Abstract

Modern enterprise networks heavily rely on the ubiquitous network middleboxes for advanced traffic-processing functions, such as intrusion detection, web application firewalls, and load balancers. Recent advances in software packet processing and virtualization technologies are further pushing forward the paradigm of migrating middleboxes to third-party providers, e.g., clouds and ISPs, as virtualized services, with well-understood benefits on reduced maintenance cost and increased service scalability. Despite promising, this new paradigm of middlebox services also raises fundamental security challenges. This is majorly because the network traffic is now redirected to and processed by service providers, which are not necessarily in the same trust domain as enterprises. In this talk, I will present some of our recent research efforts towards secure outsourced middlebox services. Our first challenge is to ensure that those middleboxes consistently perform network functions as intended. Practical assurance mechanisms have to be designed to enforce both individual middleboxes and middlebox service chains to process packets via designated functions. As redirecting traffic to service providers would further raise privacy concerns on the unwanted exposure of traffic flows, I will also discuss our initial efforts on privacy-preserving deep packet inspection in outsourced middleboxes. Finally, along the line I will talk about some possible future research directions.