Privacy-preserving Network Functionality Outsourcing
This addresses privacy concerns for enterprises adopting cloud-based network outsourcing, though it is incremental as it applies existing cryptographic tools to a specific domain.
The paper tackles the problem of privacy leakage when outsourcing network middlebox functionality to the cloud in SDN, proposing a framework using cryptographic multilinear maps to obfuscate firewall rules, with experiments showing the schemes are secure, accurate, and practical.
Since the advent of software defined networks ({SDN}), there have been many attempts to outsource the complex and costly local network functionality, i.e. the middlebox, to the cloud in the same way as outsourcing computation and storage. The privacy issues, however, may thwart the enterprises' willingness to adopt this innovation since the underlying configurations of these middleboxes may leak crucial and confidential information which can be utilized by attackers. To address this new problem, we use firewall as an sample functionality and propose the first privacy preserving outsourcing framework and schemes in SDN. The basic technique that we exploit is a ground-breaking tool in cryptography, the \textit{cryptographic multilinear map}. In contrast to the infeasibility in efficiency if a naive approach is adopted, we devise practical schemes that can outsource the middlebox as a blackbox after \textit{obfuscating} it such that the cloud provider can efficiently perform the same functionality without knowing its underlying private configurations. Both theoretical analysis and experiments on real-world firewall rules demonstrate that our schemes are secure, accurate, and practical.