Improving secure server performance by re-balancing SSL/TLS handshakes

  • Authors:
  • Claude Castelluccia;Einar Mykletun;Gene Tsudik

  • Affiliations:
  • INRIA Zirst, Saint Ismier, Cedex, France;University of California, Irvine Irvine, CA;University of California, Irvine Irvine, CA

  • Venue:
  • ASIACCS '06 Proceedings of the 2006 ACM Symposium on Information, computer and communications security
  • Year:
  • 2006

Quantified Score

Hi-index 0.00

Visualization

Abstract

Much of today's distributed computing takes place in a client /server model. Despite advances in fault tolerance - in particular, replication and load distribution -- server overload remains to be a major problem. In the Web context, one of the main overload factors is the direct consequence of expensive Public Key operations performed by servers as part of each SSL handshake. Since most SSL-enabled servers use RSA, the burden of performing many costly decryption operations can be very detrimental to server performance. This paper examines a promising technique for re-balancing RSA-based client/server handshakes. This technique facilitates more favorable load distribution by requiring clients to perform more work (as part of encryption) and servers to perform commensurately less work, thus resulting in better SSL throughput. Proposed techniques are based on careful adaptation of variants of Server-Aided RSA originally constructed by Matsumoto, et al. [1]. Experimental results demonstrate that suggested methods (termed Client-Aided RSA) can speed up processing of RSA private key operations by a factor of between 11 to 19, depending on the RSA key size. This represents a considerable improvement. Furthermore, proposed techniques can be a useful companion tool for SSL Client Puzzles in defense against DoS and DDoS attacks.