EndBox: Scalable Middlebox Functions Using Client-Side Trusted Execution

Abstract

Many organisations enhance the performance, security, and functionality of their managed networks by deploying middleboxes centrally as part of their core network. While this simplifies maintenance, it also increases cost because middlebox hardware must scale with the number of clients. A promising alternative is to outsource middlebox functions to the clients themselves, thus leveraging their CPU resources. Such an approach, however, raises security challenges for critical middlebox functions such as firewalls and intrusion detection systems. We describe ENDBOX, a system that securely executes middlebox functions on client machines at the network edge. Its design combines a virtual private network (VPN) with middlebox functions that are hardware-protected by a trusted execution environment (TEE), as offered by Intel's Software Guard Extensions (SGX). By maintaining VPN connection endpoints inside SGX enclaves, ENDBOX ensures that all client traffic, including encrypted communication, is processed by the middlebox. Despite its decentralised model, ENDBOX's middlebox functions remain maintainable: they are centrally controlled and can be updated efficiently. We demonstrate ENDBOX with two scenarios involving (i) a large company; and (ii) an Internet service provider that both need to protect their network and connected clients. We evaluate ENDBOX by comparing it to centralised deployments of common middlebox functions, such as load balancing, intrusion detection, firewalling, and DDoS prevention. We show that ENDBOX achieves up to 3.8× higher throughput and scales linearly with the number of clients.

OblivSketch: Oblivious Network Measurement as a Cloud Service

“…Our work is also related to secure networked systems based on Intel SGX [27], [31], [36], [58], [67]. With the help of trusted hardware, these systems can securely process network traffic for a variety of network functions, e.g., IDS [27], [31], [36], [67], firewall [27], [31], [58], load balancer [31], [58], NAT [58], etc. We note that the above systems do not consider mitigating side-channel attacks against Intel SGX.…”

“…A practical alternative for securing network measurement services is to resort to hardware-assisted security, i.e., Intel SGX, a trusted execution environment. Due to its advantages on functionality and performance, SGX has recently been applied to develop a wide spectrum of secure networked applications and systems, e.g., IDS [27], [58], load balancer [31], [58], and firewall [27], [58]. At first glance, migrating existing implementation of network measurements into the SGX enclave would solve the problem.…”

PDoT

“…Specifically, SGX has been used to protect network functions, especially middle-boxes. For example, Endbox [17] aims to distribute middle-boxes to client edges: clients connect through VPN to ensure confidentiality of their traffic while remaining maintainable. LightBox [14] is another middle-box that runs in an enclave; its goal is to protect the client's traffic from the third-party middle-box service provider while maintaining adequate performance.…”

sgx-perf

“…With the advent of Intel's Software Guard Extensions (SGX) [14,28], the situation is about to change as this novel trusted execution technology enables confidentiality and integrity protection of code and data -even from privileged software and physical attacks. Accordingly, researchers from academia and industry alike recently published research works in rapid succession to secure applications in clouds [2,5,33], enable secure networking [9,11,34,39] and fortify local applications [22,23,35].…”