QoS3: Secure Caching in HTTPS Based on Fine-Grained Trust Delegation

Abstract

With the ever-increasing concern in network security and privacy, a major portion of Internet traffic is encrypted now. Recent research shows that more than 70% of Internet content is transmitted using HyperText Transfer Protocol Secure (HTTPS). However, HTTPS encryption eliminates the advantages of many intermediate services like the caching proxy, which can significantly degrade the performance of web content delivery. We argue that these restrictions lead to the need for other mechanisms to access sites quickly and safely. In this paper, we introduce QoS3, which is a protocol that can overcome such limitations by allowing clients to explicitly and securely re-introduce in-network caching proxies using fine-grained trust delegation without compromising the integrity of the HTTPS content and modifying the format of Transport Layer Security (TLS). In QoS3, we classify web page contents into two types: (1) public contents that are common for all users, which can be stored in the caching proxies, and (2) private contents that are specific for each user. Correspondingly, QoS3 establishes two separate TLS connections between the client and the web server for them. Specifically, for private contents, QoS3 just leverages the original HTTPS protocol to deliver them, without involving any middlebox. For public contents, QoS3 allows clients to delegate trust to specific caching proxy along the path, thereby allowing the clients to use the cached contents in the caching proxy via a delegated HTTPS connection. Meanwhile, to prevent Man-in-the-Middle (MitM) attacks on public contents, QoS3 validates the public contents by employing Document object Model (DoM) object-level checksums, which are delivered through the original HTTPS connection. We implement a prototype of QoS3 and evaluate its performance in our testbed. Experimental results show that QoS3 provides acceleration on page load time ranging between 30% and 64% over traditional HTTPS with negligible overhead. Moreover, QoS3 is deployable since it requires just minor software modifications to the server, client, and the middlebox.

MDP-based Network Friendly Recommendations

“…A simple (but not the only) example of this could be to favor cached content [26]. While various implementation barriers are sometimes cited [8], the increasing convergence [27] of CPs and NOs in the context of network slicing and virtualization suggests that in the very near future the content providers will be the owners of their own network (slice), and will be able to directly infer the potential network cost of recommending and delivering content X as opposed to content Y.…”

“…To prove this, one needs to show that the state-space of the MDP forms an irreducible Markov chain, which is true if all state-pairs are communicating, i.e. P i, j > 0 in (8). It suices to consider p 0 (j) > 0 ∀ j and K l =1 α il •r il < 1.…”

“…Speciically, we recommend N = 1 item for every content, but since we do probabilistic recommendations, we could have > N outgoing recommendations links; additionally, for every content there are exactly K = 4 random jumps towards all other items in the catalog (including self-arrows). To better connect (8) to the igure, we can think about the random surfer model [32], who transits through a link w.p. α, and then chooses one of the outgoing links at random, or does a random jump w.p.…”

“…where P i j (r i ) is deined in (8) and c i indicates the immediate cost of visiting state i. We can apply well established iterative algorithms to solve these equations [33]; we choose here the well-known policy iteration, which is known to converge for ininite horizon MDP with discounts λ ∈ (0, 1) [33] [Theorem 6.4.6, p. 180], at least linearly.…”

SOBA: Session optimal MDP-based network friendly recommendations

“…A simple solution to achieved this is to favor cached content [18]. While various implementation barriers are sometimes cited [19], the increasing convergence of CPs and NOs [20], especially in the context of network slicing and virtualization suggests, that in the very near future content providers will be the owners of their own network (slice), and will be able to directly infer the potential network cost of recommending and delivering some content versus another.…”