基于前缀保持加密的网络功能外包系统

doi:10.11959/j.issn.1000-436x.2018057

通信学报 ›› 2018, Vol. 39 ›› Issue (4): 159-166.doi: 10.11959/j.issn.1000-436x.2018057

基于前缀保持加密的网络功能外包系统

魏凌波^1,²,冯晓兵¹,张驰^1,²,盛化龙¹,俞能海¹

¹ 中国科学技术大学信息科学技术学院中国科学院电磁空间信息重点实验室，安徽合肥 230026
² 中国科学院信息工程研究所信息安全国家重点实验室，北京 100093

出版日期:2018-04-01 发布日期:2018-04-29
作者简介:魏凌波（1979-），女，陕西周至人，博士，中国科学技术大学副研究员，主要研究方向为应用密码学。|冯晓兵（1992-），女，山东聊城人，中国科学技术大学硕士生，主要研究方向为网络安全。|张驰（1977-），男，湖北武汉人，博士，中国科学技术大学副教授，主要研究方向为无线网络与网络安全。|盛化龙（1991-），男，安徽阜阳人，中国科学技术大学硕士生，主要研究方向为网络安全。|俞能海（1964-），男，安徽无为人，中国科学技术大学教授，主要研究方向为多媒体数据处理与分析、数字内容安全。
基金资助:
国家重点研发计划基金资助项目(2017YFB0802200);国家自然科学基金资助项目(61702474)

Network function outsourcing system based on prefix-preserving encryption

Lingbo WEI^1,²,Xiaobing FENG¹,Chi ZHANG^1,²,Hualong SHENG¹,Nenghai YU¹

¹ CAS Key Laboratory of Electromagnetic Space Information,School of Information Science and Technology,University of Science and Technology of China,Hefei 230026,China
² State Key Laboratory of Information Security,Institute of Information Engineering,Chinese Academy of Sciences,Beijing 100093,China

Online:2018-04-01 Published:2018-04-29
Supported by:
The National Key Research and Development Program of China(2017YFB0802200);The National Natural Science Foundation of China(61702474)

摘要/Abstract

摘要：

基于硬件中间盒实现的网络功能成本高且可扩展性差等问题，越来越多的企业用户将网络功能的实现外包给云服务商。现有的网络功能外包方案要求用户对云服商公开通信流量和网络功能策略，暴露了用户内网的私密信息。基于轻量级的前缀保持加密方案，提出一种保护隐私的网络功能外包系统。与现有同类方案相比，该系统不仅为企业用户同时实现了通信流量与网络功能策略的隐私保护，而且具有更高的吞吐量和更低的时延。

关键词: 网络功能外包, 云计算, 前缀保持加密, 隐私保护

Abstract:

Due to the problem of high cost and limited scalability of dedicated hardware middleboxes,it is popular for enterprises to outsource middleboxes as software processes to the cloud service provider.In the current network function outsourcing schemes,the cloud service provider requires the enterprise’s communication traffic and network strategy which poses a serious threat to the enterprise’s piracy.Based on prefix-preserving encryption,a privacy preserving network function outsourcing system was proposed.Compared with other similar schemes,the system not only realizes the privacy protection of communication traffic,but also has higher throughput and lower delay.

Key words: network function outsourcing, cloud computing, prefix-preserving encryption, privacy preserving

中图分类号:

TP393

魏凌波,冯晓兵,张驰,盛化龙,俞能海. 基于前缀保持加密的网络功能外包系统[J]. 通信学报, 2018, 39(4): 159-166.

Lingbo WEI,Xiaobing FENG,Chi ZHANG,Hualong SHENG,Nenghai YU. Network function outsourcing system based on prefix-preserving encryption[J]. Journal on Communications, 2018, 39(4): 159-166.

图/表 8

图1

图2

图3

图4

图5

图6

图7

图8

参考文献 17

[1]	于强, 霍红卫 . 一组提高存储效率的深度包检测算法[J]. 软件学报, 2011,22(1): 149-163.
	YU Q , HUO H W . Algorithms improving the storage efficiency of deep packet inspection[J]. Journal of Software, 2011,22(1): 149-163.
[2]	袁泉, 汤红波, 黄开枝 ,等. 基于Q-learning算法的vEPC虚拟网络功能部署方法[J]. 通信学报, 2017,38(8): 172-182.
	YUAN Q , TANG H B , HUANG K Z ,et al. Deployment method for vEPC virtualized network function via Q-learning[J]. Journal on Communications, 2017,38(8): 172-182.
[3]	XU J , FAN J , AMMAR M H ,et al. Prefix-preserving IP address anonymization:measurement-based security evaluation and a new cryptography-based scheme[C]// 10th IEEE International Conference on Network Protocols. 2002: 280-289.
[4]	SHERRY J , HASAN S , SCOTT C ,et al. Making middleboxes someone else's problem:network processing as a cloud service[J]. ACM SIGCOMM Computer Communication Review, 2012,42(4): 13-24.
[5]	GIBB G , ZENG H , MCKEOWN N . Outsourcing network functionality[C]// The First Workshop on Hot Topics in Software Defined Networks. 2012: 73-78.
[6]	KHAKPOUR A R , LIU A X . First step toward cloud-based fire-walling[C]// 2012 IEEE 31st Sym-posium on Reliable Distributed Systems (SRDS). 2012: 41-50.
[7]	KUREK T , NIEMIEC M , LASON A . Taking back control of privacy:a novel framework for preserving cloud-based firewall policy confidentiality[J]. International Journal of Information Security, 2016,15(3): 235-250.
[8]	SHI J , ZHANG Y , ZHONG S . Privacy-preserving network functionality outsourcing[J]. arXiv preprint,arXiv:1502.00389, 2015.
[9]	CORON J S , LEPOINT T , TIBOUCHI M . Practical multilinear maps over the integers[M]// Advances in Cryptology–CRYPTO. 2013: 476-493.
[10]	CHEON J H , HAN K , LEE C ,et al. Cryptanalysis of the multilinear map over the integers[M]// Advances in Cryptology–EUROCRYPT, 2015: 3-12.
[11]	MELIS L , ASGHAR H J , DE CRISTOFARO E ,et al. Private processing of outsourced network functions:feasibility and constructions[C]// The 2016 ACM International Workshop on Security in Software Defined Networks ＆ Network Function Virtualization. 2016: 39-44.
[12]	SHERRY J , LAN C , POPA R A ,et al. Blindbox:deep packet inspection over encrypted traffic[J]. ACM SIGCOMM Computer Communication Review, 2015,45(4): 213-226.
[13]	LAN C , SHERRY J , POPA R A ,et al. Embark:securely outsourcing middle-boxes to the cloud[C]// 13th USENIX Symposium on Networked Systems Design and Implementation (NSDI 16). 2016: 255-273.
[14]	ASGHAR H J , MELIS L , SOLDANI C ,et al. SplitBox:toward efficient private network function virtualization[C]// The Workshop on Hot Topics in Middleboxes and Network Function Virtualization. 2016: 7-13.
[15]	MATT B . Introduction to computer security[M]. Pearson Education India, 2006.
[16]	WANG C , CHOW S S M , WANG Q ,et al. Privacy-preserving public auditing for secure cloud storage[J]. IEEE transactions on computers, 2013,62(2): 362-375.
[17]	DAEMEN J , RIJMEN V . The design of Rijndael:AES-the advanced encryption standard[M]. Springer Science ＆ Business Media, 2013.

基于前缀保持加密的网络功能外包系统

Network function outsourcing system based on prefix-preserving encryption

在线阅读

PDF下载

可视化

摘要/Abstract

引用本文

使用本文

图/表 8

参考文献 17

相关文章 15

Metrics

推荐阅读 0

[1]	马玲, 樊漆亮, 许婷, 郭冠琛, 张圣林, 孙永谦, 张玉志. 基于强化学习的在线离线混部云环境下的调度框架[J]. 通信学报, 2023, 44(6): 90-102.
[2]	马鑫迪, 李清华, 姜奇, 马卓, 高胜, 田有亮, 马建峰. 面向Non-IID数据的拜占庭鲁棒联邦学习[J]. 通信学报, 2023, 44(6): 138-153.
[3]	冯涛, 陈李秋, 方君丽, 石建明. 基于本地化差分隐私和属性基可搜索加密的区块链数据共享方案[J]. 通信学报, 2023, 44(5): 224-233.
[4]	夏莹杰, 朱思雨, 刘雪娇. 区块链架构下具有条件隐私的车辆编队跨信任域高效群组认证研究[J]. 通信学报, 2023, 44(4): 111-123.
[5]	胡柏吉, 张晓娟, 李元诚, 赖荣鑫. 支持多功能的V2G网络隐私保护数据聚合方案[J]. 通信学报, 2023, 44(4): 187-200.
[6]	徐明, 张保俊, 伍益明, 应晨铎, 郑宁. 面向网络攻击和隐私保护的多智能体系统分布式共识算法[J]. 通信学报, 2023, 44(3): 117-127.
[7]	余晟兴, 陈钟. 基于同态加密的高效安全联邦学习聚合框架[J]. 通信学报, 2023, 44(1): 14-28.
[8]	张学旺, 黎志鸿, 林金朝. 基于公平盲签名和分级加密的联盟链隐私保护方案[J]. 通信学报, 2022, 43(8): 131-141.
[9]	王继锋, 王国峰. 边缘计算模式下密文搜索与共享技术研究[J]. 通信学报, 2022, 43(4): 227-238.
[10]	封化民, 史瑞, 袁峰, 李艳俊, 杨旸. 高效的强隐私保护和可转让的属性票据方案[J]. 通信学报, 2022, 43(3): 63-75.
[11]	于海宁, 张宏莉, 余翔湛, 曲家兴, 葛蒙蒙. 隐私保护的轨迹相似度计算方法[J]. 通信学报, 2022, 43(11): 1-13.
[12]	彭滔, 钟文韬, 王国军, 罗恩韬, 熊金波, 刘忆宁, Hao Wang. 移动社交网络中面向隐私保护的精确好友匹配[J]. 通信学报, 2022, 43(11): 90-103.
[13]	史瑞, 封化民, 谢惠琴, 史国振, 刘飚, 杨旸. 基于带智能卡的移动终端实现的隐私保护的属性票据方案[J]. 通信学报, 2022, 43(10): 26-41.
[14]	熊金波, 周永洁, 毕仁万, 万良, 田有亮. 边缘协同的轻量级隐私保护分类框架[J]. 通信学报, 2022, 43(1): 127-137.
[15]	晏燕, 丛一鸣, Adnan Mahmood, 盛权政. 基于深度学习的位置大数据统计发布与隐私保护方法[J]. 通信学报, 2022, 43(1): 203-216.