Oblivious Inspection: On the Confrontation between System Security and Data Privacy at Domain Boundaries

Sancho, J. (Universidad de Zaragoza) ; García, J. (Universidad de Zaragoza) ; Alesanco, Á. (Universidad de Zaragoza)

Resumen: In this work, we introduce the system boundary security vs. privacy dilemma, where border devices (e.g., firewall devices) require unencrypted data inspection to prevent data exfiltration or unauthorized data accesses, but unencrypted data inspection violates data privacy. To shortcut this problem, we present Oblivious Inspection, a novel approach based on garbled circuits to perform a stateful application-aware inspection of encrypted network traffic in a privacy-preserving way. We also showcase an inspection algorithm for Fast Healthcare Interoperability Resources (FHIR) standard compliant packets along with its performance results. The results point out the importance of the inspection function being aligned with the underlying garbled circuit protocol. In this line, mandatory encryption algorithms for TLS 1.3 have been analysed observing that packets encrypted using Chacha20 can be filtered up to 17 and 25 times faster compared with AES128-GCM and AES256-GCM, respectively. All together, this approach penalizes performance to align system security and data privacy, but it could be appropriate for those scenarios where this performance degradation can be justified by the sensibility of the involved data such as healthcare scenarios.

Idioma: Inglés

DOI: 10.1155/2020/8856379

Año: 2020

Publicado en: SECURITY AND COMMUNICATION NETWORKS 2020 (2020), 8856379 [9 pp]
ISSN: 1939-0114

Factor impacto JCR: 1.791 (2020)

Categ. JCR: TELECOMMUNICATIONS rank: 71 / 91 = 0.78 (2020) - Q4 - T3
Categ. JCR: COMPUTER SCIENCE, INFORMATION SYSTEMS rank: 125 / 162 = 0.772 (2020) - Q4 - T3

Factor impacto SCIMAGO: 0.446 - Information Systems (Q2) - Computer Networks and Communications (Q2)

Financiación: info:eu-repo/grantAgreement/ES/DGA-FEDER/T31-20R
Financiación: info:eu-repo/grantAgreement/ES/DGA-MECD/FPU15-04841
Financiación: info:eu-repo/grantAgreement/ES/MINECO-FEDER/TIN2016-76770-R

Tipo y forma: Artículo (Versión definitiva)

Área (Departamento): Área Ingeniería Telemática (Dpto. Ingeniería Electrón.Com.)