  Since the advent of software defined networks ({SDN}), there have been many
attempts to outsource the complex and costly local network functionality, i.e.
the middlebox, to the cloud in the same way as outsourcing computation and
storage. The privacy issues, however, may thwart the enterprises' willingness
to adopt this innovation since the underlying configurations of these
middleboxes may leak crucial and confidential information which can be utilized
by attackers. To address this new problem, we use firewall as an sample
functionality and propose the first privacy preserving outsourcing framework
and schemes in SDN. The basic technique that we exploit is a ground-breaking
tool in cryptography, the \textit{cryptographic multilinear map}. In contrast
to the infeasibility in efficiency if a naive approach is adopted, we devise
practical schemes that can outsource the middlebox as a blackbox after
\textit{obfuscating} it such that the cloud provider can efficiently perform
the same functionality without knowing its underlying private configurations.
Both theoretical analysis and experiments on real-world firewall rules
demonstrate that our schemes are secure, accurate, and practical.
