The Community for Technology Leaders
2018 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) (2018)
Luxembourg City, Luxembourg
Jun 25, 2018 to Jun 28, 2018
ISSN: 2158-3927
ISBN: 978-1-5386-5596-2
pp: 386-397
ABSTRACT
Many organisations enhance the performance, security, and functionality of their managed networks by deploying middleboxes centrally as part of their core network. While this simplifies maintenance, it also increases cost because middlebox hardware must scale with the number of clients. A promising alternative is to outsource middlebox functions to the clients themselves, thus leveraging their CPU resources. Such an approach, however, raises security challenges for critical middlebox functions such as firewalls and intrusion detection systems. We describe EndBox, a system that securely executes middlebox functions on client machines at the network edge. Its design combines a virtual private network (VPN) with middlebox functions that are hardware-protected by a trusted execution environment (TEE), as offered by Intel's Software Guard Extensions (SGX). By maintaining VPN connection endpoints inside SGX enclaves, EndBox ensures that all client traffic, including encrypted communication, is processed by the middlebox. Despite its decentralised model, EndBox's middlebox functions remain maintainable: they are centrally controlled and can be updated efficiently. We demonstrate EndBox with two scenarios involving (i) a large company; and (ii) an Internet service provider that both need to protect their network and connected clients. We evaluate EndBox by comparing it to centralised deployments of common middlebox functions, such as load balancing, intrusion detection, firewalling, and DDoS prevention. We show that EndBox achieves up to 3.8x higher throughput and scales linearly with the number of clients.
INDEX TERMS
computer network security, computer networks, Internet, outsourcing, resource allocation, trusted computing, virtual private networks
CITATION

D. Goltzsche et al., "EndBox: Scalable Middlebox Functions Using Client-Side Trusted Execution," 2018 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), Luxembourg City, Luxembourg, 2018, pp. 386-397.
doi:10.1109/DSN.2018.00048
182 ms
(Ver 3.3 (11022016))