Efficient Privacy-Preserving Network Path Validation

Path validation in computer networks is used to enforce and verify data forwarding rules across network slices and administrative domains to satisfy specific service level requirements. Deviating from pre-established paths has the potential to downgrade network service quality, increase attack surface area, and disrupt network orchestration capabilities. Network operators regard the network infrastructure and topology as sensitive. This necessitates the need for privacy-preserving path validation techniques that leak minimal information about the overall network path to individual infrastructure owners. We present the design of a decentralized privacy-preserving path validation protocol using Non-Interactive Zero-Knowledge (NIZK) proofs to provide provable path privacy guarantees. The NIZK-based pairwise validation design identifies individual slice nodes that deviate from the prescribed path. Deploying this lightweight protocol periodically enables individual nodes to enforce and validate the network control path. We have implemented and evaluated our system on a testbed simulating a multi-authority network. Our results demonstrate the feasibility of preserving path privacy as well as the practicality of our proposed protocols for next-generation multi-authority sliced networks.