Abstract:Middleboxes in a computer network system inspect and analyse network traffic to detect malicious communications, monitor system performance and provide operational services. However, encrypted traffic hinders the ability of middleboxes to perform such services. A common practice in addressing this issue is by employing a "Man-in-the-Middle" (MitM) approach, wherein an encrypted traffic flow between two endpoints is interrupted, decrypted and analysed by the middleboxes. The MitM approach is straightforward and is used by many organisations, but there are both practical and privacy concerns. Due to the cost of the MitM appliances and the latency incurred in the encrypt-decrypt processes, enterprises continue to seek solutions that are less costly. There were discussion on the many efforts required to configure MitM. Besides, MitM violates end-to-end privacy guarantee, raising privacy concerns and issues on compliance especially with the rising awareness on user privacy. Furthermore, some of the MitM implementations were found to be flawed. Consequently, new practical and privacy-preserving techniques for inspection over encrypted traffic were proposed. We examine them to compare their advantages, limitations and challenges. We categorise them into four main categories by defining a framework that consist of system architectures, use cases, trust and threat models. These are searchable encryption, access control, machine learning and trusted hardware. We first discuss the man-in-the-middle approach as a baseline, then discuss in details each of them, and provide an in-depth comparisons of their advantages and limitations. By doing so we describe practical constraints, advantages and pitfalls towards adopting the techniques. We also give insights on the gaps between research work and industrial deployment, which leads us to the discussion on the challenges and research directions.

Practical Privacy-Preserving Deep Packet Inspection Outsourcing

Privacy-preserving Efficient Verifiable Deep Packet Inspection for Cloud-assisted Middlebox

Privacy-Preserving and Lightweight Verification of Deep Packet Inspection in Clouds

SPABox: Safeguarding Privacy During Deep Packet Inspection at a MiddleBox

Privacy-preserving Network Functionality Outsourcing.

A Distributed Privacy-Preserving Framework for Deep Learning with Edge-Cloud Computing.

Asidps: Auto-Scaling Intrusion Detection And Prevention System For Cloud

A Survey of Privacy-Preserving Techniques for Encrypted Traffic Inspection over Network Middleboxes

Network Function Outsourcing System Based on Prefix-Preserving Encryption

Flexible identity-based remote data integrity checking for cloud storage with privacy preserving property

Catch Me in the Dark: Effective Privacy-Preserving Outsourcing of Feature Extractions over Image Data

Outsourcing Eigen-Decomposition and Singular Value Decomposition of Large Matrix to a Public Cloud

Practical-oriented Protocols for Privacy-Preserving Outsourced Big Data Analysis: Challenges and Future Research Directions

Private Processing of Outsourced Network Functions: Feasibility and Constructions

Privacy-Preserving Traceable Encrypted Traffic Inspection in Blockchain-based Industrial IoT

JEDI: Joint and Effective Privacy Preserving Outsourced Set Intersection and Data Integration Protocols

A Generalized Framework for Preserving Both Privacy and Utility in Data Outsourcing

Toward Secure Outsourced Middlebox Services: Practices, Challenges, and Beyond.

Towards Practical Encrypted Network Traffic Pattern Matching for Secure Middleboxes

CloudBI: Practical Privacy-Preserving Outsourcing of Biometric Identification in the Cloud

Analysis and Enhancement of a Lattice-Based Data Outsourcing Scheme With Public Integrity Verification