BlindBox: Deep Packet Inspection over Encrypted Traffic

By Justine Sherry, Chang Lan, Raluca Ada Popa, Sylvia Ratnasamy. Conference on Applications, Technologies, Architectures, and Protocols for Computer Communication, 2015

413 citations recorded by the source corpus.

Many network middleboxes perform deep packet inspection (DPI), a set of useful tasks which examine packet payloads. These tasks include intrusion detection (IDS), exfiltration detection, and parental filtering. However, a long-standing issue is that once packets are sent over HTTPS, middleboxes can no longer accomplish their tasks because the payloads are encrypted. Hence, one is faced with the choice of only one of two desirable properties: the functionality of middleboxes and the privacy of encryption. We propose BlindBox, the first system that simultaneously provides {\em both} of these properties. The approach of BlindBox is to perform the deep-packet inspection {\em directly on the encrypted traffic. BlindBox realizes this approach through a new protocol and new encryption schemes. We demonstrate that BlindBox enables applications such as IDS, exfiltration detection and parental filtering, and supports real rulesets from both open-source and industrial DPI systems. We implemented BlindBox and showed that it is practical for settings with long-lived HTTPS connections. Moreover, its core encryption scheme is 3-6 orders of magnitude faster than existing relevant cryptographic schemes.

Subfields: Artificial Intelligence, Computer Networks and Communications

View Paper: https://www.semanticscholar.org/paper/463b5d0ddade077182fce105f95ead0213fe484d

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

Citations in the corpus

ReCon: Revealing and Controlling PII Leaks in Mobile Network Traffic (2015, background): “The previous section shows that current OSes do not provide sufﬁcient visibility into PII leaks, provide few options to control it, and thus signiﬁcant amounts of potentially sensitive information is exﬁltrated from user devices.”
Characterization of Encrypted and VPN Traffic using Time-related Features (2016, background): “Sherry et al. (Sherry et al., 2015) propose a DPI system that can inspect encrypted payload without decrypting it, therefore maintaining the privacy of the communications, but it can only process HTTPS traffic.”
An Approach for Service Function Chain Routing and Virtual Function Network Instance Migration in Network Function Virtualization Architectures (2017, methodology): “In this paper, due to the advantages to avoid complex NFV state management issue, we investigate solutions based on vertical scaling techniques [12], [20]–[22] in which the VNFIs are dimensioned to achieve the processing capacity required by the trafﬁc.”
Deep packet: a novel approach for encrypted traffic classification using deep learning (2017, background): “proposed a new DPI system that can inspect encrypted payload without decryption, thus solved the user privacy issue, but it can only process HTTP Secure (HTTPS) traffic (Sherry et al. 2015).”
This Paper Is Included in the Proceedings of the 12th Usenix Symposium on Operating Systems Design and Implementation (osdi '16). Ryoan: a Distributed Sandbox for Untrusted Computation on Secret Data Ryoan: a Distributed Sandbox for Untrusted Computation on Secret Data (neutral): “There are also systems built on these primitives [23, 59, 65].”