{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2023,9,3]],"date-time":"2023-09-03T09:40:17Z","timestamp":1693734017859},"reference-count":41,"publisher":"Wiley","issue":"22","license":[{"start":{"date-parts":[[2018,2,7]],"date-time":"2018-02-07T00:00:00Z","timestamp":1517961600000},"content-version":"vor","delay-in-days":0,"URL":"http:\/\/onlinelibrary.wiley.com\/termsAndConditions#vor"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["61702541"],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Concurrency and Computation"],"published-print":{"date-parts":[[2019,11,25]]},"abstract":"Summary<\/jats:title>Hardware\u2010based middleboxes are ubiquitous in computer networks, which usually incur high deployment and management expenses. A recently arising trend aims to address those problems by outsourcing the functions of traditional hardware\u2010based middleboxes to high volume servers in a cloud. This technology is promising but still faces a few challenges from different aspects, including privacy concerns, middlebox functionality, and performance. In this paper, we propose two practical approaches to implementing a cloud\u2010based DPI middlebox. The outsourced DPI middlebox performs payload inspection over encrypted traffic while preserving the privacy of both communication data and inspection rules. Our first approach employs a modified reversible sketch structure, which is used for efficient error\u2010free membership testing, and our second approach extends the famous AC pattern matching algorithm to the cipher text domain. We utilize unkeyed one\u2010way hash functions instead of complex cryptographic protocols to achieve the privacy preservation requirements. Our system supports a wide range of real\u2010world inspection rules. We conduct evaluations on the ClamAV rule set, and the experiment results demonstrate the effectiveness of our proposals.<\/jats:p>","DOI":"10.1002\/cpe.4435","type":"journal-article","created":{"date-parts":[[2018,2,8]],"date-time":"2018-02-08T02:42:54Z","timestamp":1518057774000},"source":"Crossref","is-referenced-by-count":1,"title":["Practical privacy\u2010preserving deep packet inspection outsourcing"],"prefix":"10.1002","volume":"31","author":[{"ORCID":"http:\/\/orcid.org\/0000-0002-3648-0021","authenticated-orcid":false,"given":"Jie","family":"Li","sequence":"first","affiliation":[{"name":"School of Computer National University of Defense Technology Changsha China"}]},{"given":"Jinshu","family":"Su","sequence":"additional","affiliation":[{"name":"School of Computer National University of Defense Technology Changsha China"},{"name":"National Key Laboratory for Parallel and Distributed Processing National University of Defense Technology Changsha China"}]},{"given":"Rongmao","family":"Chen","sequence":"additional","affiliation":[{"name":"School of Computer National University of Defense Technology Changsha China"}]},{"given":"Xiaofeng","family":"Wang","sequence":"additional","affiliation":[{"name":"School of Computer National University of Defense Technology Changsha China"}]},{"given":"Shuhui","family":"Chen","sequence":"additional","affiliation":[{"name":"School of Computer National University of Defense Technology Changsha China"}]}],"member":"311","published-online":{"date-parts":[[2018,2,7]]},"reference":[{"key":"e_1_2_10_2_1","unstructured":"Operators Network.Network functions virtualization an introduction benefits enablers challenges and call for action;2012."},{"key":"e_1_2_10_3_1","doi-asserted-by":"publisher","DOI":"10.1145\/2377677.2377680"},{"key":"e_1_2_10_4_1","unstructured":"WannaCry ransomware attack. Wikipedia: The Free Encyclopedia.https:\/\/en.wikipedia.org\/wiki\/WannaCry_ransomware_attack. Accessed June 19 2017."},{"key":"e_1_2_10_5_1","doi-asserted-by":"publisher","DOI":"10.1002\/cpe.3485"},{"key":"e_1_2_10_6_1","unstructured":"Amazon Web Services.https:\/\/aws.amazon.com\/what-is-aws\/. Accessed June 20 2017."},{"key":"e_1_2_10_7_1","unstructured":"Kaspersky Lab.https:\/\/www.kaspersky.com\/. Accessed June 20 2017."},{"key":"e_1_2_10_8_1","unstructured":"McAfee.https:\/\/home.mcafee.com\/. Accessed June 20 2017."},{"key":"e_1_2_10_9_1","doi-asserted-by":"crossref","unstructured":"SherryJ LanC PopaRA RatnasamyS.Blindbox: deep packet inspection over encrypted traffic. Paper presented at: Proceedings of the 2015 ACM Conference on Special Interest Group on Data Communication (SIGCOMM '15);2015;London UK.","DOI":"10.1145\/2785956.2787502"},{"key":"e_1_2_10_10_1","doi-asserted-by":"crossref","unstructured":"YaoACC.How to generate and exchange secrets. Paper presented at: 27th Annual Symposium on Foundations of Computer Science (SFCS 1986);1986;Toronto Canada.","DOI":"10.1109\/SFCS.1986.25"},{"key":"e_1_2_10_11_1","doi-asserted-by":"publisher","DOI":"10.1007\/s00145-008-9036-8"},{"key":"e_1_2_10_12_1","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-48405-1_36"},{"key":"e_1_2_10_13_1","doi-asserted-by":"crossref","unstructured":"AsharovG LindellY SchneiderT ZohnerM.More efficient oblivious transfer and extensions for faster secure computation. Paper presented at: Proceedings of the 2013 ACM SIGSAC Conference on Computer & Communications Security (CCS '13);2013;Berlin Germany.","DOI":"10.1145\/2508859.2516738"},{"key":"e_1_2_10_14_1","doi-asserted-by":"crossref","unstructured":"YuanX WangX LinJ WangC.Privacy\u2010preserving deep packet inspection in outsourced middleboxes. Paper presented at: The 35th Annual IEEE International Conference on Computer Communications (IEEE INFOCOM 2016);2016;San Francisco CA.","DOI":"10.1109\/INFOCOM.2016.7524526"},{"key":"e_1_2_10_15_1","doi-asserted-by":"publisher","DOI":"10.1007\/3-540-48329-2_40"},{"key":"e_1_2_10_16_1","volume-title":"Applied Cryptography: Protocols, Algorithms, and Source Code in C","author":"Schneier B","year":"1996"},{"key":"e_1_2_10_17_1","doi-asserted-by":"publisher","DOI":"10.1109\/TNET.2007.896150"},{"key":"e_1_2_10_18_1","article-title":"CloudEyes: cloud\u2010based malware detection with reversible sketch for resource\u2010constrained internet of things (IoT) devices","author":"Sun H","year":"2016","journal-title":"Softw Pract Exper"},{"key":"e_1_2_10_19_1","doi-asserted-by":"crossref","unstructured":"KhakpourAR LiuAX.First step toward cloud\u2010based firewalling. Paper presented at: 2012 IEEE 31st Symposium on Reliable Distributed Systems;2012;Irvine CA.","DOI":"10.1109\/SRDS.2012.31"},{"key":"e_1_2_10_20_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.comnet.2006.06.015"},{"key":"e_1_2_10_21_1","unstructured":"ShiJ ZhangY ZhongS.Privacy\u2010preserving network functionality outsourcing. arXiv preprint arXiv:1502.00389;2015."},{"key":"e_1_2_10_22_1","doi-asserted-by":"publisher","DOI":"10.1145\/1355734.1355746"},{"key":"e_1_2_10_23_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-662-46800-5_1"},{"key":"e_1_2_10_24_1","doi-asserted-by":"crossref","unstructured":"MelisL AsgharHJ De\u00a0CristofaroE KaafarMA.Private processing of outsourced network functions: feasibility and constructions. Paper presented at: Proceedings of the 2016 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization;2016;New Orleans LA.","DOI":"10.1145\/2876019.2876021"},{"key":"e_1_2_10_25_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-540-24676-3_30"},{"key":"e_1_2_10_26_1","doi-asserted-by":"crossref","unstructured":"LinYH ShenSH YangMH YangDN ChenWT.Privacy\u2010preserving deep packet filtering over encrypted traffic in software\u2010defined networks. Paper presented at: 2016 IEEE International Conference on Communications (ICC);2016;Kuala Lumpur Malaysia.","DOI":"10.1109\/ICC.2016.7510993"},{"key":"e_1_2_10_27_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-59870-3_9"},{"key":"e_1_2_10_28_1","doi-asserted-by":"crossref","unstructured":"HuangLS RiceA EllingsenE JacksonC.Analyzing forged SSL certificates in the wild. Paper presented at: 2014 IEEE Symposium on Security and Privacy;2014; San Jose CA.","DOI":"10.1109\/SP.2014.13"},{"key":"e_1_2_10_29_1","unstructured":"LanC SherryJ PopaRA RatnasamyS LiuZ.Embark: securely outsourcing middleboxes to the cloud. Paper presented at: 13th USENIX Symposium on Networked Systems Design and Implementation (NSDI '16);2016; Santa Clara CA."},{"key":"e_1_2_10_30_1","doi-asserted-by":"publisher","DOI":"10.1109\/TC.2015.2512870"},{"key":"e_1_2_10_31_1","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2014.2366471"},{"key":"e_1_2_10_32_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cose.2017.08.007"},{"key":"e_1_2_10_33_1","first-page":"1","article-title":"Privacy\u2010preserving outsourced classification in cloud computing","author":"Li P","year":"2017","journal-title":"Clust Comput"},{"key":"e_1_2_10_34_1","doi-asserted-by":"publisher","DOI":"10.1561\/0400000002"},{"key":"e_1_2_10_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/TPDS.2010.206"},{"key":"e_1_2_10_36_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.ins.2015.03.070"},{"key":"e_1_2_10_37_1","unstructured":"Clam AntiVirus. Wikipedia: The Free Encyclopedia.https:\/\/en.wikipedia.org\/wiki\/Clam_AntiVirus. Accessed June 20 2017."},{"key":"e_1_2_10_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/SURV.2013.100913.00195"},{"key":"e_1_2_10_39_1","doi-asserted-by":"publisher","DOI":"10.1109\/TPDS.2012.250"},{"key":"e_1_2_10_40_1","doi-asserted-by":"publisher","DOI":"10.1109\/TC.2013.2295802"},{"key":"e_1_2_10_41_1","doi-asserted-by":"publisher","DOI":"10.1109\/COMST.2016.2615098"},{"key":"e_1_2_10_42_1","doi-asserted-by":"publisher","DOI":"10.1145\/360825.360855"}],"container-title":["Concurrency and Computation: Practice and Experience"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/api.wiley.com\/onlinelibrary\/tdm\/v1\/articles\/10.1002%2Fcpe.4435","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/pdf\/10.1002\/cpe.4435","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/full-xml\/10.1002\/cpe.4435","content-type":"application\/xml","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/pdf\/10.1002\/cpe.4435","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2023,9,2]],"date-time":"2023-09-02T14:56:39Z","timestamp":1693666599000},"score":1,"resource":{"primary":{"URL":"https:\/\/onlinelibrary.wiley.com\/doi\/10.1002\/cpe.4435"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2018,2,7]]},"references-count":41,"journal-issue":{"issue":"22","published-print":{"date-parts":[[2019,11,25]]}},"alternative-id":["10.1002\/cpe.4435"],"URL":"http:\/\/dx.doi.org\/10.1002\/cpe.4435","archive":["Portico"],"relation":{},"ISSN":["1532-0626","1532-0634"],"issn-type":[{"value":"1532-0626","type":"print"},{"value":"1532-0634","type":"electronic"}],"subject":[],"published":{"date-parts":[[2018,2,7]]}}}
