Outsourcing software middlebox (aka. virtual network function) to third-party service provider, like public cloud, has been a recent trend for many well-known benefits. However, redirecting a large influx of raw traffic from enterprises to the service providers, who are often outside the traditional trust domain, raises severe security concerns. Over the past few years, steady progress has been made towards enabling the middlebox functionalities without revealing sensitive traffic. Following the direction, in this paper, we present LightBox, the first system that can drive full-stack protected stateful middleboxes at native speed. Similar to existing hardware-assisted designs, LightBox is built on top of SGX enclave. But, different from all prior systems, LightBox is designed to further address two new challenges that, surprisingly, are largely overlooked in the literature. First, LightBox enables enterprises to safely forward the packets intended for processing to the enclaved middlebox with all metadata, including low-level packet headers, packet size, count and timestamps, fully protected. Studies have shown that such metadata can be information-rich and potentially exploited by many traffic analysis attacks. Second, LightBox achieves very efficient in- enclave stateful middlebox processing within the highly constraint enclave space, without incurring unreasonably high overhead. The confidentiality, integrity, and freshness of the flow states are always ensured throughout our efficient state management procedures. Evaluations show that LightBox, with all the extra security benefits, can still perform packet I O at 10Gbps line rate. Even when tracking 600K flows, LightBox can obtain 3.5X to 30X performance speedup than direct adoption of SGX, while incurring negligible packet delay (<1 s) for most test cases.
Secure middleboxes BlindBox @cite_23 is the first system that applies cryptographic protocols (i.e., searchable encryption and garbled circuit) to enable inspection on encrypted packet payloads. A list of follow-up designs are proposed. The work @cite_15 emphasizes on the protection of middlebox rules and support of more inspection rules. SPABox @cite_72 and BlindIDS @cite_71 put extra attention on reducing connection setup cost. Besides payloads, privacy-preserving packet header checking is also studied. The work @cite_54 considers using heavy homomorphic encryption for generic network functions. SplitBox @cite_65 employs a distributed model for a certain class of packet header processing. Embark @cite_21 introduces a customized prefix-matching scheme and by combining it with the technique from @cite_23 , supports a wider class of middlebox functionality. These software-based solutions are generally not yet practical regarding functionality, especially stateful processing, and performance.
@cite_54 @cite_21 @cite_65 @cite_72 @cite_23 @cite_71 @cite_15
2734383261 2764080192 2790063371 1971950071
A network middlebox benefits both users and network operators by offering a wide range of security-related in-network functions, such as web firewalls and intrusion detection systems (IDS). However, the wide usage of encryption protocol restricts functionalities of network middleboxes. This forces network operators and users to make a choice between end-to-end privacy and security. This paper presents SGX-Box, a secure middlebox system that enables visibility on encrypted traffic by leveraging Intel SGX technology. The entire process of SGX-Box ensures that the sensitive information, such as decrypted payloads and session keys, is securely protected within the SGX enclave. SGX-Box provides easy-to-use abstraction and a high-level programming language, called SB lang for handling encrypted traffic in middleboxes. It greatly enhances programmability by hiding details of the cryptographic operations and the implementation details in SGX enclave processing. We implement a proof-of-concept IDS using SB lang. Our preliminary evaluation shows that SGX-Box incurs acceptable performance overhead while it dramatically reduces middlebox developer's effort. Widely used over the Internet to encrypt traffic, HTTPS provides secure and private data communication between clients and servers. However, to cope with rapidly changing and sophisticated security attacks, network operators often deploy middleboxes to perform deep packet inspection (DPI) to detect attacks and potential security breaches, using techniques ranging from simple keyword matching to more advanced machine learning and data mining analysis. But this creates a problem: how can middleboxes, which employ DPI, work over HTTPS connections with encrypted traffic while preserving privacy? In this paper, we present SPABox, a middlebox-based system that supports both keyword-based and data analysis-based DPI functions over encrypted traffic. SPABox preserves privacy by using a novel protocol with a limited connection setup overhead. We implement SPABox on a standard server and show that SPABox is practical for both long-lived and short-lived connection. Compared with the state-of-the-art Blindbox system, SPABox is more than five orders of magnitude faster and requires seven orders of magnitude less bandwidth for connection setup while SPABox can achieve a higher security level. Middleboxes that process confidential data cannot be securely deployed in untrusted cloud environments. To securely outsource middleboxes to the cloud, state-of-the-art systems advocate network processing over the encrypted traffic. Unfortunately, these systems support only restrictive functionalities, and incur prohibitively high overheads. This motivated the design of ShieldBox---a secure middlebox framework for deploying high-performance network functions (NFs) over untrusted commodity servers. ShieldBox securely processes encrypted traffic inside a secure container by leveraging shielded execution. More specifically, ShieldBox builds on hardware-assisted memory protection based on Intel SGX to provide strong confidentiality and integrity guarantees. For middlebox developers, ShieldBox exposes a generic interface based on Click to design and implement a wide-range of NFs using its out-of-the-box elements and C++ extensions. For network operators, ShieldBox provides configuration and attestation service for seamless and verifiable deployment of middleboxes. We have implemented ShieldBox supporting important end-to-end features required for secure network processing, and performance optimizations. Our extensive evaluation shows that ShieldBox achieves a near-native throughput and latency to securely process confidential data at line rate. A novel media access control (MAC) protocol named carrier sense multiple access with idle detection (CSMA ID) is proposed to handle variable-length packets over an all-optical ring network. To evaluate optimal utilization of channel bandwidth, we study packet scheduling based on three transmitting queue discipline (TQD) architectures and four idle space allocation (ISA) algorithms with regard to their impact on performance. For numerical evaluation of performance, an analytical model is developed by a preclassification queue with weighted round-robin (PCQWRR) architecture and a random algorithm. Moreover, three related MAC protocols are examined and compared, namely, multitoken, carrier sense multiple access collision avoidance (CSMA CA) and carrier sense multiple access collision preemption (CSMA CP). Simulation results indicate that, of the TQDs, better performance is obtained by PCQWRR compared with first-in-first-out and preclassification queues. The first fit space (FFS) algorithm has the best performance of the ISAs. The 12 combinations of TQDs-ISAs are then considered. It is found that the combination of PCQWRR with FFS provides the greatest efficiency and has the lowest packet latency, providing better throughput than three different MAC protocols under either symmetric or asymmetric traffic load on all-optical ring networks.