20.500.12556/RUL-187274 Filtriranje šifriranega prometa s pomočjo programirljive ravnine Encrypted Traffic Filtering via Programmable Data Plane Večina spletnega prometa je danes šifrirana. Organizacije zato za globoko pregledovanje vsebine omrežnega prometa uporabljajo posrednike. Ti za vsako povezavo opravijo dvojno rokovanje TLS ter ves promet dešifrirajo in znova šifrirajo, kar je računsko drago. Poleg tega je podpora za novejši protokol HTTP/3 pri obstoječih rešitvah redka, zato je ta promet pogosto blokiran ali pa ostane nepregledan. V diplomski nalogi predlagamo sistem razbremenitve posrednika z uporabo programirljivega stikala, katerega delovanje je opisano v jeziku P4. Del prometa glede na politiko ciljnih naslovov IP oziroma domenskih imen zaobide posrednik in zmanjša število paketov, ki jih ta pregleda. Sistem predstavlja tudi dokaz izvedljivosti za nevplivno prestrezanje prometa, ki uporablja protokol HTTP/3. Sestavljen je izključno iz odprtokodnih gradnikov, zato je pregleden tako za ponudnika rešitve kot za organizacijo, ki ga uporablja. Rešitev smo ovrednotili v virtualiziranem okolju in na vzorcu najbolj obiskanih spletnih strani. Breme posrednika pri prometu HTTP/3, o katerem stikalo odloča samo, pade za več kot dva reda velikosti, največja vzdržna hitrost pri obhodu na podlagi naslova IP pa se poveča za šestkrat. Dodajanje stikala sistemu se izplača, ko obhodni promet po protokolu HTTP/3 doseže sedem odstotkov, pri protokolu HTTP/2 pa dobro četrtino, v obeh primerih pri obhodu na podlagi naslova IP. Pri prestrezanju prometa HTTP/3 na vzorcu sto domen deluje med 87 in 98 odstotki strani, odvisno od odjemalca. Most web traffic is encrypted today. Organizations therefore use proxies for deep inspection of network traffic contents. For each connection, these perform a double TLS handshake and decrypt and re-encrypt all traffic, which is computationally expensive. In addition, support for the newer HTTP/3 protocol is rare in existing solutions, so this traffic is often blocked or remains uninspected. In this thesis, we propose a proxy offloading system using a programmable switch whose operation is described in the P4 language. Based on a policy of destination IP addresses or domain names, some traffic bypasses the proxy, reducing the number of packets it needs to inspect. The system also provides a proof of feasibility for transparent interception of traffic using the HTTP/3 protocol. It is built entirely from open-source components and is therefore auditable both by the provider of the solution and by the organization that uses it. We evaluated the solution in a virtualized environment and on a sample of the most visited websites. The proxy load for HTTP/3 traffic on which the switch decides by itself drops by more than two orders of magnitude, while the sustainable request rate for bypass based on the IP address increases sixfold. Adding the switch to the system becomes worthwhile when bypassed HTTP/3 traffic reaches seven percent of the traffic, and around a quarter for HTTP/2 traffic, in both cases for bypass based on the IP address. On a sample of one hundred domains, between 87 and 98 percent of pages still work through HTTP/3 interception, depending on the client. programirljiva podatkovna ravnina filtriranje omrežnega prometa HTTP/3 P4 QUIC razbremenitev posrednika nevplivno prestrezanje programmable data plane filtering of network traffic HTTP/3 P4 QUIC proxy offloading transparent interception true false false Slovenski jezik Angleški jezik Diplomsko delo/naloga 2026-09-09 18:25:02 2026-09-09 18:25:14 2026-09-21 08:33:36 0000-00-00 00:00:00 2026 0 0 0000-00-00 NiDoloceno NiDoloceno NiDoloceno 0000-00-00 0000-00-00 0000-00-00 38731 291717123 Pintar_Anze_-_Filtriranje_sifriranega_prometa_s_pomocjo_programirljive_ravnine.pdf Pintar_Anze_-_Filtriranje_sifriranega_prometa_s_pomocjo_programirljive_ravnine.pdf 1 97259E7B472E8F977C9EC4E8D36AA83B 3cff55cf77151991c47967b775aed0004b0ddbec2ad632e4df85135e1d840fed 04a33b49-ac6b-11f1-8bc5-0050569b8976 https://repozitorij.uni-lj.si/Dokument.php?lang=slv&id=246824 Fakulteta za računalništvo in informatiko 0 0 0