Middleboxes for Validation of Encrypted FaaS Requests: TLMSP vs Delegated Credentials

The widespread adoption of TLS has significantly enhanced the end-to-end security of client-server communications, at the price of making security middleboxes incapable of performing deep packet inspection and less effective. This paper compares two recent protocols that received attention in the industry that make it possible for middleboxes to read packet content with the supervision of the server: the Transport Layer Middlebox Security Protocol (TLMSP), standardized by ETSI, and the Delegated Credentials (DC) extension of TLS, standardized by IETF. The former solution allows fine-grained access control to the payload, but requires modifications to the TLS client, hampering its adoption. The latter solution gives limited-time full plaintext access to the middlebox without the server's supervision, but without leaking the server's private keys, making its adoption easier. We integrated our mechanism for policy-checking FaaS requests into publicly available implementations of those protocols and extensively evaluated the performance of both solutions identifying the additional latency components. Results show that the latency added by TLMSP is orders of magnitude higher than the baseline. On the other hand, we observed that DC additional latency is comparable to the baseline, making the latter solution suitable for deployment.