报头后迁移绕过封锁，在2MB请求中迁移99%数据，对90%真实封锁域名有效。
中文摘要 AI 辅助
地理受限内容在互联网上日益普遍，迫使用户依赖VPN等规避技术，从看似不同的位置访问网络。然而，这些技术往往带来经济成本并可能降低性能。QUIC协议的普及（该协议允许连接在路径之间迁移）为规避此类限制提供了机会。我们扫描了网络服务器，发现大部分地理封锁内容是在服务器端、应用层实施的，而非在路径上。此检查在请求到达时执行一次，不会随连接持续而重复。这使得客户端可以从白名单IP地址发出请求，一旦服务器接受请求，便将连接迁移到原本未经授权的地址以完成剩余传输（报头后迁移）。这绕过了封锁，同时最大化直接流量，从而减少最终的规避相关成本。基于这一洞察，我们推出了Stork，一个HTTP/2到HTTP/3的Web代理，在引入可忽略的额外延迟的同时绕过地理封锁。我们证明了我们的解决方案与主流客户端和服务器兼容。在受控实验中，使用2 MB请求时，我们的代理将99%的传输数据迁移到未经授权的路径。在支持QUIC迁移的真实世界目标中，超过52%的目标至少迁移了75%的数据。在真实的地理封锁内容上，报头后迁移绕过了90%域名的封锁，而先前工作使用的握手后迁移仅对60%的域名成功。
英文摘要
Geo-restricted content is increasingly common on the Internet, forcing users to rely on circumvention techniques, such as VPNs, to access the web from a seemingly different location. However, these often come with a financial cost and can degrade performance. The rise in popularity of the QUIC protocol, which allows connections to migrate between paths, opens opportunities to circumvent such restrictions. We scan web servers and find that a large portion of geo- blocked content is enforced on the server, at the application layer, rather than on-path. This check is performed once, when the request arrives, and is not repeated as the connection continues. This allows a client to issue its request from a whitelisted IP address and, once the server has accepted it, migrate the connection to an otherwise unauthorized address for the rest of the transfer (post-header migration). It bypasses the block while maximizing direct traffic, thereby reducing eventual circumvention-related costs. Building on this insight, we introduce Stork, an HTTP/2-to-HTTP/3 web proxy that bypasses geo-blocking while introducing negligible additional latency. We demonstrate that our solution is compatible with popular clients and servers. In controlled experiments with 2 MB requests, our proxy migrates 99% of the transferred data onto the unauthorized path. Across real-world targets that support QUIC migration, it migrates at least 75% of the data for more than 52% of them. On real geo-blocked content, post-header migration bypasses the block for 90% of domains, whereas post-handshake migration, as used by prior work, succeeds for only 60%.
发表机构
- Université Catholique de Louvain（天主教鲁汶大学）
机构由 AI 辅助整理，请以论文原文为准。
