Predictive Eviction: A Novel Policy for Optimizing TLS Session Cache Performance

Transport Layer Security (TLS) is the most commonly used security protocol to encrypt web traffic. TLS connections are computationally expensive to set up, so the TLS protocol supports session resumption, where previously negotiated connection parameters can be used to short- circuit the TLS handshake. The server assigns new sessions a session identifier (ID) and caches each session by its ID so it can be retrieved later. As clients come and go, sessions in the server's cache will have to be evicted according to the server's eviction policy. We find that first-in-first-out (FIFO) and least-recently- used (LRU) are the most common session cache eviction policies among popular TLS libraries, however, for applications whose clients connect at regular intervals, such as mobile advertising, the performance of these policies may be far worse than randomly evicting policies from the cache. To handle this, we propose a novel eviction policy for TLS session caches, predictive eviction, that relies on the server knowing the next time each client will connect again. Using a real-world application of such a policy, Android in-application advertising, we build a client that is able to simulate the behavior of a large number of devices requesting mobile advertisements over TLS. We use this simulated client to benchmark the hit rate of the predictive policy compared with eviction policies found in popular TLS library implementations. In addition, we demonstrate that our policy can be implemented efficiently by benchmarking its performance in transactions per second compared with OpenSSL's session cache implementation, and compared with TLS session tickets (an alternative to session caching for resuming TLS sessions). We find that our policy has better hit rate performance than other eviction policies, and can achieve comparable performance to session tickets. To the best of our knowledge, this is the first study of the performance of TLS session resumption strategies.

I. Introduction

TLS (and its predecessor SSL) is a collection of cryptographic protocols that are designed to support confidentiality, integrity, and authenticity of network connections. It is the de facto standard for securing Internet communications such as web browsing (HTTPS) and email (SMTP over TLS). As TLS connections are computationally expensive to set up, because they require public key cryptography, TLS supports session resumption, where parameters of a previous connection can be reused to avoid the cost of establishing a new connection with a returning client. If the client and server both have stored session information from a previous connection, they can resume the previous session without public key cryptography and using fewer messages than a full handshake, making resuming sessions much cheaper than creating new ones. To resume sessions, clients and servers must store recently negotiated sessions. Whereas clients only need to store a handful of sessions, one for each TLS server with which the client has recently communicated, servers may need to store a large number of sessions if they have many active clients, but the memory required to store these sessions may exceed the server's capacity or degrade the server's performance. Moreover, sessions become stale over time as clients terminate and purge their session information, either because sessions are held in memory or because it would be insecure to continue using session information for long periods of time. To handle these problems, a TLS server provides session caches to store recently negotiated sessions and evicts sessions when the cache overflows.