Research Interests

THRUSTS

My work sits at the confluence of networks, security, and privacy. The goal: design, build, and deploy secure and privacy-preserving technologies that are both scalable and usable — studied through the lens of measurement.

01

Internet privacy & data-protection law

Empirically studying regulations such as the GDPR, and the myriad factors that determine whether such laws are effective in practice, including in jurisdictions like India with evolving data-protection frameworks.

02

Internet structure, topology & filtering

Mapping Internet topology and CDN-era peering to identify network chokepoints, studying the traffic-filtering techniques deployed there, and characterizing and circumventing them.

03

Deep packet inspection & routing infrastructure

Building programmable-switch (P4)- based routing and firewall infrastructure capable of effective, line-rate deep packet inspection, and studying the implications for filtering and defense.

04

Anonymous communication systems

Designing and evaluating anonymity-enhancing systems: Tor, VPNs, mixnets (e.g., Nym), and the anonymity guarantees (or lack thereof) of peer-to-peer cryptocurrency networks.

05

Authentication & usable security

Examining the security properties of E2E-encrypted messaging (Signal and its derivatives), including susceptibility to man-in-the-middle attacks and the social and legal dimensions of cryptographic deniability, with a focus on usable security for India's heterogeneous user base.

Read the full research statement Collapse research statement

Studying data privacy regulations

Online services monetize their audience through advertising and data collection, often without meaningful consent, using third-party trackers to profile browsing activity for targeted content. The GDPR is one of the most comprehensive regulatory responses to date, and a growing body of work examines its real-world efficacy. My research shows the many factors that shape whether such laws actually work, and asks what it would take to design and implement effective protections within India's evolving data-protection framework.

Characterizing Internet structure, topology & filtering

As the Internet evolves and CDNs proliferate, mapping its current structure and the peering relationships IXPs create between ISPs is essential to understanding where the strategic high ground lies. This topology also shows where filtering middleboxes are deployed: the network's chokepoints. Filtering is a double-edged sword: it can suppress free expression in some contexts and curb illegal markets in others. This is why it warrants careful, empirical study, along with the techniques used to bypass it and how users perceive being blocked. My recent work shows programmable switches (P4) can implement effective deep packet inspection at these chokepoints.

Building anonymous communication systems

Anonymity, being unidentifiable within a set of subjects, is hard to study and quantify on the Internet, where identity can leak at both the application and network layers. Tor provides network-layer anonymity but not protection against a strong global passive adversary; mixnets, the subject of two decades of research at KU Leuven's COSIC group, offer stronger guarantees, as embodied in systems like Nym. A related, understudied ecosystem is cryptocurrency: although a public-key identity suggests pseudonymity, academic work, including mine, shows that proposed anonymity-enhancing schemes for these networks often fall short of acceptable guarantees.

Examining authentication properties of end-to-end encryption

Billions of users rely on E2E encryption in apps like WhatsApp, iMessage, and Signal for message privacy, many built on the Signal protocol or a derivative. These protocols promise confidentiality, deniability, and forward/future secrecy — but my work shows Signal-derived protocols remain susceptible to man-in-the-middle attacks, motivating automatic defenses. Deniability in particular is subtle: it requires social and legal acceptance to be meaningful, and our multi-perspective study of user expectations surfaces inconsistencies that can enable social-engineering attacks. I aim to pursue usable-security research with particular attention to India's linguistically and culturally diverse user base.