EndBox: Scalable middlebox functions using Client-Side trusted execution

Goltzsche D, Ruesch S, Nieke M, Vaucher S, Weichbrodt N, Schiavoni V, Aublin PL, Costa P, Fetzer C, Felber P, Pietzuch P, Kapitza R (2018)

Publication Type: Conference contribution

Publication year: 2018

Publisher: Institute of Electrical and Electronics Engineers Inc.

Pages Range: 386-397

Conference Proceedings Title: Proceedings - 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2018

Event location: Luxembourg City LU

ISBN: 9781538655955

DOI: 10.1109/DSN.2018.00048

Abstract

Many organisations enhance the performance, security, and functionality of their managed networks by deploying middleboxes centrally as part of their core network. While this simplifies maintenance, it also increases cost because middlebox hardware must scale with the number of clients. A promising alternative is to outsource middlebox functions to the clients themselves, thus leveraging their CPU resources. Such an approach, however, raises security challenges for critical middlebox functions such as firewalls and intrusion detection systems. We describe EndBox, a system that securely executes middlebox functions on client machines at the network edge. Its design combines a virtual private network (VPN) with middlebox functions that are hardware-protected by a trusted execution environment (TEE), as offered by Intel's Software Guard Extensions (SGX). By maintaining VPN connection endpoints inside SGX enclaves, EndBox ensures that all client traffic, including encrypted communication, is processed by the middlebox. Despite its decentralised model, EndBox's middlebox functions remain maintainable: They are centrally controlled and can be updated efficiently. We demonstrate EndBox with two scenarios involving (i) a large company; and (ii) an Internet service provider that both need to protect their network and connected clients. We evaluate EndBox by comparing it to centralised deployments of common middlebox functions, such as load balancing, intrusion detection, firewalling, and DDoS prevention. We show that EndBox achieves up to 3.8x higher throughput and scales linearly with the number of clients.

Authors with CRIS profile

Rüdiger Kapitza

Involved external institutions

Microsoft Research Lab UK GB United Kingdom (GB) Technische Universität Braunschweig DE Germany (DE) Imperial College London / The Imperial College of Science, Technology and Medicine GB United Kingdom (GB) Technische Universität Dresden DE Germany (DE) Université de Neuchâtel CH Switzerland (CH)

How to cite

APA:

Goltzsche, D., Ruesch, S., Nieke, M., Vaucher, S., Weichbrodt, N., Schiavoni, V.,... Kapitza, R. (2018). EndBox: Scalable middlebox functions using Client-Side trusted execution. In Proceedings - 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2018 (pp. 386-397). Luxembourg City, LU: Institute of Electrical and Electronics Engineers Inc..

MLA:

Goltzsche, David, et al. "EndBox: Scalable middlebox functions using Client-Side trusted execution." Proceedings of the 48th Annual IEEE/IFIP International Conference on Dependable Systems and Networks, DSN 2018, Luxembourg City Institute of Electrical and Electronics Engineers Inc., 2018. 386-397.

BibTeX: Download