Towards a Safe Playground for HTTPS and Middle Boxes with QoS2

Abstract

With the increasing concern for network security and privacy, adoption of HTTPS has sky-rocket, with over 50% of traffic flows employing HTTPS. Unfortunately by encrypting the data, HTTPS eliminates the benefits provided by Middle-boxes such as proxies and caches. We claim that these limitations, highlight the need for alternative mechanisms for quickly and safely viewing websites: QoS2. QoS2 argues for fine-grained identification of common web-content and user-specific content, which are then deliver over either HTTP or HTTPS respectively. The main challenge in enabling a framework, such as QoS2, lies in ensuring that security is not compromised, namely vulnerability to Man in the Middle attacks. QoS2 overcomes such attacks, by judiciously employing object level checksums which are sent exclusively over the HTTPS connection. To quantify the benefits of QoS2, we have manually tagged the content for a number of sites and emulated an QoS2 server: initial results are promising with QoS2 providing 20%-70% speed up over traditional HTTPS.