TY - JOUR
T1 - Fast privacy-preserving network function outsourcing
AU - Asghar, Hassan Jameel
AU - De Cristofaro, Emiliano
AU - Jourjon, Guillaume
AU - Kaafar, Mohammed Ali
AU - Mathy, Laurent
AU - Melis, Luca
AU - Russell, Craig
AU - Yu, Mang
PY - 2019/11/9
Y1 - 2019/11/9
N2 - In this paper, we present the design and implementation of SplitBox, a system for privacy-preserving processing of network functions outsourced to cloud middleboxes—i.e., without revealing the policies governing these functions. SplitBox is built to provide privacy for a generic network function that abstracts the functionality of a variety of network functions and associated policies, including firewalls, virtual LANs, network address translators (NATs), deep packet inspection, and load balancers. We present a scalable design aiming to provide high throughput and low latency, by distributing functionalities to a few virtual machines (VMs), while providing provably secure guarantees. We implement SplitBox inside FastClick, an extension of the Click modular router, using Intel's DPDK to handle packet I/O. We evaluate our prototype experimentally to find its bottlenecks and stress-test its different components, vis-à-vis two widely used network functions, i.e., firewall and VLAN tagging. Our evaluation shows that, on commodity hardware, SplitBox can process packets close to line rate (i.e., 8.9Gbps) with up to 50 traversed policies.
AB - In this paper, we present the design and implementation of SplitBox, a system for privacy-preserving processing of network functions outsourced to cloud middleboxes—i.e., without revealing the policies governing these functions. SplitBox is built to provide privacy for a generic network function that abstracts the functionality of a variety of network functions and associated policies, including firewalls, virtual LANs, network address translators (NATs), deep packet inspection, and load balancers. We present a scalable design aiming to provide high throughput and low latency, by distributing functionalities to a few virtual machines (VMs), while providing provably secure guarantees. We implement SplitBox inside FastClick, an extension of the Click modular router, using Intel's DPDK to handle packet I/O. We evaluate our prototype experimentally to find its bottlenecks and stress-test its different components, vis-à-vis two widely used network functions, i.e., firewall and VLAN tagging. Our evaluation shows that, on commodity hardware, SplitBox can process packets close to line rate (i.e., 8.9Gbps) with up to 50 traversed policies.
KW - NFV
KW - privacy
KW - Middlebox
UR - http://www.scopus.com/inward/record.url?scp=85071449566&partnerID=8YFLogxK
U2 - 10.1016/j.comnet.2019.106893
DO - 10.1016/j.comnet.2019.106893
M3 - Article
AN - SCOPUS:85071449566
SN - 1389-1286
VL - 163
SP - 1
EP - 15
JO - Computer Networks
JF - Computer Networks
M1 - 106893
ER -