Trans-encrypting HTTP Adaptive Streaming

Measuring Performance Overhead of Trans-encrypting HTTP Adaptive Streaming

System & Network Engineering (SNE) Research Paper — University of Amsterdam & TNO Medialab (2017)
Author: A.T. Wiersma BSc | Mentors: Oskar van Deventer & Thijs van Veugen (TNO)

Research Findings at a Glance

• Untrusted CDNs: Trans-encryption using split-key cryptography enables secure distribution of DRM-protected content over entirely untrusted third-party Content Delivery Networks (CDNs) because content is never decrypted to cleartext at any intermediate point in the pipeline.
• Performance Benchmark: Split-key RSA trans-encryption (encryption step) achieved 18.7% throughput of the passthrough baseline (almost sufficient to support 100 concurrent 1080p H.264 streams on 2017 commodity hardware).
• Decryption Bottleneck: RSA decryption on the edge server is computationally expensive, achieving only 0.5% baseline throughput (1 stream capacity) due to CPU-bound asymmetric exponentiations.
• AES Comparison: Standard AES-128 re-encryption performs much faster (51.3% baseline throughput) but requires temporary cleartext exposure on the edge server, presenting a security threat window.
• Hardware Optimization: AES performance benefits heavily from native CPU hardware-acceleration (AES-NI). Trans-encryption can achieve similar viability by offloading RSA operations to GPUs or specialized accelerators.

Research Abstract

The content distributors take content protection and Digital Rights Management of content very serious. As such many provisions already exist to make sure content is securely sent to, and only to, licensed clients. In this paper an alternative content encryption system is proposed by using the homomorphic features of asymmetric cryptography systems.

Using a split-key derivative of the RSA cryptosystem, representing asymmetric split-key cryptography, the overhead of doing a trans-encryption operation on an edge was evaluated. The results show that using the split-key RSA cryptosystem degrades performance significantly over using a similar AES-128 re-encrypting cryptosystem but show area for improvement. Although the split-key RSA cryptosystem doesn’t perform satisfactory it does provide the ability to distribute over untrusted third-party Content Delivery Networks (CDNs) as content is never decrypted along the pipeline, where this is the case for the similar AES-128 cryptosystem.

Core Concepts & Methodology

• HTTP Adaptive Streaming (HAS): Video streaming technologies (like MPEG-DASH) that slice video files into small segments (e.g., .m4s) and dynamically adjust playback resolution/bitrate in response to client network congestion.
• Trans-encryption: A patented cryptographic routing method where encrypted content is converted from one key to another on intermediate servers (such as CDNs) without being decrypted to plaintext first.
• Split-key Cryptography: Multiplicative property of consecutive exponentiations where public keys $e_1, e_2$ and private keys $d_1, d_2$ are generated with a shared modulus $n$, such that sequential operations yield $(X^{e_1})^{e_2} \equiv X^{e_1 \cdot e_2} \pmod n$.
• Edge Processing: A C-based OpenSSL engine utilizing Japronto (asynchronous python HTTP toolkit built on uvloop) and wrk load generators to test passthrough, AES-128 re-encryption, and split-key RSA trans-encryption paths.

Citation

Wiersma, A. T.: Measuring Performance Overhead of Trans-encrypting HTTP Adaptive Streaming, Master System and Network Engineering, University of Amsterdam & TNO Medialab, Netherlands, 2017.