[논문]A Secure Middlebox Framework for Enabling Visibility Over Multiple Encryption Protocols

Han, Juhyeng; Kim, Seongmin; Cho, Daeyang; Choi, Byungkwon; Ha, Jaehyeong; Han, Dongsu

doi:10.1109/tnet.2020.3016785

[해외논문] A Secure Middlebox Framework for Enabling Visibility Over Multiple Encryption Protocols

IEEE/ACM transactions on networking : a joint publication of the IEEE Communications Society, the IEEE Computer Society, and the ACM with its Special Interest Group on Data Communication, v.28 no.6, 2020년, pp.2727 - 2740

Han, Juhyeng (Korea Advanced Institute of Science and Technology, School of Electrical Engineering, Daejeon, South Korea) , Kim, Seongmin (Sungshin Women’s University, Seoul, South Korea) , Cho, Daeyang (Korea Advanced Institute of Science and Technology, School of Electrical Engineering, Daejeon, South Korea) , Choi, Byungkwon (Korea Advanced Institute of Science and Technology, School of Electrical Engineering, Daejeon, South Korea) , Ha, Jaehyeong (Korea Advanced Institute of Science and Technology, School of Electrical Engineering, Daejeon, South Korea) , Han, Dongsu (Korea Advanced Institute of Science and Technology, School of Electrical Engineering, Daejeon, South Korea)

Abstract ▼ AI-Helper

Network middleboxes provide the first line of defense for enterprise networks. Many of them typically inspect packet payload to filter malicious attack patterns. However, the widespread use of end-to-end cryptographic protocols designed to promote security and privacy, either inhibits deep packet inspection in the network or forces enterprises to use solutions that are not secure. This article introduces a complete framework for building secure and practical network middleboxes, called EVE, which enables visibility over encrypted traffic. EVE securely processes encrypted traffic using a combination of hardware-based trusted execution and software security technology. For enhanced programmability and security, EVE provides a high-level programming interface based on the Rust language. The high-level APIs of EVE provide security and significantly ease the development effort by hiding the details of cryptographic operations, enclave processing, TCP reassembly, and out-of-band key sharing. Our evaluation shows EVE supports diverse use cases with multiple encryption protocols in a secure fashion while delivering high performance.

참고문헌 (71)

Proc 14th USENIX Symp Netw Syst Design Implement (NSDI) Opaque: An oblivious and encrypted distributed analytics platform zheng 2017 283
Yang, Yuchen, Wu, Longfei, Yin, Guisheng, Li, Lijie, Zhao, Hongbin. A Survey on Security and Privacy Issues in Internet-of-Things. IEEE Internet of things journal : a joint publication of the IEEE Sensors Council, the IEEE Communications Society, the IEEE Computer Society, the IEEE Signal Processing Society, vol.4, no.5, 1250-1258.

상세보기
10.1109/INFOCOM.2018.8485861
Proc Usenix Secur Symp Inferring fine-grained control flow inside SGX enclaves with branch shadowing lee 2017 16
Kothmayr, T., Schmitt, C., Hu, W., Brunig, M., Carle, G.. DTLS based security and two-way authentication for the Internet of Things. Ad hoc networks, vol.11, no.8, 2710-2723.

상세보기
Kohler, Eddie, Morris, Robert, Chen, Benjie, Jannotti, John, Kaashoek, M. Frans. The click modular router. ACM transactions on computer systems, vol.18, no.3, 263-297.

상세보기
Proc The 10th ACM Workshop on Hot Topics in Networks (Hotnets) A first step towards leveraging commodity trusted execution environments for network applications kim 2015 7
Proc 14th USENIX Symp Netw Syst Design Implement (NSDI) Enhancing security and privacy of Tor’s ecosystem by using trusted execution environments kim 2017 145
Proc Usenix Secur Symp Hacking in darkness: Return-oriented programming against secure enclaves lee 2017 523
Proc USENIX Symp Netw Syst Design Implem (NSDI) Embark: Securely outsourcing middleboxes to the cloud lan 2016 255
10.1145/3064176.3064192
arXiv 1802 00508 Snort intrusion detection system with intel software guard extension (Intel SGX) kuvaiskii 2018
Snort Intrusion detection system 2020
10.1109/SP.2013.13
Stanton, Ray. Securing VPNs: comparing SSL and IPsec. Computer fraud & security, vol.2005, no.9, 17-19.

상세보기
Kalkan, Kubra, Zeadally, Sherali. Securing Internet of Things with Software Defined Networking. IEEE communications magazine, vol.56, no.9, 186-192.

상세보기
arXiv 1709 04226 Slick: Secure middleboxes using shielded execution trach 2017
Proc 11th USENIX Symp Netw Syst Design Implement (NSDI) mTCP: A highly scalable user-level TCP stack for multicore systems jeong 2014 489
10.1145/3185467.3185469
Proc USENIX Annu Tech Conf (ATC) Graphene-SGX: A practical library OS for unmodified applications on SGX tsai 2017 645
10.1145/3373376.3378486
Proc Usenix Secur Symp Telling your secrets without page faults: Stealthy page table-based attacks on enclaved execution bulck 2017 1041
10.1007/978-3-319-45744-4_22
10.1145/3079856.3080208
10.1109/SP.2015.45
Proc HASP Innovative technology for CPU based attestation and sealing anati 2013 1
Alshalan, Abdullah, Pisharody, Sandeep, Dijiang Huang. A Survey of Mobile VPN Technologies. IEEE Communications surveys and tutorials, vol.18, no.2, 1177-1196.

상세보기
10.1145/3106989.3106994
Proc USENIX Symp on Operating System Design and Implementation Ryoan: A distributed sandbox for untrusted computation on secret data hunt 2016 533
HTTPS vs VPN Makes No Sense 2020
Intel software guard extensions for Linux OS 2019
Intel data plane development kit (dpdk) 2020
Proc 14th USENIX Symp Netw Syst Design Implement (NSDI) mOS: A reusable networking stack for flow monitoring middleboxes jamshed 2017 113
Intel software guard extensions SSL 2019
Paxson, Vern. Bro: a system for detecting network intruders in real-time. Computer networks, vol.31, no.23, 2435-2463.

상세보기
The perl compatible regular expression library 2019
10.14722/ndss.2017.23193
10.1145/2876019.2876032
10.1145/2785956.2787502
10.14722/ndss.2017.23037
Rust SGX SDK 2019
Rust-Openssl 2019
Rossberg, Michael, Schaefer, Guenter. A survey on automatic configuration of virtual private networks. Computer networks, vol.55, no.8, 1684-1699.

상세보기
Proc USENIX Symp Netw Syst Design Implem (NSDI) SafeBricks: Securing network functions in the cloud poddar 2018 201
10.1145/3040992.3040994
Proc ACM SIGAda Annu Conf High Integrity Lang Technol The rust language matsakis 2014 10.1145/2663171.2663188 34 103
10.1145/3319535.3339814
10.1145/2663716.2663755
ET Pro Ruleset 2019
Intel AVX New Frontiers In Performance Improvements and Energy Efficiency firasta 2008 19
Proc Int Symp Res Attacks Intrusions Defenses SGX-LAPD: Thwarting controlled side channel attacks via enclave verifiable page faults fu 2017 10.1007/978-3-319-66332-6_16 357
10.1109/FiCloud.2016.20
10.1145/1536414.1536440
10.1109/DSN.2018.00048
10.1145/3065913.3065915
TaLoS: Secure and transparent TLS termination inside SGX enclaves aublin 2017 5
Proc OSDI SCONE: Secure Linux containers with intel SGX arnautov 2016 1
10.1109/SEC.2016.15
10.1109/SP.2007.11
Proc USENIX Symp Netw Syst Design Implem (NSDI) DFC: Accelerating string pattern matching for network applications choi 2016 551
Proc of USENIX Symp on Operating Systems Design and Implementation (OSDI) NetBricks: Taking the V out of NFV panda 2016 203
10.1145/3052973.3053007
Cisco ASA 5585-X Stateful Firewall Data Sheet 2019
Nested Tunnels 2020
10.1145/2785956.2787482
OpenVPN-2 4 3 2019
OpenSSL-1 0 2l 2019
Modsecurity 2020
10.1145/2487726.2488368
10.1145/3143361.3143383
arXiv 1703 06986 CacheZoom: How SGX amplifies the power of cache attacks moghimi 2017

LOADING...

활용도 분석정보

상세보기

다운로드

내보내기

활용도 Top5 논문

해당 논문의 주제분야에서 활용도가 높은 상위 5개 콘텐츠를 보여줍니다.
더보기 버튼을 클릭하시면 더 많은 관련자료를 살펴볼 수 있습니다.

원문 URL 링크

DOI : 10.1109/TNET.2020.3016785
IEEE : 저널 > 논문
Association for Computing Machinery : 저널

*원문 PDF 파일 및 링크정보가 존재하지 않을 경우 KISTI DDS 시스템에서 제공하는 원문복사서비스를 사용할 수 있습니다.

저작권 관리 안내

내보내기 메뉴

내보내기 구분

파일저장
인쇄
메일전송

구성항목

기본정보
상세정보

관리번호, 논문명, 저널/프로시딩명, 저자 , 발행년, 권, 호, 시작페이지, 끝페이지, 발행기관

저장형식

Text(ASCII format)
Excel format
RefWorks Direct Export
RIS format (for Reference Manager, ProCite, EndNote), Scholar's Aids, Mendeley

메일정보

받는사람 (필수): @
보내는사람 (선택): @
제목
내용: KISTI 검색결과 이메일 서비스

안내

총 건의 자료가 검색되었습니다.

다운받으실 자료의 인덱스를 입력하세요. (1-10,000)

검색결과의 순서대로 최대 10,000건 까지 다운로드가 가능합니다.

데이타가 많을 경우 속도가 느려질 수 있습니다.(최대 2~3분 소요)

다운로드 파일은 UTF-8 형태로 저장됩니다.
파일의 내용이 제대로 보이지 않을실 때는 웹브라우저 상단의 보기 -> 인코딩 -> 자동선택 여부를 확인하십시오.

Text(ASCII format)
Excel format

표제어: PCR

동의어: Packet Collision Rate

용어 설명 출처 목록 (6)

용어 설명: PCR은 세균 특이성이 있는 primer를 이용하여 적은 수의 세균이 있을지라도 쉽게 검출할 수 있는 유용한 방법이며, 이를 이용하여 구강 내 치면세균막이나 타액에서 직접 세균을 검출할 수 있게 되었다[8].

AI-Helper ※ AI-Helper는 을 사용합니다.

AI-Helper

안녕하세요, AI-Helper입니다. 좌측 "선택된 텍스트"에서 텍스트를 선택하여 요약, 번역, 용어설명을 실행하세요.
※ AI-Helper는 부적절한 답변을 할 수 있습니다.

연합인증