Institute of Operating Systems and Computer Networks EndBox: Scalable M iddlebox Functions Using Client-Side Trusted Execution Image CC-BY-SA Victorgrigas David Goltzsche, 1 Signe Rüsch, 1 Manuel Nieke, 1 Sébastien Vaucher, 2 Nico Weichbrodt, 1 Valerio Schiavoni, 2 Pierre-Louis Aublin, 3 Paolo Costa, 4 Christof Fetzer, 5 Pascal Felber, 2 Peter Pietzuch 3 and Rüdiger Kapitza 1 1 TU Braunschweig goltzsche@ibr.cs.tu-bs.de @d_goltzsche 2 University of Neuchâtel 3 Imperial College London 4 Microsoft Research 5 TU Dresden
Introduction to Middleboxes Design of EndBox Evaluation of EndBox Related Work Conclusion What Are M iddleboxes? Middleboxes are essential parts of large networks Example: enterprise networks Server Server Server Functions related to security or performance Middlebox Enterprise Current best practice: Network Gateway central deployment as physical boxes Client Client Client High infrastructure and management costs (Sherry et al. SIGCOMM’12) Scalability issues with growing client numbers 2018-06-27 D. Goltzsche, TU Braunschweig, Germany DSN’18: EndBox Page 2 Institute of Operating Systems and Computer Networks
Introduction to Middleboxes Design of EndBox Evaluation of EndBox Related Work Conclusion What Are M iddleboxes? Middleboxes are essential parts of large networks Example: enterprise networks Server Server Server Functions related to security or performance Middlebox Enterprise Current best practice: Network Gateway central deployment as physical boxes Client Client Client High infrastructure and management costs (Sherry et al. SIGCOMM’12) Scalability issues with growing client numbers Problem: Middleboxes are necessary for large networks, but come at high costs and do not scale well with number of clients. 2018-06-27 D. Goltzsche, TU Braunschweig, Germany DSN’18: EndBox Page 2 Institute of Operating Systems and Computer Networks
Introduction to Middleboxes Design of EndBox Evaluation of EndBox Related Work Conclusion P lacement of Middleboxes Server Server Server Server Server Server (a) (b) (c) (d) Middlebox Enterprise Network Gateway Enterprise Low infra. cost Network Gateway Client Cloud Middle Low latency Client box Good scalability Client Client Client Client Trusted infrastructure (a) Centralised (b) Cloud-based Easy administration Server Server Server Server Server Server Middle Middle Middle box box box Enterprise Network Gateway Enterprise Network Gateway Client Client Client Middle Middle Middle Client Client Client box box box (c) Server-side (d) Client-side 2018-06-27 D. Goltzsche, TU Braunschweig, Germany DSN’18: EndBox Page 3 Institute of Operating Systems and Computer Networks
Introduction to Middleboxes Design of EndBox Evaluation of EndBox Related Work Conclusion P lacement of Middleboxes Server Server Server Server Server Server (a) (b) (c) (d) Middlebox Enterprise Network Gateway Enterprise Low infra. cost ✗ Network Gateway Client Cloud Middle Low latency ✔ Client box Good scalability Client Client Client ✗ Client Trusted infrastructure ✔ (a) Centralised (b) Cloud-based Easy administration ✔ Server Server Server Server Server Server Middle Middle Middle box box box Enterprise Network Gateway Enterprise Network Gateway Client Client Client Middle Middle Middle Client Client Client box box box (c) Server-side (d) Client-side 2018-06-27 D. Goltzsche, TU Braunschweig, Germany DSN’18: EndBox Page 3 Institute of Operating Systems and Computer Networks
Introduction to Middleboxes Design of EndBox Evaluation of EndBox Related Work Conclusion P lacement of Middleboxes Server Server Server Server Server Server (a) (b) (c) (d) Middlebox Enterprise Network Gateway Enterprise Low infra. cost ✗ ✔ Network Gateway Client Cloud Middle Low latency ✔ ✗ Client box Good scalability Client Client Client ✗ ✔ Client Trusted infrastructure ✔ ✗ (a) Centralised (b) Cloud-based Easy administration ✔ ✔ Server Server Server Server Server Server Middle Middle Middle box box box Enterprise Network Gateway Enterprise Network Gateway Client Client Client Middle Middle Middle Client Client Client box box box (c) Server-side (d) Client-side 2018-06-27 D. Goltzsche, TU Braunschweig, Germany DSN’18: EndBox Page 3 Institute of Operating Systems and Computer Networks
Introduction to Middleboxes Design of EndBox Evaluation of EndBox Related Work Conclusion P lacement of Middleboxes Server Server Server Server Server Server (a) (b) (c) (d) Middlebox Enterprise Network Gateway Enterprise Low infra. cost ✗ ✔ ✔ Network Gateway Client Cloud Middle Low latency ✔ ✗ ✔ Client box Good scalability ✗ ✔ ✗ Client Client Client Client Trusted infrastructure ✔ ✗ ✔ (a) Centralised (b) Cloud-based Easy administration ✔ ✔ ✗ Server Server Server Server Server Server Middle Middle Middle box box box Enterprise Network Gateway Enterprise Network Gateway Client Client Client Middle Middle Middle Client Client Client box box box (c) Server-side (d) Client-side 2018-06-27 D. Goltzsche, TU Braunschweig, Germany DSN’18: EndBox Page 3 Institute of Operating Systems and Computer Networks
Introduction to Middleboxes Design of EndBox Evaluation of EndBox Related Work Conclusion P lacement of Middleboxes Server Server Server Server Server Server (a) (b) (c) (d) Middlebox Enterprise Network Gateway Enterprise Low infra. cost ✗ ✔ ✔ ✔ Network Gateway Client Cloud Middle Low latency ✔ ✗ ✔ ✔ Client box Good scalability ✗ ✔ ✗ ✔ Client Client Client Client Trusted infrastructure ✔ ✗ ✔ ✗ (a) Centralised (b) Cloud-based Easy administration ✔ ✔ ✗ ✗ Server Server Server Server Server Server Middle Middle Middle box box box Enterprise Network Gateway Enterprise Network Gateway Client Client Client Middle Middle Middle Client Client Client box box box (c) Server-side (d) Client-side 2018-06-27 D. Goltzsche, TU Braunschweig, Germany DSN’18: EndBox Page 3 Institute of Operating Systems and Computer Networks
Introduction to Middleboxes Design of EndBox Evaluation of EndBox Related Work Conclusion P lacement of Middleboxes Server Server Server Server Server Server (a) (b) (c) (d) Middlebox Enterprise Network Gateway Enterprise Low infra. cost ✗ ✔ ✔ ✔ Network Gateway Client Cloud Middle Low latency ✔ ✗ ✔ ✔ Client box Good scalability Client Client Client ✗ ✔ ✗ ✔ Client Trusted infrastructure ✔ ✗ ✔ ✔ (a) Centralised (b) Cloud-based Easy administration ✔ ✔ ✗ ✔ ✔ with EndBox Server Server Server Server Server Server Middle Middle Middle box box box Enterprise Network Gateway Enterprise Network Gateway EndBox targets enterprise networks and Client Client Client Middle Middle Middle places middleboxes on untrusted clients . Client Client Client box box box (c) Server-side (d) Client-side 2018-06-27 D. Goltzsche, TU Braunschweig, Germany DSN’18: EndBox Page 3 Institute of Operating Systems and Computer Networks
Introduction to Middleboxes Design of EndBox Evaluation of EndBox Related Work Conclusion Outline Introduction to Middleboxes Design of EndBox Evaluation of EndBox Related Work Conclusion 2018-06-27 D. Goltzsche, TU Braunschweig, Germany DSN’18: EndBox Page 4 Institute of Operating Systems and Computer Networks
Introduction to Middleboxes Design of EndBox Evaluation of EndBox Related Work Conclusion Approach of EndBox Enterprise Client machine Network Applications configures Admin FW/GW EndBox Client EndBox Server TEE Untrusted clients can manipulate or circumvent traffic analysis Client traffic routed through trusted execution environments (TEEs) Inside TEE, packets are processed, signed and encrypted Unsigned outgoing traffic dropped by firewall/gateway (FW/GW) Encrypted incoming traffic cannot be encrypted outside of TEE 2018-06-27 D. Goltzsche, TU Braunschweig, Germany DSN’18: EndBox Page 5 Institute of Operating Systems and Computer Networks
Introduction to Middleboxes Design of EndBox Evaluation of EndBox Related Work Conclusion Approach of EndBox Enterprise Client machine Apps Network EndBox Applications configures Client Admin FW/GW TEE EndBox Client EndBox Server TEE Untrusted clients can manipulate or circumvent traffic analysis Client traffic routed through trusted execution environments (TEEs) Inside TEE, packets are processed, signed and encrypted Unsigned outgoing traffic dropped by firewall/gateway (FW/GW) Encrypted incoming traffic cannot be encrypted outside of TEE 2018-06-27 D. Goltzsche, TU Braunschweig, Germany DSN’18: EndBox Page 5 Institute of Operating Systems and Computer Networks
Recommend
More recommend
