Devising Secure Sockets Layer-Based Distributed Systems: A Performance-Aware

Approach

Norman Lim, Shikharesh Majumdar, Vineet Srivastava, Dept. of Systems and Computer Engineering, Cistech Limited,Carleton University, Ottawa, CanadaOttawa, Canada

Presentation Outline

Motivation and Proposed Solution

Additional Performance Optimizations– PO1: Multiple Channels– PO2: Batching

Performance Evaluation

Conclusions and Future Work

2Department of Systems and Computer Engineering

Motivation

In a distributed environment, exchanging documents containing sensitive information is common.

The state of the art: Transmit the entire document over a secure channel.

Problem: Can result in long document transmission times due to CPU-intensive operations (e.g. encryption/decryption) used by security protocols.

However, some documents can contain both sensitive and non-sensitive components– E.g., Document containing a patient’s medical history

– Secure components (that can identify the person)– Non-Secure components

3Department of Systems and Computer Engineering

Proposed Solution

Department of Systems and Computer Engineering 4

A performance enhancement technique called Security Sieve, is proposed.

Security sieve uses selective security which is based on two performance optimization principles:– Processing vs. Frequency principle– Centering principle

Sieve Integrate

SecureChannel

Non-SecureChannel

Data

SecureData

Non- Secure

Data

SecureData

Non- Secure

Data

Data

MS Word Macro

Department of Systems and Computer Engineering 5

1

2

3

Additional Performance Optimizations

Along with basic security sieve, two other performance optimizations (POs) are introduced:

PO1: Adds multiple channels to achieve concurrent data transmission– Based on parallel processing principle

PO2: Batches multiple document transfer requests that have the same destination– Based on batching principle

6Department of Systems and Computer Engineering

Split/Combine Algorithms

7Department of Systems and Computer Engineering

Even Split/Combine (ES)– Evenly divides data

among the channels

Secure Data ListLength: 455

Security Sieve Segment Split Example

100 14030 50 2550 60 Order String

1. 2. 3. 4. 5. 6. 7.

8.Secure sub-data List 0

Length: 117Secure sub-data List 1

Length: 105Secure sub-data List 2

Length: 240Order String:

“1;0;1;2”

Secure sub-data lists array

50 5030 100 1402560

Security Sieve Even Split Example

1. 2. ... 7.

16 10 ... 46 16 10 46... 18 10 ... 48

Sub-data List 0Length: 149

Sub-data List 1Length: 149

Sub-data List 2Length: 157

Non-secure Data ListLength: 455

50 5030 100 1402560

Non-secure sub-data lists array

Segment Split/Combine (SS)– Distributes entire text

segments

Combining PO1 and PO2

Combining PO1 and PO2, requires dividing the batch data lists (containing data for multiple files) into multiple sub-batch data lists.

Batch File Split/Combine (BFS)

Batch Even Split/Combine (BES) Batch Segment Split/Combine (BSS)

Department of Systems and Computer Engineering 8

Secure Batch Data ListLength: 430

Security Sieve Batch File Split Example

Sub-batch data List 1Length: 250

50 30 100 100 60 80 10

Sub-batch data List 0Length: 180

1. 3.2.Secure sub-batch data lists

array

50 30 100 100 60 80 10

Performance Analysis of Security Sieve: Sample Results

Performance Metric:

Total Time:

– Data transfer Time (Response Time)

– Sieving and integration Times

Effect of P

– Proportion of data corresponding to the secure components

When P is less than approximately 95% the security sieve system starts outperforming the secure-only system.

9Department of Systems and Computer Engineering

Evaluation of PO1: Multiple Channels

For the 1MB file, the mean total time increases, as the number of channels increases.

For the 10MB file, the

lowest total time is achieved when using two channels.

10

0 1 2 3 4 5 60

500

1000

1500

2000

2500

3000

3500

4000

SecOnly1MBSecOnly10MBSecSieve 1MB-50SecSieve 10MB-50

N and MM

ean

Tota

l Tim

e (m

s)

Comparison of ES and SS Algorithm

The ES algorithm starts to outperform the SS algorithm when proportion of non-secure data is less than 40%

For all other values, the SS-based system has slightly lower response times because the split/combine times are lower.

Department of Systems and Computer Engineering 11

0 10 20 30 40 50 60 70 80 90 1000

200400600800

10001200140016001800 1MB (ES)

10MB (ES)1MB (SS)1MB (ES)

100- P (in %)

Mea

n Re

spon

se T

ime

(ms)

Evaluation of PO2: Batching

PO2 is evaluated when a stream of file transfer requests arrives (following a Poisson process).

At higher λ, batching becomes more effective.

At low λ, system without batching displays higher performance.

Department of Systems and Computer Engineering 12

0

2

4

6

8

10

12

No BatchingBatching

λ (req/s)

Mea

n Tu

rnar

ound

Tim

e (s

)

Conclusions

Security sieve, a performance enhancement technique for improving the performance of transferring documents containing both sensitive and non-sensitive components

Performance measurements made on the prototype demonstrates the effectiveness of the security sieve technique.

Evaluation of PO1: Using multiple channels is effective in reducing response times but only when enough data is transferred

Evaluation of PO2: Batching is most effective at higher arrival rates.

13Department of Systems and Computer Engineering

Future Work

Development of a tool that searches a document and automatically marks the confidential data warrant further investigation.

Such a technique can be based on a user provided list of keywords and/or phrases that are associated with confidential information.

14Department of Systems and Computer Engineering

Evaluation of Combining PO1 and PO2

When using the BSS and BES algorithm we observe that the mean total times are nearly identical.

When the BFS algorithm is used, the mean total time is higher, especially for medium and high values of x.

Department of Systems and Computer Engineering 15

0 1 2 3 4 5 6 7 8 9 10 110

500

1000

1500

2000

2500

3000

1 Channel2 Channels (BES)2 Channels (BFS)2 Channels (BSS)

x (MB)M

ean

Tota

l tim

e (m

s)