Design and Implementation of a Stateful Firewall to Mitigate Security Challenges in the QUIC Protocol

The rapid growth of streaming services and their dominance in global Internet traffic have driven a demand for more efficient real-time communication protocols. In response, QUIC was introduced by Google in 2012 and later specified by the IETF in 2021 as an improved transport-layer protocol. QUIC allows HTTP/3 to run over UDP instead of relying on the traditional TCP, offering improvements in speed and security. Features such as connection migrations ensure continuous communication even through network address changes, increasing user experience but also introducing new security challenges for middleboxes. This thesis presents an in-depth analysis of QUIC and its security challenges, alongside the development of a prototype stateful firewall designed of handling QUIC traffic during connection migrations. The firewall is able to identify malicious from benign connection migrations and can effectively block potentially harmful activity. Its design and implementation were evaluated through extensive testing, demonstrating its effectiveness in securing QUIC traffic while maintaining feature compatibility.