Core: Data Plane Transport

Transport security and encrypted-traffic implications

Miro Kosut

Miro Kosut

— 2 min read
Share

Requirement / business driver

Secure data in transit while preserving the visibility and control the network needs - a tension that grows as encryption becomes pervasive.

The shift

  • TLS over TCP, DTLS over UDP, and QUIC's mandatory TLS 1.3 mean most traffic is now encrypted by default.
  • QUIC rides UDP/443 and encrypts its transport headers, so it bypasses TCP-based middleboxes/optimisers and is opaque to traditional inspection.

Design implications

  • Reduced visibility: classic DPI sees little. Options: TLS/TLS-inspection (decrypt-inspect-re-encrypt) at a controlled point (privacy, performance, and cert-trust cost), or encrypted-traffic analytics (infer threat from metadata/telemetry without decrypting).
  • Policy placement: decide where to terminate/inspect (edge, proxy, firewall) and what to leave end-to-end; QUIC may need explicit allow/deny decisions since you can't transparently optimise it.
  • Observability moves to telemetry: with payloads opaque, lean on flow/metadata + streaming telemetry (Network management - traditional vs model-driven) rather than packet inspection.
  • Load balancing: encrypted/encapsulated headers reduce entropy - see Load balancing and hashing - ECMP and entropy.

Recommendation / justification

Treat encryption as the default and design visibility around it: place TLS inspection only where justified (and account for QUIC, which may be blocked to force TLS/HTTP-2 fallback or explicitly allowed), and invest in metadata/telemetry-based monitoring. Justify by the privacy/compliance vs visibility balance and where trust boundaries sit.

What would change this (mid-scenario twist)

  • Compliance/visibility mandate -> TLS inspection at a controlled choke point (+ cert trust plan).
  • Privacy-first / performance -> encrypted-traffic analytics instead of decryption.

Validation checks

  • Is there a deliberate stance on QUIC (allow with analytics, or block to fall back)?
  • Does monitoring still work when payloads are opaque (telemetry/metadata)?

IPv6 / dual-stack note

Encryption is transport-layer and address-agnostic; ensure inspection/telemetry covers both v4 and v6 paths equally.

Spaced repetition

Why does QUIC reduce network visibility and bypass middleboxes?

It rides UDP/443 and encrypts its transport headers (mandatory TLS 1.3), so DPI/optimisers can't read or transparently act on it.

With pervasive encryption, the two broad visibility options are [...] or [...].

With pervasive encryption, the two broad visibility options are TLS inspection (decrypt-inspect-re-encrypt at a controlled point) or encrypted-traffic analytics (metadata/telemetry, no decryption).

As payloads become opaque, network monitoring shifts from packet inspection toward [...].

As payloads become opaque, network monitoring shifts from packet inspection toward flow metadata + streaming telemetry.

Sources

  • RFC 9000 (QUIC); Cisco Encrypted Traffic Analytics; SCOR/security design guides.

domain: Core · blueprint-ref: Core 4.3 Security · type: design-decision · status: complete · tags: [core, core/dataplane, tradeoff/security, tradeoff/operability]

Read more