The SSL/TLS, one of the most popular encryption protocol, was developed as a solution of various network security problem while the network traffic has become complex and diverse. But the SSL/TLS traffic has been identified as its protocol name, not its used services, which is required for the effective network traffic management. This paper proposes a new method to generate service signatures automatically from SSL/TLS payload data and to classify network traffic in accordance with their application services. We utilize the certificate publication information field in the certificate exchanging record of SSL/TLS traffic for the service signatures, which occurs when SSL/TLS performs Handshaking before encrypt transmission. We proved the performance and feasibility of the proposed method by experimental result that classify about 95% SSL/TLS traffic with about 90% accuracy for every SSL/TLS services.

A method for service identification of SSL/TLS encrypted traffic with the relation of session ID and Server IP

SSL protocol realize identity authentication through verifying both sides' certificate, but there are still some drawbacks. Through applying attribute certificate and improving SSL handshake process, we can improve the function of the SSL identity authentication, let SSL apply more widely.

Improvement Method of SSL Protocol Identity Authentication Based on the Attribute Certificate

The primary goal of the secure socket layer protocol (SSL) is to provide confidentiality and data integrity between two communicating entities. Since the most computationally expensive step in the SSL handshake protocol is the server's RSA decryption, it is introduced that the proposed secret exchange algorithm can be used to speedup SSL session initialization. The optimization strategy, which is based on the constrained model considering the user's requirements for Quality of Service (QoS), such as security ranking, focuses on the optimal result in different public key size. It is also introduced that the parameter is optimized when integrating user's requirements for Internet QoS such as the stability of the system and the tolerable response time. Finally, the proposed algorithm is evaluated to be practical and efficient through both analysis and simulation studies.

QoS-aware optimization strategy for security ranking in SSL protocol

A public-key cryptosystem is usually used for key management, in particular to session key management. The paper presents a method for handling a batch of concurrent keys with homomorphic public-key cryptosystems such as RSA, Paillier and ElGamal. Theorematically, regardless Shacham and Boneh proved that it is impossible to provide batch RSA encryption of messages with a single certificate, the present result is positive when the messages are small. Practically, the present method is compliant to the de facto standard SSL/TLS handshake and increases the SSL system performance.

Batch decryption of encrypted short messages and its application on concurrent SSL handshakes

/pdf/an-integrity-batch-report-scheme-based-on-the-waiting-stack-8jy4heb63j.pdf

An Integrity Batch Report Scheme Based on the Waiting Stack

Secure socket layer (SSL) is the most popular protocol to secure Internet communications. Since SSL handshake requires a large amount of computational resource, batch RSA was proposed to speedup SSL session initialization. However, the batch method is impractical since it requires a multiple of certificates. In this paper, we overcome this problem without modifying SSL protocol. To select the optimal batching parameters in terms of performance of server and durable waiting time of the client, we model the connection request with M/D/1 queue. We validate the solutions of the analytical model through simulation.

Yongdong Wu

Papers

Batching SSL/TLS handshake improved