Abstract:Network middleboxes perform deep packet inspection (DPI) to detect anomalies and suspicious activities in network traffic. However, increasingly these traffic are encrypted and middleboxes can no longer make sense of them. A recent proposal by Sherry et al. (SIGCOMM 2015), named BlindBox, enables the middlebox to perform inspection in a privacy-preserving manner. BlindBox deploys garbled circuit to generate encrypted rules for the purpose of inspecting the encrypted traffic directly. However, the setup latency (which could be 97s on a ruleset of 3,000 as reported) and overhead size incurred by garbled circuit are high. Since communication can only be commenced after the encrypted rules being generated, such delay is intolerable in many real-time applications. In this work, we present PrivDPI, which reduces the setup delay while retaining similar privacy guarantee. Compared to BlindBox, for a ruleset of 3,000, our encrypted rule generation is 288x faster and requires 290,227x smaller overhead for the first session, and is even 1,036x faster and requires 3424,505x smaller overhead over 20 consecutive sessions. The performance gain is based on a new technique for generating encrypted rules as well as the idea of reusing intermediate results generated in previous sessions across subsequent sessions. This is in contrast to Blindbox which performs encrypted rule generation from scratch for every session. Nevertheless, PrivDPI is 6x slower in generating the encrypted traffic tokens, yet in our implementation, the token encryption rate of PrivDPI is more than 17,271 per second which is sufficient for many real-time applications. Moreover, the intermediate values generated in each session can be reused across subsequent sessions for repeated tokens, which could further speedup token encryption. Overall, our experiment shows that PrivDPI is practical and especially suitable for connections with short flows.

Programmable In-Network Obfuscation of Traffic

NetDP: In-Network Differential Privacy for Large-Scale Data Processing

Network Coding Based Privacy Preservation Against Traffic Analysis in Multi-Hop Wireless Networks

A lightweight anonymity protocol at terabit speeds on programmable switches

Anonymizing Masses: Practical Light-weight Anonymity at the Network Level

PNPL: Simplifying Programming for Protocol-Oblivious SDN Networks

PHI: Path-Hidden Lightweight Anonymity Protocol at Network Layer

GoHop: Personal VPN to Defend from Censorship

PriFi: Low-Latency Anonymity for Organizational Networks

TARANET: Traffic-Analysis Resistant Anonymity at the Network Layer

P4Control: Line-Rate Cross-Host Attack Prevention via In-Network Information Flow Control Enabled by Programmable Switches and eBPF

Tor circuit fingerprinting defenses using adaptive padding

Anonymous Network Communication Based on SDN

Encryption of Sensitive Data Flow Information in Hybrid Networks with P4

Anonymous Routing For Wireless Network Coding

Novel Protocols to Mitigate Network Slice Topology Learning Attacks and Protect Privacy of Users’ Service Access Behavior in Softwarized 5G Networks

Orthogonal Obfuscation Based Key Management for Multiple IP Protection.

An Anonymous IP-based Privacy Protection Routing Mechanism for CDNi.

Enabling Service-Oriented Programming for Multi-User in Polymorphic Network

Automated Hardware Logic Obfuscation Framework Using GPT

PrivDPI