DOCSLIB.ORG

Using DPI and Statistical Analysis in Encrypted Network Traffic Monitoring

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Using DPI and Statistical Analysis in Encrypted Network Traffic Monitoring International Journal for Information Security Research (IJISR), Volume 10, Issue 1, 2020 Using DPI and Statistical Analysis in Encrypted Network Traffic Monitoring Luca Deri1, Daniele Sartiano2 1ntop/IIT-CNR 2IIT-CNR/University of Pisa Pisa, Italy Abstract The pervasive use of encrypted protocols and new • Availability of free and automated X.509 communication paradigms based on mobile and home certificates issued by non-profit certificate IoT devices has obsoleted traffic analysis techniques authority Let’s Encrypt has driven the adoption of that relied on clear text analysis. This has required HTTPS to new highs. new monitoring metrics being able to characterise, identify, and classify traffic not just in terms of • Computational overhead is no longer a problem network protocols but also behaviour and intended even on low-end devices, thus even home IoT use. This paper reports the lessons learnt while devices such as virtual assistants and smart home analysing traffic in both home networks and the devices relying on cloud-based services need to Internet, and it describes how monitoring metrics secure their communication with encryption. used in experiments have been implemented on an open source toolkit for deep packet inspection (DPI) As encryption is becoming pervasive with 87% of and traffic analysis developed by the authors. The the whole Internet traffic in 2019, it is becoming validation process confirmed that combining the important to provide network visibility in this new proposed metrics with DPI, it is possible to effectively changed scenario where clear-text protocols are used characterise and fingerprint encrypted traffic less frequently even though they are still relatively generated by home IoT and non-IoT devices, paving popular in LAN networks where obsolete operating the way to next generation DPI toolkit development. systems and outdated IoT devices will be used for some more years. This means that we need to 1. Introduction complement existing techniques with new measurements metrics able to inspect and characterise Network traffic has changed significantly in terms encrypted traffic for the purpose of identifying threats of network protocols and behaviour. Today most of and changes in network traffic behaviour. This is in the network traffic is encrypted and the reasons are particular because modern enterprises are rethinking manyfold: their network security moving off castle-and-moat approaches focusing on defending their perimeter to a • Changes in company network topologies with the new zero-trust model where no user is trusted based adoption of multi-cloud architectures require on the principle of “never trust always verify” [6]. In communications to be protected as they are no home networks the widespread use of IoT and longer limited to trusted LAN network segments healthcare devices that operate using cloud services traditionally protected by security devices. has created new security issues pushing towards the zero-trust model as users no longer interact directly • Devices such as mobile phone and portable PCs with the device but only through cloud services. This are used on public network and WiFi hotspots trend towards cloud-based security is present also on making compulsory to use encrypted products manufactured by leading firewall vendors communications in order to safely exchange that can be accessed solely using a cloud console and sensitive data while preserving privacy on no longer connecting to the firewall sitting on the potentially hostile networks. company premises. Providing network visibility is the base on which security of modern networks works, as it is • New multi-language cryptographic libraries such compulsory to implement mechanisms to enforce as Amazon s2n and Google Tink made encryption network policies that enable zero-trust and modern commodity for programers with respect to home networks to operate. This has been the obsolete libraries such as OpenSSL that were large motivation behind this work, being decryption of in size, difficult to use, and affected by severe encrypted traffic not practical for various reasons problems such as Heartbleed. Copyright © 2020, Infonomics Society 932 International Journal for Information Security Research (IJISR), Volume 10, Issue 1, 2020 including, but not limited to, ethical and technical 2. Related Work issues that prevent MITM (Man In The Middle) techniques [1] to operate on non-TLS (Transport This section first analyses TLS and SSH (Secure Layer Security) protocols such as SSH, BitTorrent Shell), the two leading encryption protocols and it and Skype. Contrary to previous research [2, 3, 4], describes various traffic analysis and fingerprint goal of this paper is not to define new methods for methods. Then it describes how IoT device traffic is identifying specific threats but rather to classify analysed and enforced in networks. network traffic in a generic way without searching specific traffic or malware fingerprints. As specified 2.1. SSL/TLS Fingerprinting later in this paper, this approach is able to classify traffic using specific protocol metrics and also detect TLS (Transport Security Layer) is the most changes in network behaviour. This fact is effective in popular cryptographic protocol used to secure particular on IoT and home networks, where the communications on computer networks. TLS has device behaviour should not change unless it is replaced its predecessor SSL (Secure Socket Layer) reconfigured or compromised. used for years on the Internet and now deprecated, and Another objective that has motivated this work, is it has been designed to provide privacy and data the definition of new metrics and techniques to be integrity between two communicating applications. used with encrypted traffic similar to those used with TLS uses TCP as transport protocol even though there clear text. For instance, in HTTP the User Agent has is also a variant called DTLS (Datagram TLS) mostly been used [5] to classify devices and identify used for VPNs and in some mobile applications (e.g. malware: how can this be implemented with the Signal messaging app) that is similar to the QUIC encrypted traffic? In essence, identify properties in protocol promoted by Google. TLS communications encrypted traffic analysis equivalent to those used for flow over an encrypted, bidirectional network tunnel years in clear text traffic so that it is possible to have that is encrypted using some cryptographic keys based the same level of visibility without decoding the on shared secrets negotiated at the start of the session encrypted traffic payload. named TLS handshake. During handshake the two In summary, the main contribution of this paper is communicating peers agree on algorithms, exchange to show in practice how existing network visibility certificates and cryptographic options before starting methods and algorithms have been enhanced to take encrypted data exchange. In this negotiation phase the into account encrypted traffic and to promote the TLS client sends a ClientHello message that contains creation of a next generation DPI engine that does a list of supported ciphers, compression methods and more than just identifying network protocols decoding various parameters including options on elliptic-curve a few packets. The novelty of this work is the cryptography used by TLS. The server responds with combination of existing protocol fingerprint a ServerHello message that contains the chosen TLS techniques coming from DPI with new traffic protocol version, ciphers and compression methods behavioural indicators that allow traffic not only to be selected out of the various options offered by the recognised in terms of application protocol, but also client in the ClientHello message. Then the server to be checked for compliance with the expected sends an optional certificate message containing the behavioral model. Doing this it is possible to improve public key used by the server. Handshake messages application protocol detection, and at the same time are exchanged in clear, so they can be decoded by spot suspicious traffic behaviour in a simple way with dissecting packets, with the exception of the server respect to what popular IDSs can do in a significantly certificate that in TLS 1.3 is encrypted. more complex fashion [6]. This is to create a comprehensive set of algorithms and metrics that can be effectively used to monitor both large and home/IoT networks as well Internet traffic. As described later in this paper, the results of this research have been implemented in a popular open source deep-packet inspection and traffic classification engine named nDPI [7] so that other people can benefit from this work. The rest of the paper is structured as follows. Section 2 analyses encryption protocols and standard Figure 1. Simplified TLS Handshake traffic fingerprint techniques used to classify (RFC 5246, 2008) encrypted traffic. Section 3 covers the proposed monitoring methodology, metrics and approach. Decoding the initial handshake packets allows Section 4 discusses the tool implementation and applications to inspect how data is exchanged and experiments, and finally Section 5 concludes the disclose information about both the client and server paper. configuration as well fingerprint and identify client Copyright © 2020, Infonomics Society 933 International Journal for Information Security Research (IJISR), Volume 10, Issue 1, 2020 applications. For instance, a typical misconception about TLS is that monitoring applications are unable to
Load more

Recommended publications
  • Scalable Scanning and Automatic Classification of TLS Padding Oracle Vulnerabilities
    Scalable Scanning and Automatic Classification of TLS Padding Oracle Vulnerabilities Robert Merget and Juraj Somorovsky, Ruhr University Bochum; Nimrod Aviram, Tel Aviv University; Craig Young, Tripwire VERT; Janis Fliegenschmidt and Jörg Schwenk, Ruhr University Bochum; Yuval Shavitt, Tel Aviv University https://www.usenix.org/conference/usenixsecurity19/presentation/merget This paper is included in the Proceedings of the 28th USENIX Security Symposium. August 14–16, 2019 • Santa Clara, CA, USA 978-1-939133-06-9 Open access to the Proceedings of the 28th USENIX Security Symposium is sponsored by USENIX. Scalable Scanning and Automatic Classification of TLS Padding Oracle Vulnerabilities Robert Merget1, Juraj Somorovsky1, Nimrod Aviram2, Craig Young3, Janis Fliegenschmidt1, Jörg Schwenk1, and Yuval Shavitt2 1Ruhr University Bochum 2Department of Electrical Engineering, Tel Aviv University 3Tripwire VERT Abstract the encryption key. The attack requires a server that decrypts a message and responds with 1 or 0 based on the message va- The TLS protocol provides encryption, data integrity, and lidity. This behavior essentially provides the attacker with a authentication on the modern Internet. Despite the protocol’s cryptographic oracle which can be used to mount an adaptive importance, currently-deployed TLS versions use obsolete chosen-ciphertext attack. The attacker exploits this behavior cryptographic algorithms which have been broken using var- to decrypt messages by executing adaptive queries.Vaudenay ious attacks. One prominent class of such attacks is CBC exploited a specific form of vulnerable behavior, where im- padding oracle attacks. These attacks allow an adversary to plementations validate the CBC padding structure and re- decrypt TLS traffic by observing different server behaviors spond with 1 or 0 accordingly.
    [Show full text]
  • HTTP Cookie - Wikipedia, the Free Encyclopedia 14/05/2014
    HTTP cookie - Wikipedia, the free encyclopedia 14/05/2014 Create account Log in Article Talk Read Edit View history Search HTTP cookie From Wikipedia, the free encyclopedia Navigation A cookie, also known as an HTTP cookie, web cookie, or browser HTTP Main page cookie, is a small piece of data sent from a website and stored in a Persistence · Compression · HTTPS · Contents user's web browser while the user is browsing that website. Every time Request methods Featured content the user loads the website, the browser sends the cookie back to the OPTIONS · GET · HEAD · POST · PUT · Current events server to notify the website of the user's previous activity.[1] Cookies DELETE · TRACE · CONNECT · PATCH · Random article Donate to Wikipedia were designed to be a reliable mechanism for websites to remember Header fields Wikimedia Shop stateful information (such as items in a shopping cart) or to record the Cookie · ETag · Location · HTTP referer · DNT user's browsing activity (including clicking particular buttons, logging in, · X-Forwarded-For · Interaction or recording which pages were visited by the user as far back as months Status codes or years ago). 301 Moved Permanently · 302 Found · Help 303 See Other · 403 Forbidden · About Wikipedia Although cookies cannot carry viruses, and cannot install malware on 404 Not Found · [2] Community portal the host computer, tracking cookies and especially third-party v · t · e · Recent changes tracking cookies are commonly used as ways to compile long-term Contact page records of individuals' browsing histories—a potential privacy concern that prompted European[3] and U.S.
    [Show full text]
  • Arxiv:1911.09312V2 [Cs.CR] 12 Dec 2019
    Revisiting and Evaluating Software Side-channel Vulnerabilities and Countermeasures in Cryptographic Applications Tianwei Zhang Jun Jiang Yinqian Zhang Nanyang Technological University Two Sigma Investments, LP The Ohio State University [email protected] [email protected] [email protected] Abstract—We systematize software side-channel attacks with three questions: (1) What are the common and distinct a focus on vulnerabilities and countermeasures in the cryp- features of various vulnerabilities? (2) What are common tographic implementations. Particularly, we survey past re- mitigation strategies? (3) What is the status quo of cryp- search literature to categorize vulnerable implementations, tographic applications regarding side-channel vulnerabili- and identify common strategies to eliminate them. We then ties? Past work only surveyed attack techniques and media evaluate popular libraries and applications, quantitatively [20–31], without offering unified summaries for software measuring and comparing the vulnerability severity, re- vulnerabilities and countermeasures that are more useful. sponse time and coverage. Based on these characterizations This paper provides a comprehensive characterization and evaluations, we offer some insights for side-channel of side-channel vulnerabilities and countermeasures, as researchers, cryptographic software developers and users. well as evaluations of cryptographic applications related We hope our study can inspire the side-channel research to side-channel attacks. We present this study in three di- community to discover new vulnerabilities, and more im- rections. (1) Systematization of literature: we characterize portantly, to fortify applications against them. the vulnerabilities from past work with regard to the im- plementations; for each vulnerability, we describe the root cause and the technique required to launch a successful 1.
    [Show full text]
  • A Security Analysis of the WPA-TKIP and TLS Security Protocols
    ARENBERG DOCTORAL SCHOOL Faculty of Engineering Science A Security Analysis of the WPA-TKIP and TLS Security Protocols Mathy Vanhoef Supervisor: Dissertation presented in partial Prof. dr. ir. F. Piessens fulfillment of the requirements for the degree of Doctor in Engineering Science: Computer Science July 2016 A Security Analysis of the WPA-TKIP and TLS Security Protocols Mathy VANHOEF Examination committee: Dissertation presented in partial Prof. dr. ir. P. Van Houtte, chair fulfillment of the requirements for Prof. dr. ir. F. Piessens, supervisor the degree of Doctor in Engineering Prof. dr. ir. C. Huygens Science: Computer Science Prof. dr. D. Hughes Prof. dr. ir. B. Preneel Prof. dr. K. Paterson (Royal Holloway, University of London) July 2016 © 2016 KU Leuven – Faculty of Engineering Science Uitgegeven in eigen beheer, Mathy Vanhoef, Celestijnenlaan 200A box 2402, B-3001 Leuven (Belgium) Alle rechten voorbehouden. Niets uit deze uitgave mag worden vermenigvuldigd en/of openbaar gemaakt worden door middel van druk, fotokopie, microfilm, elektronisch of op welke andere wijze ook zonder voorafgaande schriftelijke toestemming van de uitgever. All rights reserved. No part of the publication may be reproduced in any form by print, photoprint, microfilm, electronic or any other means without written permission from the publisher. Preface When I started my PhD four years ago, I thought people were exaggerating when they said that doing a PhD was a unique and special experience. Turns out I was wrong: it is indeed quite the journey! It was a roller coaster of exciting and sometimes no so exciting research results, late-night deadline races, moments of doubt, enriching and rewarding travels, grueling dilemmas, facing your own limitations,.
    [Show full text]
  • Torward: DISCOVERY, BLOCKING, and TRACEBACK of MALICIOUS TRAFFIC OVER Tor 2517
    IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 10, NO. 12, DECEMBER 2015 2515 TorWard: Discovery, Blocking, and Traceback of Malicious Traffic Over Tor Zhen Ling, Junzhou Luo, Member, IEEE,KuiWu,Senior Member, IEEE, Wei Yu, and Xinwen Fu Abstract— Tor is a popular low-latency anonymous communi- I. INTRODUCTION cation system. It is, however, currently abused in various ways. OR IS a popular overlay network that provides Tor exit routers are frequently troubled by administrative and legal complaints. To gain an insight into such abuse, we designed Tanonymous communication over the Internet for and implemented a novel system, TorWard, for the discovery and TCP applications and helps fight against various Internet the systematic study of malicious traffic over Tor. The system censorship [1]. It serves hundreds of thousands of users and can avoid legal and administrative complaints, and allows the carries terabyte of traffic daily. Unfortunately, Tor has been investigation to be performed in a sensitive environment such abused in various ways. Copyrighted materials are shared as a university campus. An intrusion detection system (IDS) is used to discover and classify malicious traffic. We performed through Tor. The black markets (e.g., Silk Road [2], an comprehensive analysis and extensive real-world experiments to online market selling goods such as pornography, narcotics validate the feasibility and the effectiveness of TorWard. Our or weapons1) can be deployed through Tor hidden service. results show that around 10% Tor traffic can trigger IDS alerts. Attackers also run botnet Command and Control (C&C) Malicious traffic includes P2P traffic, malware traffic (e.g., botnet servers and send spam over Tor.
    [Show full text]
  • Designing a Better Browser for Tor with BLAST
    Designing a Better Browser for Tor with BLAST Tao Wang Department of Computer Science and Engineering Hong Kong University of Science and Technology [email protected] Abstract—Tor is an anonymity network that allows clients unwilling to trade off utility for its better privacy. Having to browse web pages privately, but loading web pages with more users improves the anonymity of Tor Browser by creating Tor is slow. To analyze how the browser loads web pages, we larger anonymity sets, reducing the chance that eavesdroppers examine their resource trees using our new browser logging and could deanonymize a Tor user using side information. simulation tool, BLAST. We find that the time it takes to load a web page with Tor is almost entirely determined by the number Anonymity network optimization is a well-studied privacy of round trips incurred, not its bandwidth, and Tor Browser problem with a decade of research, generally focused on incurs unnecessary round trips. Resources sit in the browser Tor [4], [5], [12], [14], [18]. Researchers have proposed various queue excessively waiting for the TCP and TLS handshakes, each solutions to optimize Tor’s performance on the network level of which takes a separate round trip. We show that increasing so as to improve user experience. On the other hand, the resource loading capacity with larger pipelines and even HTTP/2 problem of browser design for anonymity networks remains do not decrease load time because they do not save round trips. academically untouched, with many open problems that are We set out to minimize round trips with a number of protocol just as significant for user experience as network design and browser improvements, including TCP Fast Open, optimistic problems.
    [Show full text]
  • Warptcptm SPDY
    What Warp TCP TM does for SPDY WHITE PAPER Turbcharge Web Performance BADU networks - Improving the way the world connects - WarpTCP TM & SPDY Web performance is increasingly becoming a key focal point One among them is SPDY – a companion protocol to HTTP for many web properties. There are several approaches to that is aimed at reducing web page load latency and improv- help deliver rich, dynamic content with significantly lower ing web security among other things. latencies and improved user experience. Google’s “Make the Web Faster” initiative has proposed several techniques to This document describes how SPDY and Badu technology can improve web performance. These techniques are currently be combined to boost web performance. The approaches are being evaluated for inclusion in future standards. different but complementary to each other and can be implemented individually or together for maximum benefit. * The following diagram illustrates where SPDY and WarpTCP™ sit in the network protocol stack. Application Layer Web Cloud Computing Video File Transfer Amazon AWS HTML JS CSS H.264 MP4 Flash - EC2, S3 HTTP HTTP/REST/SOAP RTSP RTMP HLS FTP SCP SPDY Presentation Layer SSL Transport Layer WarpTCPTM SPDY SPDY operates at the Application/Session Layer. SPDY does not replace HTTP; it modifies the way HTTP requests and responses are sent over the Internet. This means that all the existing server-side applications can be used without modification if a SPDY-compatible translation layer is put in place. SPDY is similar to HTTP, with particular goals to reduce web page load latency and improve web security. SPDY achieves reduced latency through compression, multiplexing, and prioritization.
    [Show full text]
  • How Speedy Is SPDY?
    How Speedy is SPDY? Xiao Sophia Wang, Aruna Balasubramanian, Arvind Krishnamurthy, and David Wetherall, University of Washington https://www.usenix.org/conference/nsdi14/technical-sessions/wang This paper is included in the Proceedings of the 11th USENIX Symposium on Networked Systems Design and Implementation (NSDI ’14). April 2–4, 2014 • Seattle, WA, USA ISBN 978-1-931971-09-6 Open access to the Proceedings of the 11th USENIX Symposium on Networked Systems Design and Implementation (NSDI ’14) is sponsored by USENIX How speedy is SPDY? Xiao Sophia Wang, Aruna Balasubramanian, Arvind Krishnamurthy, and David Wetherall University of Washington Abstract provides only a modest improvement [13, 19]. In our SPDY is increasingly being used as an enhancement own study [25] of page load time (PLT) for the top 200 to HTTP/1.1. To understand its impact on performance, Web pages from Alexa [1], we found either SPDY or we conduct a systematic study of Web page load time HTTP could provide better performance by a significant (PLT) under SPDY and compare it to HTTP. To identify margin, with SPDY performing only slightly better than the factors that affect PLT, we proceed from simple, syn- HTTP in the median case. thetic pages to complete page loads based on the top 200 As we have looked more deeply into the performance Alexa sites. We find that SPDY provides a significant im- of SPDY, we have come to appreciate why it is chal- provement over HTTP when we ignore dependencies in lenging to understand. Both SPDY and HTTP perfor- the page load process and the effects of browser compu- mance depend on many factors external to the protocols tation.
    [Show full text]
  • Directed Greybox Fuzzing
    Directed Greybox Fuzzing Marcel Böhme Van-Thuan Pham∗ National University of Singapore, Singapore National University of Singapore, Singapore [email protected] [email protected] Manh-Dung Nguyen Abhik Roychoudhury National University of Singapore, Singapore National University of Singapore, Singapore [email protected] [email protected] ABSTRACT However, existing greybox fuzzers cannot be effectively directed.1 Existing Greybox Fuzzers (GF) cannot be effectively directed, for Directed fuzzers are important tools in the portfolio of a security instance, towards problematic changes or patches, towards critical reseacher. Unlike undirected fuzzers, a directed fuzzer spends most system calls or dangerous locations, or towards functions in the of its time budget on reaching specific target locations without stacktrace of a reported vulnerability that we wish to reproduce. wasting resources stressing unrelated program components. Typical In this paper, we introduce Directed Greybox Fuzzing (DGF) applications of directed fuzzers may include which generates inputs with the objective of reaching a given set • patch testing [4, 21] by setting changed statements as targets. of target program locations efficiently. We develop and evaluate When a critical component is changed, we would like to check a simulated annealing-based power schedule that gradually as- whether this introduced any vulnerabilities. Figure 1 shows the signs more energy to seeds that are closer to the target locations commit introducing Heartbleed [49]. A fuzzer that focusses on while reducing energy for seeds that are further away. Experiments those changes has a higher chance of exposing the regression. with our implementation AFLGo demonstrate that DGF outper- • crash reproduction [18, 29] by setting method calls in the forms both directed symbolic-execution-based whitebox fuzzing stack-trace as targets.
    [Show full text]
  • The Rocky Road To
    The Rocky Road to Hanno Böck https://hboeck.de @hanno 1 Transport Layer Security A protocol to create an encrypted and authenticated layer around other protocols 2 TLS 1.3 was published in August 2018 3 How did we get there? 4 In 1995 Netscape introduced Secure Socket Layer or SSL version 2 5 In 1996 it was followed up with SSL version 3 6 In 1999 the IETF took over and renamed it to TLS 7 SSL/TLS History 1995: SSL 2 1996: SSL 3 1999: TLS 1.0 2006: TLS 1.1 2008: TLS 1.2 2018: TLS 1.3 8 Vulnerabilities C C S 9 Padding Oracles in CBC mode 10 Plaintext Plaintext Plaintext Initialization Vector (IV) block cipher block cipher block cipher Key Key Key encryption encryption encryption Ciphertext Ciphertext Ciphertext WhiteTimberwolf, Wikimedia Commons, Public Domain 11 CBC Padding for Block Ciphers (AES) Encryption of data blocks means we have to fill up space 12 CBC in TLS MAC-then-Pad-then-Encrypt 13 Valid Padding 00 01 01 02 02 02 03 03 03 03 ... 14 We assume a situation where the attacker can see whether the padding is valid 15 Ciphertext Ciphertext block cipher block cipher Key Key decryption decryption Initialization Vector (IV) ?== 00 -> padding valid Plaintext Plaintext Attacker wants to decrypt Attacker manipulates / XOR with guess 16 Ciphertext Ciphertext block cipher block cipher Key Key decryption decryption Initialization Vector (IV) ?== 01 01 -> padding valid Plaintext Plaintext Attacker knows Attacker manipulates to 01 Attacker wants to know Attacker manipulates to guess 01 17 2002: Serge Vaudenay discovers Padding Oracle Vaudenay,
    [Show full text]
  • An Analysis of the Transport Layer Security Protocol
    An Analysis of the Transport Layer Security Protocol Thyla van der Merwe Thesis submitted to the University of London for the degree of Doctor of Philosophy Information Security Group School of Mathematics and Information Security Royal Holloway, University of London 2018 Declaration These doctoral studies were conducted under the supervision of Professor Kenneth G. Paterson. The work presented in this thesis is the result of original research I conducted, in collabo- ration with others, whilst enrolled in the School of Mathematics and Information Security as a candidate for the degree of Doctor of Philosophy. This work has not been submitted for any other degree or award in any other university or educational establishment. Thyla van der Merwe March, 2018 2 Dedication To my niece, Emma. May you always believe in your abilities, no matter what anybody tells you, and may you draw on the strength of our family for support, as I have done (especially your Gogo, she’s one tough lady). “If you’re going through hell, keep going.” Winston Churchill 3 Abstract The Transport Layer Security (TLS) protocol is the de facto means for securing commu- nications on the World Wide Web. Originally developed by Netscape Communications, the protocol came under the auspices of the Internet Engineering Task Force (IETF) in the mid 1990s and today serves millions, if not billions, of users on a daily basis. The ubiquitous nature of the protocol has, especially in recent years, made the protocol an attractive target for security researchers. Since the release of TLS 1.2 in 2008, the protocol has suffered many high-profile, and increasingly practical, attacks.
    [Show full text]
  • The Fundamentals of Http/2 the Fundamentals of Http/2
    Ali Jawad THE FUNDAMENTALS OF HTTP/2 THE FUNDAMENTALS OF HTTP/2 Ali Jawad Bachelor’s Thesis June 2016 Information Technology Oulu University of Applied Sciences ABSTRACT Oulu University of Applied Sciences Degree Programme, Option of Internet Services Author: Ali Jawad Title of the bachelor’s thesis: Fundamentals Of HTTP/2 Supervisor: Teemu Korpela Term and year of completion: June 2016 Number of pages: 31 The purpose of this Bachelor’s thesis was to research and study the new ver- sion of HTTP ”HTTP2.0”, which is considered to be the future of the web. Http/2 is drawing a great attention from the web industry. Most of the Http/2 features are inherited from SPDY. This thesis shows how HTTP/2 enables a more efficient use of network re- sources and a reduced perception of latency by introducing a header field com- pression and allowing multiple concurrent exchanges on the same connection ”multiplexing” and more other features. Also, it discusses the security of Http/2 and the new risks and dangerous at- tacks that resurfaces with the arrival of this new protocol version. The simulation results show how HTTP/2 influences the page load time compar- ing to the other previous versions of HTTP. Keywords: HTTP1, HTTP/2, SPDY, SNI, DOS, CRIME, Downgrade-attack. 3 PREFACE This thesis was written for Oulu University of Applied Sciences and done during 1 February – 23 May 2016. The role of the instructor was guiding the thesis from the requirements and bases of writing a thesis document through meet- ings. The role of the supervisor was instructing the thesis plan and its require- ments which were done by the author.
    [Show full text]