Keyword filtering blocks a connection when a banned word appears in traffic the network can read, such as a web address or a search term.
Explanation
The filter has to see the words, so it works best on unencrypted traffic. In 2006 Cambridge researchers Richard Clayton, Steven Murdoch and Robert Watson showed that China's Great Firewall inspected plain HTTP requests for banned keywords and, on a match, sent forged TCP reset packets to both ends to close the connection. HTTPS hides the page address, search terms and page content, so the only words an outside network can still read are site names: in DNS lookups and in the TLS handshake (SNI). Modern filters therefore match domain names and block whole sites rather than single pages. When browsers began encrypting the site name, China blocked that as well: from 29 July 2020 researchers from GFW Report, iYouPort and the University of Maryland observed it dropping TLS connections that used encrypted SNI. Company networks can go further. If an employer installs its own root certificate on your device, its filter can decrypt HTTPS and read every word. Through a web proxy, a network without such a certificate sees only the proxy's name; the address you typed travels inside the encrypted connection.
In practice
The shift from words to names is visible in the research record. In 2006 a single banned word in a plain-HTTP request was enough for the Great Firewall to reset the connection. By 2020, with most of the web on HTTPS, the firewall was keying on the TLS handshake itself, dropping any connection that tried to encrypt the site name. On a personal device without an extra root certificate, page paths and search terms are no longer visible to the network.
Sources: Clayton, Murdoch, Watson - Ignoring the Great Firewall of China (2006) · Geneva / GFW Report / iYouPort - China is now blocking encrypted SNI (7 Aug 2020)
Questions about Keyword filtering
Related terms