The New, Encrypted Protocol Stack Taking over the Internet and How to Deal with It - BRKSPM-2024#

Speakers: Andreas Enotiadis (Cisco), Bart Van de Velde (Cisco)

• Why: The QUIC/HTTP-3/DoH/ECH transition obsoletes core assumptions about network visibility and congestion management — a structural shift any network-security-literate PM should understand even if the session's remediation focus is service-provider oriented.
• What: How the new encrypted stack (QUIC + HTTP/3 + DoH + ECH/eSNI) is constructed and evolving, its measured share of traffic (claimed ~50% and doubling every 18 months), how it changes flow behavior and visibility, and what techniques SPs can use to keep pace on visibility, QoE, and spectrum efficiency. (from abstract only)
• How: Walks the protocol stack mechanics (QUIC's UDP-based encrypted transport, DNS encryption, encrypted client hello) and their consequences: application disintermediation of the network, loss of flow-level visibility, and congestion control moving to endpoints — then surveys SP countermeasures.
• Where applicable: Service-provider networks primarily (5G spectrum, QoE management), but the visibility-loss analysis applies to enterprise security monitoring too. Traffic-share figures are the speakers' claims; worth sanity-checking against independent measurements.