SSL Splitting Christopher Lesniewski-Laas and M. Frans Kaashoek { - - PowerPoint PPT Presentation

▶
ssl splitting
SMART_READER_LITE
LIVE PREVIEW

SSL Splitting Christopher Lesniewski-Laas and M. Frans Kaashoek { - - PowerPoint PPT Presentation

Mar 07, 2024 452 likes •812 views

SSL Splitting Christopher Lesniewski-Laas and M. Frans Kaashoek { ctl,kaashoek } @mit.edu MIT LCS USENIX Security 2003 p. Bandwidth Offloading Server mypenguin.org (DSL) Mirror mirrors.kernel.org (OC12) Client Client GET

slide-1
SLIDE 1

SSL Splitting

Christopher Lesniewski-Laas and M. Frans Kaashoek

{ctl,kaashoek}@mit.edu

MIT LCS

USENIX Security 2003 – p.

slide-2
SLIDE 2

Bandwidth Offloading

‘GET /tux.png’

Client Client Server Mirror

mirrors.kernel.org mypenguin.org

(DSL) (OC12)

USENIX Security 2003 – p.

slide-3
SLIDE 3

Bandwidth Offloading

‘GET /tux.png’

Client

daemonporn.com

Mirror Client Client Server Mirror

mirrors.kernel.org mypenguin.org

(DSL) (OC12)

USENIX Security 2003 – p.

slide-4
SLIDE 4

Secure Bandwidth Offloading

σ σ σ = Sign(tux.png)

‘GET /tux.png’

Client

daemonporn.com

Mirror Client Client Server Mirror

mirrors.kernel.org mypenguin.org

(DSL) (OC12)

USENIX Security 2003 – p.

slide-5
SLIDE 5

Secure Bandwidth Offloading

σ σ σ = Sign(tux.png)

‘GET /tux.png’

Client

daemonporn.com

Mirror Client Client Server Mirror

mirrors.kernel.org mypenguin.org

(DSL) (OC12)

!

USENIX Security 2003 – p.

slide-6
SLIDE 6

Existing Solutions Aren’t Practica

  • Force users to install specialized browser
  • Ex: S-HTTP

, SFSRO, BitTorrent, RPM+PGP

  • Operates at the channel level, not file level
  • Ex: SSL

USENIX Security 2003 – p.

slide-7
SLIDE 7

SSL’s Authentication Layer

Client Server

Handshak Request File transf

X =MACk( ) X’=MACk( )

Check:X = X’?

Hello Certificate Negotiate shared secret Done

(knows shared secret k) (knows shared secret k)

G E T / t u x . p n g A

X Y

USENIX Security 2003 – p.

slide-8
SLIDE 8

When All You Have Is A Hammer...

Client Serve

X X =MACk( ) X’=MACk( ) Check:X = X’?

USENIX Security 2003 – p.

slide-9
SLIDE 9

SSL Splitting

Client Serve Proxy

‘tux.png(1/2)’ X X X =MACk( ) X’=MACk( ) Check:X = X’? = Cache(‘tux.png(1/2)’)

USENIX Security 2003 – p.

slide-10
SLIDE 10

SSL Splitting

Connect

  • 1. Connect

Proxy Server Client

USENIX Security 2003 – p. 1

slide-11
SLIDE 11

SSL Splitting

Connect Connect

  • 1. Connect

Proxy Server Client

USENIX Security 2003 – p. 1

slide-12
SLIDE 12

SSL Splitting

  • 1. Connect
  • 2. Handshake

(knows k) (knows k) (cannot learn k) Negotiate shared key k

Proxy Server Client

USENIX Security 2003 – p. 1

slide-13
SLIDE 13

SSL Splitting

  • 2. Handshake

GET /tux.png

  • 3. Request
  • 1. Connect

Proxy Server Client

USENIX Security 2003 – p. 1

slide-14
SLIDE 14

SSL Splitting: Cache Hit

  • 3. Request

ID=SHA−1(tux.png), ID X=MAC (tux.png)

k

  • 4. Stub record
  • 2. Handshake
  • 1. Connect

Proxy Server Client Cache

USENIX Security 2003 – p. 1

slide-15
SLIDE 15

SSL Splitting: Cache Hit

, X Check MAC X

  • 4. Stub record
  • 5. Spliced record
  • 3. Request
  • 2. Handshake
  • 1. Connect

Proxy Server Client Cache

USENIX Security 2003 – p. 1

slide-16
SLIDE 16

SSL Splitting: Cache Miss

ID=SHA−1(tux.png), X=MAC (tux.png)

k

ID miss!

Proxy Server Client Cache

USENIX Security 2003 – p. 1

slide-17
SLIDE 17

SSL Splitting: Cache Miss

Get(ID) ID miss!

Proxy Server Client Cache

USENIX Security 2003 – p. 1

slide-18
SLIDE 18

SSL Splitting: Cache Miss

Get(ID) ID miss!

Proxy Server Client Cache

USENIX Security 2003 – p. 1

slide-19
SLIDE 19

SSL Splitting: Cache Miss

, X Check MAC X Insert Get(ID)

Proxy Server Client Cache

USENIX Security 2003 – p. 1

slide-20
SLIDE 20

Caveats

  • No end-to-end confidentiality
  • Only distributes bandwidth load, not CPU

USENIX Security 2003 – p. 2

slide-21
SLIDE 21

Implementation

  • Server
  • Unmodified Apache
  • Modified OpenSSL library
  • Proxy: Perl and C
  • Splicing is not a cryptographic operation
  • Client: Netscape, IE, w3m...

USENIX Security 2003 – p. 2

slide-22
SLIDE 22

Performance Questions

  • How much data do we send over the

server-proxy link?

  • How does overhead vary with file size?
  • How much overhead with realistic file size

distributions?

USENIX Security 2003 – p. 2

slide-23
SLIDE 23

Experiments

  • Client replayed prerecorded request patterns
  • Measured bytes over server interfaces
  • Key performance metric is "rate" r:

r = wire bytes sent by server total size of files received by clients

  • Smaller is better
  • If no caching, r = 1 + % overhead

USENIX Security 2003 – p. 2

slide-24
SLIDE 24

Experimental Setup

  • Server: 160 kbps upstream, 500 MHz AMD
  • CPU could push ≈ 4 Mbps using HTTPS
  • Client: 100 Mbps LAN, 1.2 GHz Athlon
  • Proxy: 100 Mbps LAN, 700 MHz P3

USENIX Security 2003 – p. 2

slide-25
SLIDE 25

Single File Microbenchmark

10 B 100 B 1 KB 10 KB 100 KB 1 MB 10 MB

File size (bytes)

0.001 0.01 0.1 1 10 100

Rate

HTTP HTTPS Uncached

USENIX Security 2003 – p. 2

slide-26
SLIDE 26

Large Files Compress Well

10 B 100 B 1 KB 10 KB 100 KB 1 MB 10 MB

File size (bytes)

0.001 0.01 0.1 1 10 100

Rate

Ideal SSL splitting performance HTTP HTTPS Uncached Cached

USENIX Security 2003 – p. 2

slide-27
SLIDE 27

Some Apache Quirks

10 B 100 B 1 KB 10 KB 100 KB 1 MB 10 MB

File size (bytes)

0.001 0.01 0.1 1 10 100

Rate

Apache puts HTTP headers into separate record Apache bug: record size halved HTTP HTTPS Uncached Cached

USENIX Security 2003 – p. 2

slide-28
SLIDE 28

Understanding Single File Results

  • Model: r = f(file size)
  • Constant 1.5 KB overhead per file
  • Uncached: 5% overhead per byte
  • Cached: 62 bytes sent per 16 KB record
  • 8 KB records for files > 4 MB

USENIX Security 2003 – p. 2

slide-29
SLIDE 29

Real Workloads

  • Do real access patterns benefit from SSL

splitting?

  • 7-month web traces taken from

www.lcs.mit.edu and amsterdam.lcs.mit.edu

USENIX Security 2003 – p. 2

slide-30
SLIDE 30

How The Simulator Works

  • Input: list of file requests and sizes
  • Use microbenchmark results to predict

number of bytes sent by server

  • Infinite cache

USENIX Security 2003 – p. 3

slide-31
SLIDE 31

Simulation Accuracy

  • 2 hours, 10 MB transferred, 4.43 MB of files

HTTP HTTPS Ideal cold cache SSL splitting cold cache SSL splittin 100% cache

0.0 0.5 1.0 1.5

Rate

1 . 6 1 . 1 3 . 4 4 . 5 6 . 1 1 . 6 1 . 1 3 . 5 2 . 1

Simulate Measure

USENIX Security 2003 – p. 3

slide-32
SLIDE 32

Long-Term Savings ≈ 83%

  • 7 months, 109 GB transferred, 10.6 GB of files

HTTP HTTPS Ideal cold cache SSL splitting cold cache SSL splittin 100% cache

0.0 0.5 1.0 1.5

Rate

1 . 5 1 . 1 . 1 . 1 8 . 8

Simulate

USENIX Security 2003 – p. 3

slide-33
SLIDE 33

Summary

  • SSL Splitting does not:
  • Provide confidentiality
  • Reduce server CPU load
  • SSL Splitting does:
  • Reduce server bandwidth use by 25–90%
  • Guarantee end-to-end data integrity
  • Work with normal Web browsers!
  • You might use it if: you’re a Web site admin

and you’re not sure you trust your mirrors.

USENIX Security 2003 – p. 3

slide-34
SLIDE 34

Availability

http://pdos.lcs.mit.edu/barnraising/

USENIX Security 2003 – p. 3