PhantomBox: Fully Homomorphic Web Application Firewall

Abstract

Web Application Firewalls (WAFs) defend against malicious traffic by inspecting application payloads against regular expression (RegEx) rulesets. Because ruleset maintenance requires specialized expertise, operators typically delegate WAF functionality to third-party middleboxes, which cannot inspect encrypted traffic without access to the secret keys. Prior privacy-preserving WAFs sacrifice either RegEx expressiveness, third-party offloading, or communication costs. Fully Homomorphic Encryption (FHE) can evaluate RegEx on encrypted traffic, but thousand-fold ciphertext expansion and seconds-per-character compute costs have kept FHE-based WAFs unrealistic.

We present PhantomBox, an FHE-based WAF that co-designs the datapath from client-side encryption through middlebox rule compilation and execution. To mitigate the compute bottleneck, PhantomBox introduces a novel ahead-of-time RegEx compiler with two FHE-specific optimizations: Fast Literal Matching and Boolean Fusion. The compiler also exploits equality saturation to further harness the optimizations. To overcome network overhead, PhantomBox employs hardware-accelerated transciphering, keeping on-wire size comparable to plaintext, while achieving 76× speedup over CPU. Evaluated on the Proofpoint ruleset with over 5,800 web-attack signatures, PhantomBox achieves a median evaluation latency of 7.7ms on an AWS EC2 F2 instance. PhantomBox is the first system to make FHE-based WAF practical for real-world deployment, achieving full RegEx expressiveness, middlebox offloading, and cryptographic privacy simultaneously.