Authenticated Browsing

How it works

Protocol overview

Problem

Regulated services often cannot use TLS-terminating DDoS protection.

Application-layer floods consist of well-formed HTTP(S) requests over valid TCP and TLS sessions, so header-based filtering cannot separate them from legitimate traffic. CDN and WAF scrubbing services can, but only by terminating TLS, which banking secrecy, medical confidentiality and the GDPR often prohibit.

Approach

Authenticating the sender does not require reading the payload.

Authenticated Browsing moves federated user authentication from the application layer to per-packet verification at the network layer. It was developed with a major Swiss systemically important financial institution that may not give third parties access to plaintext customer traffic.

Components

Identity provider + AB Server

An existing OAuth 2.0 identity provider with an added AB Server that issues keys. Neither is on the packet path.

User agent

Runs next to the browser and adds the AB header to every packet sent to a linked service.

Validators

Deployed in front of the application, e.g. at IXPs or scrubbing centres. They derive each user's key from K mac and verify tags without per-connection state.

Application

The protected service and TLS endpoint. It holds K id, which maps a pseudonym to an account for revocation.

Symmetric crypto only AES-CBCMAC key derivation AES-PMAC packet tags AES-NI TLS stays end-to-end

Results

DPDK application in C, commodity hardware, 4×40 Gbps NIC (160 Gbps total).

70M+

authenticated packets per second per validator, at the 160 Gbps line rate.

+0.7 ms

maximum increase in p99.9 latency under a near-line-rate attack.

Requests served per second

No attack: 19,925
Attack, without Authenticated Browsing: < 1817.3 s median latency
Attack, with Authenticated Browsing: 19,925

67–86%

of RIPE Atlas probes in Europe reached our server with the header intact (North America: 72–75%). About 190 probes per region, January to May 2026.

Europe

67–86

North America

72–75

050100%

Header format

AB header, 24 bytes

TCP: IPv6 Destination Options extension header. UDP and QUIC: appended to the payload.

4 B framing Option data · 20 B

NH 02 1E 14 IdP Expiry ruid · 7 B pad tag · 8 B

Framing · 4 B. Next header, length 0x02, option type 0x1E, option length 0x14.
IdP ID · 1 B. Identity provider that issued the key bundle.
Expiry · 2 B. Bundle expiry time, also an input to the key derivation.
ruid · 7 B. Pseudonym, new with every bundle and indistinguishable from a random 56-bit string.
Padding · 2 B. Alignment.
Tag · 8 B. 64-bit AES-PMAC over the packet, keyed with the per-user key.

Validator pipeline

Per-packet processing without per-connection state

01AB header?no → remainder
02Derive keyPer-user key from K mac and header fields
03Duplicate checkreplay → drop
04Verify MACfail → drop
05Update dedup tableStore the verified tag
06Forwardreserved share

Authenticated packets use a reserved share of the link capacity. Unauthenticated packets get the remaining capacity or are dropped, depending on the configured policy.

No forged packet passed verification Replay detection ≥ 0.999779, no false positives

Comparison

Design goals G1–G6

Approach	G1No plaintext	G2Priority	G3Accountable	G4No net changes	G5Line rate	G6Resilient
TLS-terminating CDN / WAF	×	✓	×	✓	∼	∼
Rate limiting & admission control	✓	∼	×	✓	∼	∼
Network capabilities	✓	✓	×	×	∼	×
Transport- and network-layer authentication	∼	∼	∼	✓	∼	✓
Authenticated Browsing	✓	✓	✓	✓	✓	✓

✓ meets ∼ partly × does not

G1 No plaintext exposure to filtering infrastructure
G2 Differentiated service under attack
G3 Accountability without disclosure
G4 No network changes
G5 Line-rate validation without per-connection state
G6 Works while one linked IdP and one validator are reachable

Limitations

Only users with a linked account get priority during an attack.
Requires identity providers that prevent mass bot sign-ups.
A compromised account can send until it is revoked and its bundle expires, at most five minutes later.
The TCP variant requires IPv6, and extension headers that survive the path.
Volumetric attacks that saturate links upstream of the validators are out of scope.

Cite

@article{stoeger2026authenticated,
  author     = {St\"{o}ger, Felix and van Bommel, Jelte and Kwon, Jonghoon and Bamert, Patrick and Boss, Stefanie and Eggerth, Alexander and Perrig, Adrian},
  title      = {Authenticated Browsing: Reconciling Application-Layer Flooding Defense with Data Confidentiality},
  journal    = {Proc. ACM Netw.},
  volume     = {4},
  number     = {CoNEXT4},
  articleno  = {46},
  numpages   = {25},
  year       = {2026},
  month      = dec,
  publisher  = {Association for Computing Machinery},
  doi        = {10.1145/3856957}
}

More research

Ongoing

Protocol overview

Identity provider + AB Server

User agent

Validators

Application

DPDK application in C, commodity hardware, 4×40 Gbps NIC (160 Gbps total).

AB header, 24 bytes

Per-packet processing without per-connection state

Design goals G1–G6

On-Demand Path-Aware Backbone

BGP Vortex

SA4P

Off-Chain NFT Hijacking