網際網路在現今扮演著非常重要的角色，相對的，網路安全是一個不可忽視的問題。隨著網路的快速發展，WWW被廣泛地應用，已成為傳遞各種資訊的使用者介面以及軟體工具，帶給使用者包羅萬象的內容。另一方面，網路安全議題的範圍也不斷地擴大延伸，由通訊協定層級升到應用層級，僅僅靠著防火牆或單純的安全存取控制已不足以抵抗網路上泛濫的攻擊。保護個人電腦或是內部網路，應提升至應用層級，也就是檢視文件封包內容。利用傳統的防毒軟體以及經驗可以由病毒特徵、傳播方式、社交工程技巧來找出這些惡意程式，然而，原本是以善意保護封包內容的加密技術，避免遭非法竊聽或惡意竄改，卻反而成為網路安全設備偵測過程中的漏網之魚，成為攻擊者躲避檢測的另一管道，直接或間接地影響到內部伺服器或者是網路整體的安全。
要作到深層檢測，確保整個網路安全，防火牆應該具備檢視加密封包的能力。因此，我們在這篇論文中，提出SSL代理伺服器的設計與實作，主要的工作為檢視HTTPS加密封包的內容。在此架構下，可以將文件封包還原成未加密的狀態，提供給應用層級防火牆做深層封包檢查，在通過檢查後，再轉送到原本提供資料的伺服器。另外，在SSL代理伺服器的運作過程之中，由於已獲得原始的封包內容，可以結合許多應用層服務，我們也搭配實作快取功能。而本篇的討論重點將在於SSL代理伺服器還原封包內容的過程。我們將討論設計與實作過程遭遇到的問題及解決方式，並循序說明如何利用SSL Handshake的特性，加速建立連線，以及使用SSL彈性的加解密演算法，減少傳輸資料過程中的計算負擔。在此技術下，既可達成我們檢視封包，達成深層內容檢測，同時，又可以分擔原網頁伺服器的負載。

As usage of the Internet for typical applications increases and new e-commerce and extranets proliferate, World Wide Web (WWW) has become a popular, powerful and convenient tool and application for billions of users. It offers global access to nearly any type of information. However, another disturbing trend has been with regard to the types of attacks malicious parties have been launching. Network security continues to increase in importance. It has comes a security underside fraught with increasing communications and productivities associated with access information, email, streaming media, instant message, etc. While several years ago most attacks exploited network-level vulnerabilities such as flaws in the TCP/IP protocol, today’s hackers primarily exploit application-level bugs and come into next generation network attacks. Blended attacks that target new vulnerabilities found in applications. The Intrusion Detection System (IDS) engine ensures that protocols are indeed valid, the application headers are compliant according to the application's legal syntax and semantics, the header values are validated and overflows are prevented as well as analyzes the application payloads and searches for both known and unknown malicious contents. However, the higher-level attacks used by well-disciplined intruders are often transmitted via encrypted SSL connections to web servers and appeared to be legitimate business activity to network-level security device, these attacks can easily penetrate traditional firewalls and the IDSes.
This thesis presents an approach to a practical framework of the SSL Proxy Server which performs cryptographic functions, decrypts packets, restores the origin contents of HTTPS traffic, also provides layer-7 application firewall to inspect the contents and identity the signatures. After performing in-depth intrusion detection analysis, the SSL proxy server, then forwards secure traffic to the origin web server. Besides, the proxy server also provides several application-layer services such as caching technique due to cipher-text traffic has been decrypted already. In our points of view in this thesis will focus on the detail procedures of restoring content from encrypted packet. Furthermore, exploring the potentials of innovation and improving the performance, the framework has the ability to take advantage of a characteristic of SSL known as resume handshake. It reduces the burden of establishing connection between SSL proxy server and origin web server. In addition, the flexibility and comprehensive SSL cipher suites help transferring data in diverse context. As a result, the refinement not only mitigates the traffic between SSL proxy server and web server but also off-loads SSL processing from web server. We implement our proposal to demonstrate the efficiency functionalities and also give experimental results for all the proposed techniques.

[1] Check Point Software Technologies Ltd., “Check Point Multi-Layer Security: Attack Prevention Safeguards and Attacks Blocked,” 2003, http://www.checkpoint.com/products/downloads/vsx_attacks_prevent_blocked.pdf
[2] Diane Crawford, “Defense In Depth Gets the Worm,” Communications of the ACM Volume 47, Issue 2, Feb. 11-13, 2004
[3] Roger Crandell, James Clifford, and Alexander Kent, “A Secure and Transparent Firewall Web Proxy,” Proceedings of the 17th Conference on Systems Administration (LISA 2003), San Diego, CA, October 26-31, 2003, pages 23-30
[4] Check Point Software Technologies Ltd., “Stateful Inspection Technology,” 2004, http://www.checkpoint.com/products/downloads/Stateful_Inspection.pdf
[5] Sapiro, Benjamin. “Application Level Content Scrubbers,” SANS InfoSec Reading Room, August 22, 2001, http://www.sans.org/rr/firewall/scrubbers.php
[6] Fortinet, whitepaper. “The importance of web content filtering,” 2004, http://www.fortinet.com/leads/action/leadRequest.do?categoryId=10
[7] Caleb Sima, SPI Dynamics, “Security at the Next Level: Are Your Web Applications Vulnerable?,” http://www.spidynamics.com/support/ whitepapers/webappwhitepaper.pdf, August 2004
[8] A. Frier, P. Karlton and P. Kocher, “The SSL 3.0 Protocol,” Netscape Communication Corporation, Nov. 1996
[9] Eric Rescorla, “SSL and TLS : designing and building secure systems,” Addison-Wesley, 2001
[10] Yao-Wen Huang, Shih-Kun Huang, Tsung-Po Lin, Chung-Hung Tsai, “Web Application Security Assessment by Fault Injection and Behavior Monitoring,” The Twelfth International World Wide Web Conference, Budapest, Hungary, May 20-24, 2003, pages 148-159
[11] “Snort.org”, http://www.snort.org
[12] eEye Digital Security. “Analysis: .ida “code red” worm,” http://www.eeye.com/html/Research/Advisories/AL20010717.html,2001.
[13] eEye Digital Security. “Blaster worm analysis,” http://www.eeye.com/html/Research/Advisories/AL20030811.html,2003.
[14] Incidents.org. “Nimda worm/virus report,” http://www.incidents.org/react/nimda.pdf.
[15] D. Moore, V. Paxson, S. Savage, C. Shannon, S. Staniford, and N. Weaver. “Inside the slammer worm,” IEEE Magazine on Security and Privacy, 1(4), July 2003, pages 33-39
[16] Curphey et. al. Mark. “A Guide to Building Secure Web Applications.” The Open Web Application Security Project, Sep 2002.
[17] OWASP. “The Ten Most Critical Web Application Security Vulnerabilities.” OWASP Whitepaper, version 1.0, 2003.
[18] D.Wagner and B.Schneier, “Analysis of the SSL 3.0 Protocol,” The Second USENIX Workshop on Electronic Commerce Proceedings, Berkeley, CA , Nov. 18-21, 1996, pages 29-40
[19] Arthur Goldberg, Robert Buff, Andrew Schmitt, “Secure Web Server Performance Dramatically Improved By Caching SSL Session Keys,” Workshop on Internet Server Performance, SIGMETRICS'98, Madison, Jun. 24-26, 1998
[20] T. Dierks, C. Allen, “RFC 2246: The TLS Protocol Version 1.0,” Jan 1999
[21] Stephen A. Thomas, “SSL & TLS Essentials: Securing the Web,” Wiley, 2000
[22] Blake-Wilson, S., Nystrom, M., Hopwood, D., Mikkelsen, J., and Wright, T. “RFC 3546: TLS Extensions,” June 2003
[23] Coarfa, C., Druschel, P., and Wallach, D., “Performance analysis of TLS web servers,” In Proceedings of Internet Society's 2002 Symposium on Network and Distributed System Security (NDSS), San Diego, California, Feb. 6-8, 2002, pages 183-194
[24] Arthur Goldberg, Robert Buff, Andrew Schmitt, “A Comparison of HTTP and HTTPS Performance,” Computer Measurement Group, CMG98, Anaheim, CA, Dec. 6-11, 1998, pages 226-331
[25] George Apostolopoulos, Vinod Peris, Debanjan Saha “Transport Layer Security: How much does it really cost?,” In Proceedings IEEE INFOCOM '99, New York, Mar. 23-25, 1999, pages 717-725,
[26] Infonetics Research, http://www.infonetics.com/
[27] J. Elson, A. Cerpa, "RFC 3507 : Internet Content Adaptation Protocol", April 2003
[28] “OpenSSL project”, http://www.openssl.org
[29] John Viega, Matt Messier, Pravir Chandra, “Network Security with OpenSSL,” O'Reilly, 2002
[30] Duane Wessels , “Web Caching,” O'Reilly and Associates, June 2001
[31] V. Beltran, J. Guitart, D. Carrera, J. Torres, E. Ayguade and J. Labarta. “Performance Impact of Using SSL on Dynamic Web Applications,” XV Jornadas de Paralelismo, Almeria, Spain, Sep. 15-17, 2004, pages 471-476 (Also as Research Report number: UPC-DAC-2004-39 / UPC-CEPBA-2004-6, November 2004).
[32] W. Richard Stevens, “TCP/IP Illustrated, Volume1,” Addison Wesley,1999
[33] W. Richard Stevens, “Unix Network Programming : Interprocess Communications,” Prentice Hall , 1998
[34] W.A. Vanhonacker, “Characterizing Web Content,” CAIA Technical Report 040227A, February 2004
[35] L. Bent , M. Rabinovich , G. M. Voelker , Z. Xiao, “Characterization of a large web site population with implications for content delivery,” In Proceedings of the 13th conference on World Wide Web, New York, NY, May 17-20, 2004, pages 522-533
[36] M. Portmann, A. Seneviratne, “Selective Security for TLS,” Proceedings Ninth IEEE International Conference on Networks, Bangkok, Thailand, Oct. 10-12, 2001, pages 216- 221
[37] SGI, “WebStone World Wide Web server benchmarking.” http://www.sgi.com/Products/WebFORCE/WebStone/.
[38] OWASP, http://www.owasp.org/codeseeker/
[39] Peter Burkholder, "SSL Man-in-the-Middle Attacks V2.0,” SANS Institute, February 1, 2002
[40] “Anti-Phishing”, http://www.antiphishing.org/
[41] Adam Hess, Jason Holt, Jared Jacobson, Kent E. Seamons , “Content-triggered trust negotiation,” ACM Transactions on Information and System Security (TISSEC), Aug. 2004, Volume 7 Issue 3, pages 428-456
[42] H. Shacham and D. Boneh. “Fast-Track Session Establishment for TLS,” In Proceedings of Internet Society's 2002 Symposium on Network and Distributed System Security (NDSS), San Diego, California, Feb. 6-8, 2002, pages 195-202
[43] WAP Forum, “Wireless Transport Layer Security,” April 2001. http://www.wapforum.org