Selective security for TLS

Abstract

Today's computing environments are becoming increasingly heterogeneous, mostly due to the growth of mobile computing. In this environment, application layer proxies that can adapt and tailor the content to the client's needs and capabilities as well as to the available network resources are highly beneficial. The problem is that content adaptation proxies are generally incompatible with the notion of end-to-end security. The only generic solution to this problem is the concept of selective security. The idea is to apply security selectively only to the sensitive elements of a data stream and expose the rest to any intermediary system for potential content adaptation. None of the currently used security protocols provides an API for fine-grained control of the application of security mechanisms to a data stream. We propose a simple extension to the transport layer security protocol (TLS), which provides the application with an interface for selectively protecting elements within a data stream. We also discuss a generic application scenario that shows how the proposed extended features can be used in conjunction with content adaptation proxies.