Don't Yank My Chain: Auditable NF Service Chaining
summary
AuditBox is a deployed system that uses trusted execution environments (Intel SGX enclaves) plus a per-NF verification shim to produce continuous, provable auditing and sampled offline logs. Each packet carries an audit trailer (packet id, source NF id, destination NF id, tag MAC) signed with a symmetric per-chain key; an update-forgmac optimization reuses prior MACs so second-MAC cost scales with modified blocks, not packet length. Evaluation shows 72–80% fewer bytes per-packet overhead (5-hop chains), 61–67% higher goodput than prior VRPs, and >18 Gbps for a 3-NF chain under realistic DPI workloads.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:31Virtualization
- 1:04Cloud
- 2:26Auditbox
- 4:04Verify Internet Process
- 4:56Audit Box
- 6:29Threat Model
- 9:26Audit Trailer
- 10:34Update 4G
- 11:32Evaluation
- 11:49Results
- 12:30Summary
related talks
21mCorrectness and Performance for Stateful Chained Network Functions
35mChains of trust in Confidential Computing
24mMetron: NFV Service Chains at the True Speed of the Underlying Hardware
15mAutomated Verification of Network Function Binaries
26mPerformance Contracts for Software Network Functions
43mThe Chain of Command: Building Trust Across Public Sector Software Pipelines
09mWhy Institutional Custody Breaks on Shielded Chains
25mPractical Accountability of Secret Processes