Function-as-a-Service (FaaS) platforms enable developers to build event-driven applications by composing lightweight functions into complex workflows. Many such workflows process sensitive data, raising confidentiality risks from untrusted cloud providers and compromised infrastructure. Existing confidential FaaS systems mitigate these risks with secure hardware enclaves (e.g., Intel SGX) but still depend on a trusted key-provisioning enclave for autoscaling, creating a single point of compromise.

Oblivious DNS over HTTPS (ODoH) enhances DNS privacy by routing queries through a proxy so that no single party can link a client's IP address with its DNS queries. However, because ODoH encrypts each query individually, the proxy cannot cache responses. We present CODoH (Cacheable Oblivious DNS over HTTPS), a cacheable extension to ODoH that reduces DNS resolution latency while preserving ODoH's separation of knowledge. CODoH places a proxy-side cache inside a trusted execution environment--namely, an Intel SGX enclave--and uses end-to-end encryption to ensure that the proxy never learns plaintext queries or cached responses. To prevent caching from becoming a new inference surface, CODoH defends against cache-state probing and set-difference (bracketing) attacks with (i) cover responses supplied by the resolver, (ii) batched cache updates that mix many clients' inserts, and (iii) an oblivious RAM (ORAM) backend that hides cache access patterns. CODoH also enforces correctness and freshness of cached records via resolver authorization and replay protection. We implement CODoH as CoreDNS extensions and evaluate it on an Azure SGX testbed. CODoH reduces median latency by 2.7x over ODoH on cache hits (18.0 vs. 48.0 ms) and by 2.2x under Zipf traffic (22.3 vs. 48.6 ms), with under 1 ms of SGX overhead.

Although cloud providers offer many options for encrypting object storage and rotating the encryption key, the cloud ultimately possesses the key, leaving data vulnerable to insider attacks, legal demands, and storage bugs. Moreover, current key rotation methods do not re-encrypt existing objects, exposing the data indefinitely to adversaries with stolen keys. This paper introduces Akeso, the first cloud storage system to achieve post-compromise security, thus restoring data confidentiality after a key compromise. For efficient key rotation, Akeso adapts the asynchronous group key agreement protocols of messaging applications to storage clients. For scalable object re-encryption, Akeso makes novel use of a cloud-side enclave to coordinate an updatable encryption scheme among untrusted cloud functions. Our evaluations demonstrate that Akeso re-encrypts a 10 GB bucket 2.5× faster than a naïve method that fetches and re-encrypts each object, with a monthly expense that is only 15.6–19.3% higher than the current, less secure, provider encryption options.

Tor is a powerful and important tool for providing anonymity and censorship resistance to users around the world. Yet it is surprisingly difficult to deploy new services in Tor—it is largely relegated to proxies and hidden services—or to nimbly react to new forms of attack. Conversely, “non-anonymous” Internet services are thriving like never before because of recent advances in programmable networks, such as Network Function Virtualization (NFV) which provides programmable in-network middleboxes.

Tor is a powerful and important tool for providing anonymity and censorship resistance to users around the world. Yet it is surprisingly difficult to deploy new services in Tor---it is largely relegated to proxies and hidden services---or to nimbly react to new forms of attack. Conversely, "non-anonymous" Internet services are thriving like never before because of recent advances in programmable networks, such as Network Function Virtualization (NFV) which provides programmable in-network middleboxes.