Please enable JavaScript.
Coggle requires JavaScript to display documents.
TEE, Reference:, Y. Sun, D. Marino, S.K. Nanda, S. Shintra, B.T. Witten, R…
TEE
Final Thoughts
It is also one of the innovations citing BlindBox, probably to have more freedom in inspecting the encrypted payloads the authors created an isolated environment for DPI to freely check detected traffic without compromising the security of customer's privacy.
No evaluation was included in this paper probably because it is a patent paper, but according to the process flow it seems like there will be a large amount of delay since after kernel application is done with inspecting, that is the only time the encrypted network traffic, either modified or original, will be forwarded to the receiver.
The idea of using non-transitory media in the TEE is great since it can somehow provide peace of mind that decrypted network traffic is not stored for a long time.
Architecture
Workflow
5) Kernel application will inspect decrypted network traffic using the Sensitivity Policy
6) Depending if the decrypted network traffic is sensitive it will redact the information and will forward the now filtered decrypted data
4) Kernel application will use the symmetric session key to decrypt encrypted network traffic
7) Logic Application will further process the filtered decrypted data
3) Sender will include symmetric session key in the encrypted network session
8) Kernel application will record the the details regarding the decrypted network traffic and can forward the logs to the sender or receiver for their auditing.
2) Sender and receiver will establish encrypted network session between them
1) Trusted Execution Environment (TEE) will provide attestation to both sender and receiver that it is authentic.
Inside the Middlebox
Logic Application
Depending on the configuration, Logic Application can modify the decrypted data or perform other actions regarding the decrypted data
Inside TEE
Sensitivity Policy
Set of rules to identify the sensitive data
Log
TEE stores logs of the filtered decrypted data
It also monitors the accessing of logs, who and when it was accessed this is to provide logon details if ever there is malicious insider
Kernel Application
Handles the decryption, the loading and matching of Sensitivity Policy, taking actions to filter sensitive data once there is match
GOAL
To have a computer-implemented method wherein middlebox can decrypt an encrypted network traffic in a trusted environment and ensuring no sensitive data leakage outside the trusted environment
PROBLEM
Allowing middleboxes to decrypt network traffic being vulnerable to exposing sensitive data, not only from attackers, but also malicious insiders like network administrators.
Reference:
Y. Sun, D. Marino, S.K. Nanda, S. Shintra, B.T. Witten, R.A. Frederick, Q. Li, "Decrypting Network Traffic on a Middlebox Device Using a Trusted Execution Environment", Symantec Corp, US10044681B1, February 2018.