Enabling privacy-preserving header matching for outsourced middleboxes

Yu Guo, Cong Wang, Xingliang Yuan, Xiaohua Jia

Research output: Chapter in Book/Report/Conference proceedingConference PaperResearchpeer-review

3 Citations (Scopus)


Over the past few years, enterprises start adopting software middlebox services from cloud or NFV service providers. Although this new service model is recognized to be cost-effective and scalable for traffic processing, privacy concerns arise because of traffic redirection to outsourced middleboxes. To ease these concerns, recent efforts are made to design secure middlebox services that can directly function over encrypted traffic and middlebox rules. But prior designs only work for portions of frequently-used network functions. To push forward this area, in this work, we investigate header matching based functions like firewall filtering and packet classification. To enable privacy-preserving processing on encrypted packets, we start from the latest primitive 'order-revealing encryption (ORE)' for encrypted range search. In particular, we devise a new practical ORE construction tailored for network functions. The advantages include: 1) guaranteed protection of packet headers and rule specified ranges; 2) reduced accessible information during comparisons; 3) rule-aware size reduction for ORE ciphertexts. We implement a fully functional system prototype and deploy it at Microsoft Azure Cloud. Evaluation results show that our system can achieve per packet matching latency 0.53 to 15.87 millisecond over 1.6K firewall rules.

Original languageEnglish
Title of host publication2018 IEEE/ACM 26th International Symposium on Quality of Service (IWQoS)
Subtitle of host publicationIEEE/ACM IWQoS 2018 Banff, Alberta, Canada 4-6 June 2018
EditorsChuan Wu, Zongpeng Li
Place of PublicationPiscataway NJ USA
PublisherIEEE, Institute of Electrical and Electronics Engineers
Number of pages10
ISBN (Electronic)9781538625422
ISBN (Print)9781538625439
Publication statusPublished - 2018
EventIEEE/ACM International Symposium on Quality of Service (IWQoS) 2018 - Banff, Canada
Duration: 4 Jun 20186 Jun 2018
Conference number: 26th
http://iwqos2018.ieee-iwqos.org/ (Conference Website)
https://ieeexplore.ieee.org/xpl/conhome/8613196/proceeding (Proceedings)


ConferenceIEEE/ACM International Symposium on Quality of Service (IWQoS) 2018
Abbreviated titleIWQoS 2018
Internet address

Cite this