Toward flexible auditing for in-network functionality
Toward flexible auditing for in-network functionality
复制标题
实现对网络内功能的灵活审核
DOI：
10.1145/3565477.3569150
复制
发表时间：
2022
期刊：
影响因子：
--
通讯作者：
Choffnes, David
中科院分区：
文献类型：
--
作者：
Sun, Shuwen;Choffnes, David
今天的网络越来越多地通过网络功能虚拟化（NFV）或类似技术支持网络内功能。这样的方法能够代表终端系统部署广泛的功能，例如卸载Tor服务[5]，在加密流量[6]上实施网络使用策略，或5G[3]中的新功能。这种方法的一个重要问题是审计。也就是说，这些服务依赖于第三方网络提供商忠实地按照预期部署和运行其功能，但通常很少或根本不了解提供商是否这样做。为了解决这个问题，以前的工作提供了点解决方案，例如带每包开销[1]的可验证路由，或安全实践审计[4]；然而，这些方法并不灵活——它们仅限于审计一小部分功能，并且不允许在审计覆盖率和开销之间进行权衡。在本文中，我们提出了NFAudit，它允许使用灵活的方法对已部署的NFs进行审计，其中可以使用可配置的低开销对广泛的重要属性进行审计。我们的主要见解是，简单、可组合和灵活的审计原语的设计，加上有限的信任（以安全enclaves的形式），可以实现广泛的审计功能和可配置的（通常是低成本的）。
Networks today increasingly support in-network functionality via network function virtualization (NFV) or similar technologies. Such approaches enable a wide range of functionality to be deployed on behalf of end systems, such as offloading Tor services [5], enforcing network usage policies on encrypted traffic [6], or new functionality in 5G [3]. An important open problem with such approaches isauditing.Namely, such services rely on third-party network providers to faithfully deploy and run their functionality as intended, but often have little to no insight as to whether providers do so. To address this problem, prior work provides point solutions such as verifiable routing with per-packet overhead [1], or audits of security practices [4]; however, these approaches are notflexible---they are limited to auditing a small set of functionality and do not allow trade-offs betweenauditing coverageandoverhead.In this paper, we propose NFAudit, which allows auditing of deployed NFs with a flexible approach where a wide range of important properties can be audited with configurable, low overhead. Our key insight is that the design of simple, composable, and flexible auditing primitives, combined with limited trust (in the form of secure enclaves) can permit a wide range of auditing functionality and configurable---and often low---cost.
影响因子：
3.7
作者：
Guyue Liu;Hugo Sadok;Anne Kohlbrenner;Bryan Parno;Vyas Sekar;Justine Sherry
通讯作者：
Guyue Liu;Hugo Sadok;Anne Kohlbrenner;Bryan Parno;Vyas Sekar;Justine Sherry