Security and Performance Testing for Improving Quality of Distributed Applications Working in Public-Private Network Infrastructures

Performance and Security Testing for Improving Quality of Distributed Applications Working in Public/Private Network Environments GDANSK UNIVERSITY OF TECHNOLOGY Faculty of Electronics, Telecommunications and Informatics Marcin Adam Barylski Performance and Security Testing for Improving Quality of Distributed Applications Working in Public/Private Network Environments PhD Dissertation Supervisor: prof. dr hab. in Ŝ. Henryk Krawczyk Faculty of Electronics, Telecommunications and Informatics Gdansk University of Technology Gdansk, 2010 Performance and Security Testing for Improving Quality of Distributed Applications Working in Public/Private Network Environments To my wife, Ewa 2 Performance and Security Testing for Improving Quality of Distributed Applications Working in Public/Private Network Environments Acknowledgments First of all, I would like to thank Professor Henryk Krawczyk, a professor at Faculty of Electronics, Telecommunications and Informatics, President of Gda ńsk University of Technology, for priceless motivation, valuable advices, and his unlimited time for me that was required to write this dissertation. This dissertation would not be ever possible without help of my family. Firstly I would like to thank my wife, Ewa, for her patience, being always ready to give me a helpful hand, and invaluable day-by-day support. My parents taught me how to discover the world around me and without their education I would not ever start my studies. I would like to thank Mrs. Izabela Dziedzic for taking care of all formal and organizational matters. The crucial field test of one of the most important deliverable of this dissertation, MA2QA, would not be possible without full support of Jerzy Proficz from TASK, who introduced me to KASKADA test environment. Finally, I would like to thank my employer, Intel Technology Poland, for enabling access to best know methods. 3 Performance and Security Testing for Improving Quality of Distributed Applications Working in Public/Private Network Environments Table of Contents INDEX OF FIGURES ...................................................................................................................7 INDEX OF TABLES ..................................................................................................................10 GLOSSARY .............................................................................................................................12 LIST OF ACRONYMS ...............................................................................................................16 CHAPTER 1: INTRODUCTION .........................................................................................21 1.1. B ACKGROUND OF SECURITY AND PERFORMANCE TESTING .............................................21 1.2. I NTRODUCTION TO DISTRIBUTED PUBLIC -PRIVATE NETWORK ENVIRONMENTS ...............22 1.3. G OAL AND SCOPE OF THE DISSERTATION ........................................................................26 1.4. C LAIMS OF THE DISSERTATION .......................................................................................28 1.5. D OCUMENT STRUCTURE .................................................................................................28 CHAPTER 2: CHARACTERIZATION OF PRIVATE-PUBLIC IPSEC AND HTTPS APPLICATIONS....................................................................................................................30 2.1. IPS EC -BASED DISTRIBUTED APPLICATIONS DESIGN ........................................................30 2.1.1. Introduction to IPSec..............................................................................................30 2.1.2. ESP security............................................................................................................32 2.1.3. ESP performance....................................................................................................42 2.1.4. IKEv2 security and performance............................................................................44 2.2. HTTPS-BASED DISTRIBUTED APPLICATIONS DESIGN ......................................................46 2.2.1. Introduction to HTTPS ...........................................................................................46 2.2.2. HTTPS security.......................................................................................................49 2.2.3. HTTPS performance...............................................................................................52 2.3. D ISTRIBUTED APPLICATIONS WORKING IN IPS EC /HTTPS ENVIRONMENTS ....................54 2.3.1. Request/Response (R/R) solution............................................................................54 2.3.2. Publish/Subscribe (P/S) solution............................................................................55 2.3.3. Concept of a secure service processing continuous multimedia data....................56 2.3.4. Security and performance of continuous multimedia streams distribution............62 2.4. S UMMARY ......................................................................................................................65 CHAPTER 3. SELECTION OF SECURITY AND PERFORMANCE TESTING PROCEDURES.......................................................................................................................66 3.1. T HE GIST OF QUALITY CONTROL .....................................................................................66 3.2. F UNDAMENTALS OF SW PERFORMANCE TESTING ...........................................................70 3.3. N ETWORK LAYER PERFORMANCE TESTS .........................................................................72 3.3.1. Network throughput testing ....................................................................................73 3.3.2. Network latency testing ..........................................................................................84 3.4. M IDDLEWARE LAYER PERFORMANCE TESTS ...................................................................87 3.4.1. DB performance tests .............................................................................................90 3.4.2. WS performance tests .............................................................................................92 3.4.3. Web performance tests ...........................................................................................93 3.5. F UNDAMENTALS OF SW SECURITY .................................................................................97 3.6. SW SECURITY TESTING ...................................................................................................98 3.6.1. Scope of security testing .........................................................................................98 3.6.2. Security attacks.....................................................................................................100 3.7. IPS EC PERFORMANCE AND SECURITY TESTING .............................................................104 3.8. HTTPS PERFORMANCE AND SECURITY TESTING ...........................................................107 3.9. S UMMARY ....................................................................................................................110 4 Performance and Security Testing for Improving Quality of Distributed Applications Working in Public/Private Network Environments CHAPTER 4: PROPOSAL OF MA2QA APPROACH....................................................111 4.1. A PPLICATION MODEL ....................................................................................................111 4.1.1. Subject of analysis ................................................................................................111 4.1.2. Design and implementation for performance and security ..................................112 4.2. Q UALITY MODEL ..........................................................................................................114 4.2.1. Quality tree...........................................................................................................114 4.2.2. Scope of quality analysis ......................................................................................115 4.2.3. Method for finding the correlations between the metrics.....................................116 4.3. M ULTIDIMENSIONAL APPROACH TO QUALITY ANALYSIS (MA2QA)...........................116 4.3.1. MA2QA fundamentals...........................................................................................116 4.3.2. MA2QA usage in iterative application development............................................117 4.3.3. Compromising security and performance ............................................................118 4.3.4. MA2QA quality vector..........................................................................................121 4.3.5. Sample MA2QA score card ..................................................................................126 4.3.6. Sample MA2QA evaluation ..................................................................................128 4.4. S UMMARY ....................................................................................................................128 CHAPTER 5. EXPERIMENTS AND RESULTS .............................................................130 5.1. G OAL AND PLAN OF EXPERIMENTS ................................................................................130 5.2. E XPERIMENT 1 (EXP1): ENDPOINT AUTHENTICATION VS . USER INPUT CONFIRMATION LATENCY .............................................................................................................................132

Load more