# Programmable In-Network Obfuscation of Traffic

**Authors:** Liang Wang, Hyojoon Kim, Prateek Mittal, Jennifer Rexford  
**arXiv:** [2006.00097](https://arxiv.org/abs/2006.00097)  
**Date:** 2020-05-29  
**Summary page:** https://www.summarizepaper.com/en/arxiv-id/2006.00097v1/

## Key points

- Recent advances in programmable switch hardware have opened up new possibilities for protecting user privacy
- PINOT is a lightweight in-network anonymity solution that operates at line rate within the memory and processing limitations of hardware switches
- PINOT encrypts a client's IPv4 address, effectively concealing it from downstream Autonomous Systems (ASes) and the destination server
- PINOT is easy to deploy and does not require any end-user software or cooperation from other networks
- A prototype of PINOT was implemented on the Barefoot Tofino switch and deployed in a campus network
- The performance of PINOT was evaluated by measuring its ability to protect user identity against public DNS, NTP, and WireGuard VPN services
- Results show that PINOT successfully hides users' IP addresses while preserving network performance
- This paper introduces an innovative approach to preserving user privacy using programmable switch hardware

## Summary

Recent advances in programmable switch hardware have opened up new possibilities for protecting user privacy. In this paper, the authors present PINOT, a lightweight in-network anonymity solution that operates at line rate within the memory and processing limitations of hardware switches. PINOT employs an efficient encryption scheme to encrypt a client's IPv4 address, effectively concealing it from downstream Autonomous Systems (ASes) and the destination server. One notable advantage of PINOT is its ease of deployment. It does not require any end-user software or cooperation from networks other than the trusted network where it is implemented, making it readily deployable without significant modifications. To demonstrate its effectiveness, the authors implement a prototype on the Barefoot Tofino switch and deploy it in a campus network. They evaluate its performance by measuring its ability to protect user identity against public DNS, NTP, and WireGuard VPN services. The results show that PINOT successfully hides users' IP addresses from these services while preserving network performance. This paper introduces an innovative approach to preserving user privacy using programmable switch hardware and demonstrates its potential for broader adoption in various network environments.