NetCloak: Dynamic Topology Expansion for Secure and Scalable Configuration Sharing
Qianye Wang, Yuejie Wang, Yongting Chen, Guyue Liu
TL;DR
NetCloak tackles the privacy risks of sharing network configurations by not only obfuscating topology but also preserving functional routing. It introduces graph-embedding-based topology expansion coupled with strong $k$-Degree Mapping Anonymity to hide true scale while maintaining realism, and a mimicry-driven configuration generator to preserve command style and routing policies. A layered SMT-and-iterative repair framework then restores protocol-correct routing under OSPF and BGP, ensuring functional equivalence. Empirical results on real and emulated networks show substantial gains in topology rationality, configuration fidelity, and repair efficiency, enabling safer, scalable configuration sharing without compromising routing behavior.
Abstract
As modern networks continue to grow in both scale and complexity, sharing real-world device configurations poses significant privacy risks, especially when adversaries can infer organizational size or resource distribution from topology data. We present NetCloak, a configuration anonymization framework that adaptively injects synthetic routers and hosts into the network graph to obfuscate true scale, while preserving end-to-end forwarding behavior. NetCloak core techniques include: (1) a graph-embedding expansion algorithm that integrates the original topology into a larger reference graph, ensuring added nodes blend seamlessly with real ones; (2) a k-degree mapping anonymity scheme that selectively adds minimal links to guarantee each original node degree is indistinguishable among at least k peers; (3) a mimicry-driven configuration generator that derives command templates from existing devices, preserving command ordering, naming conventions, and routing policies; and (4) a layered repair process combining SMT-based intra-AS route synthesis with iterative inter-AS filter insertion to restore protocol-correct routing under OSPF and BGP. Extensive experiments on real and emulated campus and data-center topologies demonstrate that NetCloak effectively conceals network size, improving topological rationality by over 70% and configuration fidelity by nearly 30% compared to baseline methods, while reducing route-repair overhead by more than 50% under randomized link costs. NetCloak thus enables safe, privacy-preserving configuration sharing at scale.