SENTRY: Software-Enhanced Networthiness Analysis of Commercial VPNs using Path Analysis

Kryptowire Labs is proposing SENTRY, an approach to VPN networthiness that determines the least trustworthy node along the path of a VPN provider’s network. The novel path reconstruction method works independent of VPN tunneling strategies and can scale to arbitrary sized VPN infrastructure networks. The continuous monitoring can detect changes if only portions of the VPNs network traverse malicious nodes. We expect that a significant fraction of the VPN users will want the value added by the SENTRY networthiness metrics and alerting, since usage of a VPN is already an indication of concern about network security. In the naive case, we'd mark a packet and then ship it into the VPN and check if it leaks anywhere in the world, we don’t expect to see it. Such an undertaking would require internet scale monitoring which would not be feasible. Furthermore, our aim is to be able to identify the initial route and any changes to the encrypted traffic generated by the VPN end-to-end. We do so by, identifying any nodes along the path that can pose risks or are undesirable to the end-user or enterprise policies. These nodes can be scored based on multiple metrics including their geolocation, the ownership of the IP address space, and the Autonomous System (AS) they belong to, as well as many other criteria. For example, there are a lot of publicly available grey list services of malicious or questionable IP addresses that can be consulted to score each node, and the path that a node traverse will generate a collection of scores (one per node). The score of a path is determined by the maximum score (higher is worse) of all nodes along the path. This will be the badness score of the path. When there is a change, we intend to alert the end-user and block the VPN traffic at the client side until the user approves the new route offered by the VPN. Therefore, our product, called SENTRY, will operate continuously in the background. It will unobtrusively observe VPN traffic and intervene only when there is questionable VPN behavior, either initially or after the communication gets established.