Towards privacy-preserving dynamic deep packet inspection over outsourced  

作　　者：Chunxiao Li Yu Guo Xia Wang 

机构地区：[1]School of Artificial Intelligence,Beijing Normal University,Beijing,China [2]School of Statistics and Data Science,Beijing University of Technology,Beijing,China

出　　处：《High-Confidence Computing》2022年第1期1-8,共8页高置信计算（英文）

基　　金：supported by the Fundamental Research Funds for the Central Universities under grants 310421108.

摘　　要：The prosperity of network function virtualization(NFV)pushes forward the paradigm of migrating in-house middleboxes to third-party providers,i.e.,software(virtualized)middlebox services.A lot of enterprises have outsourced traffic processing such as deep packet inspection(DPI),traffic classification,and load balancing to middleboxes provided by cloud providers.However,if the traffic is forwarded to the cloud provider without careful processing,it will cause privacy leakage,as the cloud provider has all the rights to access the data.To solve the security issue,recent efforts are made to design secure middleboxes that can directly conduct network functions over encrypted traffic and middlebox rules.However,security concerns from dynamic operations like dynamic DPI and rule updates are still not yet fully addressed.In this paper,we propose a privacy-preserving dynamic DPI scheme with forward privacy for outsourced middleboxes.Our design can enable cloud side middlebox to conduct secure packet inspection over encrypted traffic data.Besides,the middlebox providers cannot analyze the relationship between the newly added rules and the previous data.Several recent papers have proven that it is a strong property that resist adaptive attacks.Furthermore,we design a general method to inspect stateful packets while still ensuring the state privacy protection.We formally define and prove the security of our design.Finally,we implement a system prototype and analyze the performance from experimental aspects.The evaluation results demonstrate our scheme is effective and efficient.

关 键 词：DPI outsourcing Network function virtualization Dynamic searchable symmetric encryption 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]