Xiaozhu Kang

Encrypting the internet

End-to-end communication encryption is considered necessary for protecting the privacy of user data in the Internet. Only a small fraction of all Internet traffic, however, is protected today. The primary reason for this neglect is economic, mainly security protocol speed and cost. In this paper we argue that recent advances in the implementation of cryptographic algorithms can make general purpose processors capable of encrypting packets at line rates. This implies that the Internet can be gradually transformed to an information delivery infrastructure where all traffic is encrypted and authenticated. We justify our claim by presenting technologies that accelerate end-to-end encryption and authentication by a factor of 6 and a high performance TLS 1.2 protocol implementation that takes advantage of these innovations. Our implementation is available in the public domain for experimentation.

System-wide anatomy and tuning of a SPECweb SSL server

In this paper we present system-wide analysis and performance tuning of a SPECweb SSL server. We focus on the banking workload of SPECweb because this workload is 100% SSL-enabled and thus designed to evaluate the SSL web server performance and capacity. In order to gain insight into the unique characteristics of a SPECweb banking server, we conduct extensive experiments and present module and function-level anatomy data. Based on our results, we propose methods for tuning up the server performance, alleviating some of the bottlenecks. One of our main results is that the SPECweb banking workload may not always be a realistic environment for measuring the capacity of an SSL server, due to the fact that it is burdened with overheads which are not related to cryptography and can be removed.