Techniques for policy enforcement on encrypted network traffic

Most large-scale data communication networks are built from multiple autonomous subnetworks, which are managed by different administrative entities. In many practical environments, information about traffic policies is considered proprietary and is not disclosed by network operators. However, some operational scenarios require routers within a network to check if traffic matches a particular policy that is provided by another entity. In our work, we present several algorithms of how to represent policy databases and how to perform policy checks without explicitly disclosing the total set of policies. This privacy-preserving set operation extends related work, which has assumed that parties trust each other. Our analysis shows that the proposed policy checks can be implemented efficiently in realistic systems.