Private Processing of Outsourced Network Functions: Feasibility and Constructions

TL;DR

This paper explores cryptographic methods to enable privacy-preserving outsourcing of network functions to untrusted cloud providers, ensuring sensitive policies remain confidential while maintaining efficiency.

Contribution

It introduces a cryptographic framework and concrete constructions for private network function processing, with proofs of security and practical implementation.

Findings

Network functions can be processed privately in milliseconds.

Cryptographic schemes protect sensitive network policies.

Practical implementations demonstrate feasibility.

Abstract

Aiming to reduce the cost and complexity of maintaining networking infrastructures, organizations are increasingly outsourcing their network functions (e.g., firewalls, traffic shapers and intrusion detection systems) to the cloud, and a number of industrial players have started to offer network function virtualization (NFV)-based solutions. Alas, outsourcing network functions in its current setting implies that sensitive network policies, such as firewall rules, are revealed to the cloud provider. In this paper, we investigate the use of cryptographic primitives for processing outsourced network functions, so that the provider does not learn any sensitive information. More specifically, we present a cryptographic treatment of privacy-preserving outsourcing of network functions, introducing security definitions as well as an abstract model of generic network functions, and then propose a few instantiations using partial homomorphic encryption and public-key encryption with keyword search. We include a proof-of-concept implementation of our constructions and show that network functions can be privately processed by an untrusted cloud provider in a few milliseconds.