This thesis presents a detailed investigation into the use of Zero-Knowledge Proofs (ZKPs) within the QUIC protocol to enhance secure traffic validation in Function-as-a-Service (FaaS) environments. As cloud-based FaaS architectures become increasingly popular due to their flexibility, scalability, and efficiency, the need to ensure secure inter-service communication without exposing sensitive data is crucial. Traditional methods of traffic validation typically require decryption, which poses significant privacy and security risks by exposing potentially sensitive information to external systems. To address this, we propose a Zero-Knowledge Middlebox framework that inspects encrypted QUIC traffic using zk-SNARK (Zero-Knowledge Succinct Non-Interactive Argument of Knowledge) proofs to verify policy compliance without decrypting the actual data, thereby preserving the confidentiality of traffic. This work starts from the need to make the Zero-Knowledge Middlebox framework of Andreotti et al. compliant with the new QUIC Transport Protocol. In fact, this work focuses on the differences between the two implementations. The system design combines the xJsnark framework to translate security policies into Arithmetic Circuits with the aioquic Python library, which enables QUIC and HTTP 3 communications with the OpenFaaS platform. To make the Zero-Knowledge Middlebox framework work with QUIC it became necessary to bring some modifications. Client-side the library was modified in order to extract all the necessary handshake parameters to be used as input of the Arithmetic Circuits. Together with that also the Circuits have been modified: the decryption works differently in terms of Key Derivation Function and Record Layer organization of the Transport Layer; the match is applied on HTTP 3 headers that are encoded with the Huffman Encoding Scheme, meaning that the policy string is no more in pure text but is a string of bytes. At the Middlebox the packet capture software was completely renewed with respect to previous works to be able to reconstruct the QUIC Stream that was not supported. This allows the Middlebox to perform real-time verification of encrypted traffic, enforcing specific security policies while maintaining end-to-end encryption. Our implementation employs Groth16 zk-SNARK protocols to ensure efficient and non-interactive proof generation, enabling the Middlebox to verify traffic compliance in a minimally invasive manner. Through extensive testing on a dedicated hardware testbed, we analyze the system performance in terms of latency, computational load, and verification accuracy, with comparisons to existing security frameworks. Results indicate that integrating Zero-Knowledge Proofs into the QUIC protocol is both feasible and effective, achieving verification tasks with moderate impact on latency with respect to HTTP 1.1. However, the computational requirements of zk-SNARKs introduce some performance trade-offs, particularly on lower-powered devices, underscoring the need for optimization in resource-constrained environments. For example, because of the design of QUIC, the fields that represent integer values are dynamically encoded, which leads to a trade-off between flexibility and complexity. In some special cases, this flexibility can be reduced in order to make the Circuits less complex and faster, reducing latency. The best trade-off is reached when decrypting only the number of bytes equal to the policy string length of the HTTP 3 Request. Ultimately, this research demonstrates a viable approach to secure and privacy-preserving traffic validation in encrypted FaaS communications, providing a framework that aligns with modern cloud security standards. This work contributes to the foundational knowledge required for further advancements in secure cloud communication and offers insights into future research directions that may explore more efficient Zero-Knowledge algorithms or alternative cryptographic solutions.
Questa tesi presenta un'indagine dettagliata sull'uso delle dimostrazioni a conoscenza zero (Zero-Knowledge Proofs, ZKP) all'interno del protocollo QUIC per migliorare la validazione sicura del traffico in ambienti Function-as-a-Service (FaaS). Con l’aumento della popolarità delle architetture FaaS basate su cloud per la loro flessibilità, scalabilità ed efficienza, diventa essenziale garantire comunicazioni inter-servizi sicure senza esporre dati sensibili. I metodi tradizionali di validazione del traffico richiedono solitamente la decifratura, esponendo così informazioni potenzialmente sensibili a sistemi esterni e comportando rischi per la privacy e la sicurezza. Per affrontare questo problema, proponiamo un framework di Middlebox a conoscenza zero che ispeziona il traffico QUIC crittografato utilizzando zk-SNARK (Zero-Knowledge Succinct Non-Interactive Argument of Knowledge) per verificare la conformità alle politiche di sicurezza senza decifrare i dati, preservando così la riservatezza del traffico. Questo lavoro prende le mosse dalla necessità di rendere il framework di Middlebox a conoscenza zero di Andreotti et al. compatibile con il nuovo protocollo di trasporto QUIC. Infatti, questo studio si concentra sulle differenze tra le due implementazioni. Il sistema combina il framework xJsnark per tradurre le politiche di sicurezza in circuiti aritmetici con la libreria Python aioquic, che abilita le comunicazioni QUIC e HTTP 3 con la piattaforma OpenFaaS. Per adattare il framework di Middlebox a conoscenza zero al protocollo QUIC, sono state necessarie alcune modifiche. Sul lato Client, la libreria è stata modificata per estrarre tutti i parametri di handshake necessari da utilizzare come input per i circuiti aritmetici. Oltre a questo, i circuiti sono stati modificati: la decifratura funziona in modo diverso in termini di funzione di derivazione della chiave (Key Derivation Function) e organizzazione dei Record Layer del livello di trasporto; la corrispondenza viene applicata agli header HTTP 3, che sono codificati con il sistema di codifica Huffman, il che significa che la stringa della regola non è più in testo, ma è rappresentata come una stringa di byte. Al Middlebox, il software di cattura dei pacchetti è stato completamente rinnovato rispetto ai lavori precedenti per supportare la ricostruzione del flusso QUIC. Questo consente al Middlebox di effettuare verifiche in tempo reale del traffico crittografato, applicando specifiche politiche di sicurezza pur mantenendo la crittografia end-to-end. La nostra implementazione utilizza i protocolli zk-SNARK Groth16 per garantire una generazione di prove efficiente e non interattiva, permettendo al Middlebox di verificare la conformità del traffico in modo poco invasivo. Attraverso test su un banco di prova hardware dedicato, analizziamo le prestazioni del sistema in termini di latenza, carico computazionale e precisione della verifica, confrontandole con i framework di sicurezza esistenti. I risultati indicano che l'integrazione delle dimostrazioni a conoscenza zero nel protocollo QUIC è sia fattibile sia efficace, permettendo di svolgere attività di verifica con un impatto moderato sulla latenza rispetto a HTTP 1.1. Tuttavia, i requisiti computazionali degli zk-SNARK introducono alcuni compromessi di prestazione, in particolare su dispositivi meno potenti, sottolineando la necessità di ottimizzazione in ambienti con risorse limitate. Ad esempio, a causa del design di QUIC, i campi che rappresentano valori interi sono codificati dinamicamente, il che porta a un compromesso tra flessibilità e complessità. In alcuni casi particolari, questa flessibilità può essere ridotta per rendere i circuiti meno complessi e più veloci, riducendo la latenza. Il miglior compromesso viene raggiunto decifrando solo il numero di byte pari alla lunghezza della stringa della regola della richiesta HTTP 3. In definitiva, questa ricerca dimostra un approccio valido per una validazione del traffico sicura e rispettosa della privacy nelle comunicazioni FaaS crittografate, fornendo un framework che è in linea con gli standard moderni di sicurezza nel cloud. Questo lavoro contribuisce alla conoscenza di base necessaria per ulteriori progressi nelle comunicazioni cloud sicure e offre spunti per future direzioni di ricerca che potrebbero esplorare algoritmi di conoscenza zero più efficienti o soluzioni crittografiche alternative.
A zero-knowledge middlebox for secure FaaS using
Kubler, Filippo
2023/2024
Abstract
This thesis presents a detailed investigation into the use of Zero-Knowledge Proofs (ZKPs) within the QUIC protocol to enhance secure traffic validation in Function-as-a-Service (FaaS) environments. As cloud-based FaaS architectures become increasingly popular due to their flexibility, scalability, and efficiency, the need to ensure secure inter-service communication without exposing sensitive data is crucial. Traditional methods of traffic validation typically require decryption, which poses significant privacy and security risks by exposing potentially sensitive information to external systems. To address this, we propose a Zero-Knowledge Middlebox framework that inspects encrypted QUIC traffic using zk-SNARK (Zero-Knowledge Succinct Non-Interactive Argument of Knowledge) proofs to verify policy compliance without decrypting the actual data, thereby preserving the confidentiality of traffic. This work starts from the need to make the Zero-Knowledge Middlebox framework of Andreotti et al. compliant with the new QUIC Transport Protocol. In fact, this work focuses on the differences between the two implementations. The system design combines the xJsnark framework to translate security policies into Arithmetic Circuits with the aioquic Python library, which enables QUIC and HTTP 3 communications with the OpenFaaS platform. To make the Zero-Knowledge Middlebox framework work with QUIC it became necessary to bring some modifications. Client-side the library was modified in order to extract all the necessary handshake parameters to be used as input of the Arithmetic Circuits. Together with that also the Circuits have been modified: the decryption works differently in terms of Key Derivation Function and Record Layer organization of the Transport Layer; the match is applied on HTTP 3 headers that are encoded with the Huffman Encoding Scheme, meaning that the policy string is no more in pure text but is a string of bytes. At the Middlebox the packet capture software was completely renewed with respect to previous works to be able to reconstruct the QUIC Stream that was not supported. This allows the Middlebox to perform real-time verification of encrypted traffic, enforcing specific security policies while maintaining end-to-end encryption. Our implementation employs Groth16 zk-SNARK protocols to ensure efficient and non-interactive proof generation, enabling the Middlebox to verify traffic compliance in a minimally invasive manner. Through extensive testing on a dedicated hardware testbed, we analyze the system performance in terms of latency, computational load, and verification accuracy, with comparisons to existing security frameworks. Results indicate that integrating Zero-Knowledge Proofs into the QUIC protocol is both feasible and effective, achieving verification tasks with moderate impact on latency with respect to HTTP 1.1. However, the computational requirements of zk-SNARKs introduce some performance trade-offs, particularly on lower-powered devices, underscoring the need for optimization in resource-constrained environments. For example, because of the design of QUIC, the fields that represent integer values are dynamically encoded, which leads to a trade-off between flexibility and complexity. In some special cases, this flexibility can be reduced in order to make the Circuits less complex and faster, reducing latency. The best trade-off is reached when decrypting only the number of bytes equal to the policy string length of the HTTP 3 Request. Ultimately, this research demonstrates a viable approach to secure and privacy-preserving traffic validation in encrypted FaaS communications, providing a framework that aligns with modern cloud security standards. This work contributes to the foundational knowledge required for further advancements in secure cloud communication and offers insights into future research directions that may explore more efficient Zero-Knowledge algorithms or alternative cryptographic solutions.| File | Dimensione | Formato | |
|---|---|---|---|
|
2024_11_Kubler_Summary_02.pdf
accessibile in internet solo dagli utenti autorizzati
Descrizione: Executive Summary
Dimensione
716.97 kB
Formato
Adobe PDF
|
716.97 kB | Adobe PDF | Visualizza/Apri |
|
2024_11_Kubler_Thesis_01.pdf
accessibile in internet solo dagli utenti autorizzati
Descrizione: Thesis
Dimensione
1.47 MB
Formato
Adobe PDF
|
1.47 MB | Adobe PDF | Visualizza/Apri |
I documenti in POLITesi sono protetti da copyright e tutti i diritti sono riservati, salvo diversa indicazione.
https://hdl.handle.net/10589/231587