[Paper Review] Privacy-preserving Network Functionality Outsourcing

Junjie Shi, Yuan Zhang+1 more|arXiv (Cornell University)|Feb 2, 2015

Cryptography and Data SecurityComputer Science14 references17 citations

TL;DR

This paper proposes SOFA, the first privacy-preserving framework for outsourcing network middleboxes—specifically firewalls—in Software-Defined Networking (SDN). It uses cryptographic multilinear maps to obfuscate firewall rules, enabling secure cloud-based filtering without exposing sensitive configurations, while maintaining high efficiency and accuracy, as validated by experiments on real-world firewall rules.

ABSTRACT

Since the advent of software defined networks ({SDN}), there have been many attempts to outsource the complex and costly local network functionality, i.e. the middlebox, to the cloud in the same way as outsourcing computation and storage. The privacy issues, however, may thwart the enterprises' willingness to adopt this innovation since the underlying configurations of these middleboxes may leak crucial and confidential information which can be utilized by attackers. To address this new problem, we use firewall as an sample functionality and propose the first privacy preserving outsourcing framework and schemes in SDN. The basic technique that we exploit is a ground-breaking tool in cryptography, the extit{cryptographic multilinear map}. In contrast to the infeasibility in efficiency if a naive approach is adopted, we devise practical schemes that can outsource the middlebox as a blackbox after extit{obfuscating} it such that the cloud provider can efficiently perform the same functionality without knowing its underlying private configurations. Both theoretical analysis and experiments on real-world firewall rules demonstrate that our schemes are secure, accurate, and practical.

Motivation & Objective

• Address the privacy risks in outsourcing SDN middleboxes, such as firewalls, to cloud providers due to exposure of sensitive configuration data.
• Enable secure outsourcing of network functionality without revealing underlying rules or policies to untrusted cloud providers.
• Design a practical and efficient framework that preserves functionality while protecting private configurations in a cryptographically sound manner.
• Ensure the solution is compatible with existing SDN outsourcing architectures and scalable for real-world deployment.
• Demonstrate feasibility and performance through implementation and evaluation on real-world firewall rule sets.

Proposed method

• Propose SOFA, a two-phase framework: (1) local obfuscation of firewall rules using cryptographic multilinear maps, and (2) cloud-based execution of the obfuscated rules without access to original configurations.
• Leverage cryptographic program obfuscation via multilinear maps to encode firewall rules such that functionality is preserved but underlying logic remains hidden.
• Design three schemes—basic, divide-and-conquer, and blocking—each optimizing different phases: obfuscation (phase 1) or packet filtering (phase 2).
• Use ring sampling, encoding, re-randomization, multiplication, and zero-testing procedures as core cryptographic operations within the multilinear map system.
• Optimize performance by compressing obfuscation encodings and introducing a blocking scheme to reduce computational overhead in the execution phase.
• Ensure correctness and security by tuning noise parameters in the multilinear map system to maintain accuracy while maximizing efficiency.

Experimental results

Research questions

• RQ1 Can network functionality outsourcing in SDN be made privacy-preserving without compromising functional correctness?
• RQ2 How can cryptographic multilinear maps be effectively applied to obfuscate firewall rules while preserving their filtering behavior?
• RQ3 What are the performance trade-offs between different obfuscation and execution schemes in terms of computation time and scalability?
• RQ4 To what extent can the proposed schemes handle real-world firewall rule sets in terms of efficiency and accuracy?
• RQ5 Is it feasible to deploy such a privacy-preserving framework in practice, given real-world performance constraints?

Key findings

• The naive obfuscation scheme scales poorly, taking approximately 4.1 seconds to obfuscate a single 32-bit rule, highlighting the need for optimized schemes.
• The basic scheme significantly improves obfuscation performance through encoding compression, reducing time overheads in the first phase.
• The blocking scheme achieves the fastest packet filtering performance, with average processing times of 6 milliseconds per packet on a standard PC.
• The divide-and-conquer and blocking schemes outperform the basic scheme in the execution phase, with measured times of 100 and 6 ms per packet, respectively.
• The zero-testing procedure is computationally lightweight, contributing minimally to overall overhead.
• The framework maintains correctness and security under controlled noise levels, ensuring no loss of accuracy even at high multilinearity levels (e.g., κ = 33).