Outsourcing software middlebox (aka. virtual network function) to third-party service provider, like public cloud, has been a recent trend for many well-known benefits. However, redirecting a large influx of raw traffic from enterprises to the service providers, who are often outside the traditional trust domain, raises severe security concerns. Over the past few years, steady progress has been made towards enabling the middlebox functionalities without revealing sensitive traffic. Following the direction, in this paper, we present LightBox, the first system that can drive full-stack protected stateful middleboxes at native speed. Similar to existing hardware-assisted designs, LightBox is built on top of SGX enclave. But, different from all prior systems, LightBox is designed to further address two new challenges that, surprisingly, are largely overlooked in the literature. First, LightBox enables enterprises to safely forward the packets intended for processing to the enclaved middlebox with all metadata, including low-level packet headers, packet size, count and timestamps, fully protected. Studies have shown that such metadata can be information-rich and potentially exploited by many traffic analysis attacks. Second, LightBox achieves very efficient in- enclave stateful middlebox processing within the highly constraint enclave space, without incurring unreasonably high overhead. The confidentiality, integrity, and freshness of the flow states are always ensured throughout our efficient state management procedures. Evaluations show that LightBox, with all the extra security benefits, can still perform packet I O at 10Gbps line rate. Even when tracking 600K flows, LightBox can obtain 3.5X to 30X performance speedup than direct adoption of SGX, while incurring negligible packet delay (<1 s) for most test cases.
Several attempts have been made to secure middlebox processing with trusted hardware. S-NFV @cite_98 proposes to protect specifically the middlebox state, but not the entire middlebox processing over protected traffic. Trusted Click @cite_3 and ShieldBox @cite_55 port Click modular router @cite_22 to SGX enclave. But they do not consider the protection of metadata, and lack support for stateful processing due to the inherent limitation of Click. SGX-BOX @cite_13 and mbTLS @cite_81 enable middlebox to intercept TLS connections and securely inspect traffic in enclave, with primary focus on programmability and real-world deployment, respectively. Again, they do not address the concern of metadata privacy. The latest work SafeBricks @cite_51 pays extra attention on middlebox code protection, and applies IPSec for secure traffic tunneling. While protecting low-level headers, it is still vulnerable to various traffic analysis attacks leveraging packet size and count. None of these hardware-assisted solutions protects traffic metadata as does, nor do they enable running secure stateful middlebox processing at native speed in real networks.
@cite_22 @cite_98 @cite_55 @cite_3 @cite_81 @cite_51 @cite_13
2734383261 2790063371 2067209328 2037206848
A network middlebox benefits both users and network operators by offering a wide range of security-related in-network functions, such as web firewalls and intrusion detection systems (IDS). However, the wide usage of encryption protocol restricts functionalities of network middleboxes. This forces network operators and users to make a choice between end-to-end privacy and security. This paper presents SGX-Box, a secure middlebox system that enables visibility on encrypted traffic by leveraging Intel SGX technology. The entire process of SGX-Box ensures that the sensitive information, such as decrypted payloads and session keys, is securely protected within the SGX enclave. SGX-Box provides easy-to-use abstraction and a high-level programming language, called SB lang for handling encrypted traffic in middleboxes. It greatly enhances programmability by hiding details of the cryptographic operations and the implementation details in SGX enclave processing. We implement a proof-of-concept IDS using SB lang. Our preliminary evaluation shows that SGX-Box incurs acceptable performance overhead while it dramatically reduces middlebox developer's effort. Middleboxes that process confidential data cannot be securely deployed in untrusted cloud environments. To securely outsource middleboxes to the cloud, state-of-the-art systems advocate network processing over the encrypted traffic. Unfortunately, these systems support only restrictive functionalities, and incur prohibitively high overheads. This motivated the design of ShieldBox---a secure middlebox framework for deploying high-performance network functions (NFs) over untrusted commodity servers. ShieldBox securely processes encrypted traffic inside a secure container by leveraging shielded execution. More specifically, ShieldBox builds on hardware-assisted memory protection based on Intel SGX to provide strong confidentiality and integrity guarantees. For middlebox developers, ShieldBox exposes a generic interface based on Click to design and implement a wide-range of NFs using its out-of-the-box elements and C++ extensions. For network operators, ShieldBox provides configuration and attestation service for seamless and verifiable deployment of middleboxes. We have implemented ShieldBox supporting important end-to-end features required for secure network processing, and performance optimizations. Our extensive evaluation shows that ShieldBox achieves a near-native throughput and latency to securely process confidential data at line rate. Middleboxes are widely deployed in today's enterprise networks. They perform a wide range of important network functions, including WAN optimizations, intrusion detection systems, network and application level firewalls, etc. Depending on the processing requirement of traffic, packet processing for different traffic flows may consume vastly different amounts of hardware resources (e.g., CPU and link bandwidth). Multi-resource fair queueing allows each traffic flow to receive a fair share of multiple middlebox resources. Previous schemes for multi-resource fair queueing, however, are expensive to implement at high speeds. Specifically, the time complexity to schedule a packet is O(log n), where n is the number of backlogged flows. In this paper, we design a new multi-resource fair queueing scheme that schedules packets in a way similar to Elastic Round Robin. Our scheme requires only O(1) work to schedule a packet and is simple enough to implement in practice. We show, both analytically and experimentally, that our queueing scheme achieves nearly perfect Dominant Resource Fairness. The deployment of micro-datacenters for network function virtualization (NFV) by Internet Service Providers creates opportunities for flow processing along the traffic path. On-path processing requires the discovery of the middleboxes that will be traversed by each flow and the assignment of network functions (NFs) to middleboxes, while preserving the order of the NFs as specified in the service chain. NF location dependencies may require flow processing establishment across multiple NF Providers (NFPs). This entails additional challenges for middlebox discovery and selection, stemming from the NFPs' restrictions in information disclosure and interoperability. To address these issues, we present MIDAS, an architecture for the coordination of middlebox discovery and selection across multiple NFPs. MIDAS relies on a centralized middlebox controller in each NFP to provide interoperability among NFPs for flow processing setup. MIDAS establishes on-path processing via middlebox signaling, controller chaining, and Multi-Party Computation (MPC) based middlebox selection. We particularly employ MPC to preserve the confidentiality of middlebox utilization across the NFPs. We study the feasibility of MIDAS using a prototype implementation and further present simulation results to assess the efficiency of our middlebox selection approach.