Privacy-preserving deep packet inspection in outsourced middleboxes

摘要: Middleboxes are essential for a wide range of advanced traffic processing in modern enterprise networks. Recent trend deploying middleboxes cloud as virtualized services further expands potential benefits while avoiding local maintenance burdens. Despite promising, designing outsourced still faces several security challenges. First, many middlebox services, like intrusion detection, require packet payload inspection, the ever-increasing adoption HTTPS limits function due to end-to-end encryption. Second, inspection rules used by can be proprietary nature. They may contain sensitive information enterprises, and thus need strong protection when configuring untrusted environments. In this paper, we propose practical system architecture perform deep over encrypted traffic, without revealing either payloads or rules. Our first design is an high-performance rule filter that takes randomized tokens from inspection. We then elaborate through carefully tailored techniques how comprehensively support open-source real rulesets. formally analyze strength. Implementations at Amazon Cloud show our introduces roughly 100 millisecond latency each connection initialization, with individual throughput 3500 packets/second 500 concurrent connections.