CensorLess: Cost-Efficient Censorship Circumvention Through Serverless Cloud Functions
This paper introduces CensorLess, a cost-efficient censorship circumvention system leveraging serverless cloud functions to reduce operational costs by 97% compared to state-of-the-art techniques while maintaining robust resistance through bridge rotation and live migration.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
Imagine you live in a neighborhood where the local government has built a giant, invisible wall around your house. They don't just block the front door; they check every single package, letter, and phone call you try to send or receive. If they see you trying to talk to a specific friend outside the wall, they cut the line immediately.
This is Internet Censorship.
For years, people trying to get past this wall have used "proxies"—basically, secret tunnels or bridges built by volunteers. But building and maintaining these bridges is expensive. You have to rent servers (like renting a house for the bridge), pay for electricity, and constantly move the bridge to a new location before the censors find it. It's like trying to run a secret delivery service where you have to pay rent on a new warehouse every two days.
Enter CensorLess.
The researchers behind this paper asked a simple question: "What if we didn't rent a warehouse at all? What if we just used a delivery service that only charges us for the exact second we use it?"
The Big Idea: The "Pop-Up" Bridge
Think of CensorLess not as a permanent bridge, but as a pop-up tent that appears, does its job, and vanishes in seconds.
They use a technology called Serverless Cloud Functions (like AWS Lambda). Here is how it works in simple terms:
- The "Pay-Per-Click" Model: Traditional bridges are like renting an apartment; you pay rent even if you sleep all day. Serverless functions are like a taxi service. You only pay when the car is moving. If no one is using the bridge, it costs $0.
- The Magic of Disappearing: When you call a serverless function, it creates a tiny, temporary "container" (a mini-computer) to do the job. Once the job is done, the container is deleted. It's like a ghost that appears, delivers a message, and then vanishes into thin air.
- The Chameleon Effect: Because these containers are created instantly and deleted instantly, they have different "addresses" (IP addresses) every time. It's like a spy who changes their face, voice, and clothes every 10 seconds. The censors can't block the spy because by the time they figure out who the spy is, the spy has already changed into someone else.
How It Actually Works (The Three Magic Tricks)
The paper describes three clever tricks CensorLess uses to make this work:
1. The Translator (Request Translation)
The Problem: Serverless functions are picky. They won't talk to the internet directly like a normal computer; they only speak "HTTPS" (secure web requests). But your computer usually tries to talk using "Sockets" (a direct line).
The Solution: CensorLess installs a small app on your computer (the Local Proxy). Think of this as a translator. When you try to visit a blocked website, your computer speaks "Socket." The translator catches it, rewrites it into a "HTTPS" letter, and sends it to the serverless function. The serverless function reads the letter, goes to the website, and brings the answer back. The translator then rewrites the answer back into "Socket" for your computer.
2. The Hot Potato (Live Migration)
The Problem: If you stay on one bridge too long, the censors might catch you.
The Solution: CensorLess uses a Function Refresher. Imagine a relay race where the runners are constantly changing. The system automatically creates hundreds of new "pop-up tents" (bridges) in different countries. When you are using one, the system quietly tells you, "Hey, switch to this new tent over there." You switch instantly without dropping your connection. It's like passing a hot potato so fast that the censors can never grab it.
3. The Disguise (Domain Fronting)
The Problem: Censors can see the "envelope" of your letter (the domain name) even if they can't read the letter inside.
The Solution: CensorLess can use a trick called Domain Fronting. Imagine sending a letter to a famous, allowed celebrity (like "Amazon.com"), but inside the envelope, you write "Go to the blocked news site." The post office (the cloud provider) sees the celebrity's name, so they let it through. Once it gets to the celebrity's office (the serverless function), they open the envelope, see the real destination, and deliver it. This camouflages your traffic as normal, boring cloud traffic.
The "Private Mode" (The VIP Tunnel)
The standard version is cheap but relies on trusting the person running the bridge. If you want total privacy (so the bridge operator can't see what you are doing), there is a Private Mode.
- How it works: It adds a small, permanent "safe house" (a VPS) that encrypts your data before it even reaches the pop-up tents.
- The Cost: It's still incredibly cheap, but slightly more expensive than the standard version because you are renting that one "safe house."
Why Is This a Game Changer?
The paper tested this against the best existing methods (like SpotProxy, which uses cheap, temporary servers).
- Cost: CensorLess is 97% cheaper. If a traditional bridge costs you $100 a month, CensorLess costs you about $0.27. Even the "Private Mode" is only about $3.40.
- Speed: It's fast. Because the cloud provider handles the heavy lifting (scaling up when many people use it at once), it doesn't crash when a crowd shows up.
- Resilience: Because the bridges disappear and reappear constantly in different locations, it is incredibly hard for censors to block them all.
The Catch (Limitations)
It's not magic, though.
- HSTS: Some very secure websites force you to use a direct, secure connection that the "translator" can't intercept. For these, you need the Private Mode.
- Cloud Provider Rules: If the cloud company (like Amazon or Google) decides to stop supporting this trick, CensorLess might need to adapt. However, the researchers found that these tricks still work on major platforms.
The Bottom Line
CensorLess is like turning the internet censorship game from a "War of Attrition" (who can afford to keep the bridge open the longest?) into a game of "Whac-A-Mole." The censors can't hit the mole because it keeps popping up in a different spot, wearing a different hat, and vanishing before they can swing their hammer. And the best part? It costs almost nothing to play.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.