AI summaryⓘ
The authors study how to avoid internet censorship by constantly changing the access points (endpoints) that users connect to, known as moving-target circumvention. They create a formal model to understand when rotating these endpoints actually helps stop censors from blocking them. Their findings show that it’s not just how fast you rotate endpoints that matters, but the balance between how quickly censors discover and block domains versus how fast new domains are introduced. They show that if censors can block domains faster than new ones appear, endpoint rotation alone won’t work well. The authors confirm these results using a simulator that mimics real-world censors like the Great Firewall of China.
Internet censorshipCircumvention systemsMoving-target defenseEndpoint rotationCombinatorial address spaceFlipIt gameDomain blockingGreat FirewallAvailability lawCensor-defender game
Abstract
Internet censorship affects over four billion people, and deployed circumvention systems share a common weakness: their endpoints are fixed and discoverable, so a patient censor can enumerate and block them. Moving-target circumvention systems instead rotate endpoints across commercial cloud address space faster than censors can react, but the field lacks a theory of when rotation works, leaving rotation intervals and pool sizes to intuition. We give the first formal account of moving-target censorship resistance by modeling the censor-defender interaction as a continuous-time timing game over a combinatorial address-domain space, generalizing FlipIt to a collateral-bounded adversary. We prove a sustainability frontier separating configurations a censor can defeat from those it cannot, and show that under the Great Firewall's 2024 shift to blocking QUIC and TLS by domain, raw rotation speed is not the binding constraint. Instead, availability is governed by the domain burn rate, $β=λ_{\mathrm{disc}}/λ_{\mathrm{intro}}$, the ratio between how quickly the censor blocks defender domains and how quickly the defender introduces fresh ones. We derive a closed-form availability law, prove that address rotation alone cannot sustain high availability when $β>1$ regardless of endpoint rotation speed, and characterize the frontier $β^\star$. We validate the analysis with an open, model-level censor-defender simulator requiring no privileged access or cloud deployment. The simulator reproduces the predicted phase transition at $β^\star$ under adversary profiles representative of the GFW, Russia's TSPU, and Iran, and shows robustness to state-dependent discovery and bursty, provider-correlated burns. The result replaces the heuristic of ``rotate faster'' with a precise operating condition: keeping the domain economy ahead of the censor.