LightBox: Full-stack Protected Stateful Middlebox at Lightning Speed

摘要: Running off-site software middleboxes at third-party service providers has been a popular practice. However, routing large volumes of raw traffic, which may carry sensitive information, to remote site for processing raises severe security concerns. Prior solutions often abstract away important factors pertinent real-world deployment. In particular, they overlook the significance metadata protection and stateful processing. Unprotected traffic like low-level headers, size count, can be exploited learn supposedly encrypted application contents. Meanwhile, tracking states 100,000s flows concurrently is indispensable in production-level deployed real networks. We present LightBox, first system that drive near-native speed with most comprehensive date. Built upon commodity trusted hardware, Intel SGX, LightBox product our systematic investigation how overcome inherent limitations secure enclaves using domain knowledge customization. First, we introduce an elegant virtual network interface allows convenient access fully protected packets line rate without leaving enclave, as if from source network. Second, provide complete flow state management efficient processing, by tailoring set data structures algorithms optimized highly constrained enclave space. Extensive evaluations demonstrate all benefits, achieve 10Gbps packet I/O, case studies on three middleboxes, it operate speed.