Zombie: Middleboxes that Don't Snoop
Zombie: Middleboxes that Don't Snoop
复制标题
DOI：
--
复制
发表时间：
2023
期刊：
影响因子：
--
通讯作者：
Collin Zhang;Zachary Destefano;Arasu Arun;Joseph Bonneau;Paul Grubbs;Michael Walfish
中科院分区：
文献类型：
--
作者：
Collin Zhang;Zachary Destefano;Arasu Arun;Joseph Bonneau;Paul Grubbs;Michael Walfish
.零知识中间盒（ZKMB）是一种最新的范例，其中客户端获得隐私，而中间盒执行策略：客户端在零知识的情况下证明其加密流量背后的纯文本符合网络策略，例如DNS过滤。然而，以前的工作有不切实际的性能差，在功能上是有限的。这项工作介绍了Zombie，第一个使用ZKMB范式构建的系统。Zombie引入了将ZKMB推向实用性边缘的技术：预处理（将大部分证明生成转移到请求之间的空闲时间），预处理（从关键路径中删除证明和验证成本）和预处理（摊销一些验证工作）。Zombie的选择，加上这些技术，将客户端和中间体的开销减少了100%。5倍，将商用硬件上DNS过滤应用程序的关键路径开销降低到300 ms以下，或者在异步配置中降低到0。作为可能引起独立兴趣的额外贡献，Zombie引入了一系列技术来在概率（和零知识）证明中编码正则表达式。这些技术显著提高了性能超过标准基线，渐进和具体。Zombie在此产品组合的基础上构建，以支持基于正则表达式的策略，例如数据丢失预防。
. Zero-knowledge middleboxes (ZKMBs) are a recent paradigm in which clients get privacy while middleboxes enforce policy: clients prove in zero knowledge that the plain-text underlying their encrypted traffic complies with network policies, such as DNS filtering. However, prior work had im-practically poor performance and was limited in functionality. This work presents Zombie, the first system built using the ZKMB paradigm. Zombie introduces techniques that push ZKMBs to the verge of practicality: preprocessing (to move the bulk of proof generation to idle times between requests), asynchrony (to remove proving and verifying costs from the critical path), and batching (to amortize some of the verification work). Zombie’s choices, together with these techniques, reduce client and middlebox overhead by ≈ 3 . 5 × , lowering the critical path overhead for a DNS filtering application on commodity hardware to less than 300ms or, in the asynchronous configuration, to 0. As an additional contribution that is likely of independent interest, Zombie introduces a portfolio of techniques to encode regular expressions in probabilistic (and zero-knowledge) proofs. These techniques significantly improve performance over a standard baseline, asymptotically and concretely. Zombie builds on this portfolio to support policies based on regular expressions, such as data loss prevention.