Review Reports

Round 1

Reviewer 1 Report

In the paper Authors address a severe vulnerability "Blind In/On-Path Attacks" in VPNs presented in [2] and published in 2021. Considering the severity of the problem and very limited research available so far, the topic is very sound and provides a very important contribution to the field. The paper is well structured and the overall impression is positive. However, there are certain items that should be extended and clarified.

First, it would be important to describe in more detail and put more attention to ensure that the presented solution is referring to the same threat model that is considered in [2]. Moreover, in Fig. 3. right after start "Eth0 receive requests from VPN Client (...)" while in [2] on page 4 one can find "Server-side attacks inject packets by spoofing them to the VPN server, appearing to come from a remote application server" what may suggest that Authors are operating on a little different assumptions and that should be clarified, so there is absolutely no doubt. It would be greatly appreciated if Authors better describe the original problem and why the proposed solution addresses this problem. Finally, in [2] the attention is primarily put on source addresses validation which is not a concern in this paper.

Next, in section 6 where experiments are described, it would be quite important to reproduce the original attack in the experimental environment (not only simulation) and ensure that similar results to the ones from the original paper are obtained. Authors are suggested to introduce that next to each of the listed experiments where applicable (L.444). Having that, the reasoning will be much stronger.

Another thing is related to Section 5.1 (L.341) and here the whole section needs to be revisited and more precisely formulated, for instance the following should be responded:

L.379: It would be much more convenient to place Table 1 before beginning of Section 5.1

L.359: Is it really applicable here? In the attack first the port number is found, and then TXID is searched. There is no search for pairs together.

L.364, 369, 379: P is used ambiguously: first as a variable with certain meaning explained in Table 1, then apparently as a function (a function which also semantics might not be clear for everyone)

L.364, 369, 376: First, P_{birth_att} is defined as a formula, but then is used as a probability of "sth" which apparently not well properly formulated

In the Section 5.2.1 (L.393) it seems there are some mistakes in Table 2:

(a) according to Table 1 variable P represents the probability value, so it can't be 64000

(b) apparently TO and NoP are exchanged as rather the timeout is 15 and the port range is up to 65535

(c) NoA seems to be too small having other values as per (1) NoA=NoS * TO

There are also other minor things for Authors' consideration, e.g.:

L.18: Authors stated that they implemented MVPN using DPDK, but in Figure 2 DPDK is one "box" among others. Did Authors also use other products, frameworks or libraries? Obviously there is nothing wrong with that, but if so, it would be important to explicitly describe those.

L.41: To be more specific: paper [2] is referring to client- and server-side attacks, the statement (and the whole paper) applies only to server-side attacks.

L.192: It is not clear what is the purpose of the Control Layer. For instance, one may expect that the judgment unit would be there, not in the data layer. A one sentence explanation for each layer would be valuable.

L.317-325: Additional spaces before commas

L.401: It seems that experimental result values come from the paper [2] (at least values are the same as in the Section 6.2 in [2]). If so, a citation should be provided.

Author Response

Please see the attachment.

Author Response File: Author Response.pdf

Reviewer 2 Report

- more details on the motivation are essential. More on the Introduction part of the paper.

- some grammar errors are evident.

- The related work should be further expanded.

- When using different cores, how does this affect performance? Please be more explicit.

- How is the threshold optimised in your work?

- Figure 13 should be clearer.

- Please restructure the paper, in order to appear more coherent. For instance, the theoretical analysis appears too deep in the manuscript.

 

Author Response

Please see the attachment.

Author Response File: Author Response.pdf

Round 2

Reviewer 2 Report

After the corrections, i believe that the paper should appear in the journal.