SSL page access through a TCP junction

Using a page size of 5.8 KB

In this test case the client has an SSL connection to the WebSEAL server, which requires authentication and encryption, and accesses the Web page on the back end WebSphere® Application Server via an unencrypted connection (TCP junction).

Because it involves SSL access, these tests compare software encryption against hardware encryption. Encryption occurs between the client and WebSEAL. The AES-128 encryption algorithm was used for encryption operations between the client and WebSEAL. In this test, only one handshake occurred.

Encryption algorithm: AES-128

Observations

The WebSEAL system ran fully CPU constrained with one CPU in these tests. The cryptographic hardware support increased the throughput. However, using more workload generators only had an impact when additional CPU capacity was available.

Conclusion

In this environment there are two systems, the WebSEAL server and the WebSphere Application Server, that have high CPU loads. Therefore, the availability of CPU resources for these systems is a major component that affects the total throughput. The cryptographic hardware support gives the CPU on the WebSEAL server some relief, which leads to an increase in throughput. Using more CPUs resulted in higher throughput and allowed us to increase the number of workload generators, which increased the throughput further. In all cases, the CPU utilization for the other servers needed to implement the WebSEAL environment is very low. This confirms that this environment is ideal for consolidation under z/VM® because of the capability to run with more virtual CPUs than physical CPUs available. The four CPUs of the z/VM LPAR are only utilized to 50%, which means we could have run this test with only three CPUs on the LPAR while granting one more CPU to the WebSEAL system to use the full system.

Using a page size of 12 KB

In this test case the client had an SSL connection to the WebSEAL server, which requires authentication and encryption, and accesses the Web page on the back end WebSphere Application Server via an unencrypted connection (TCP junction). In order to better show the benefits of the symmetric encryption acceleration, the page size was increased to 12 KB.

Encryption algorithm: AES-128

Observations

The larger the page size, the lower the throughput in terms of pages per second.

Conclusion

This is expected because the larger page size needs more time to be transferred from the application server to the client. For the impact of the hardware cryptography support, see the conclusion of Using a page size of 2.9 MB.

Using a page size of 2.9 MB

In this test case the client has an SSL connection to the WebSEAL server, which requires authentication and encryption, and accesses the Web page on the back end WebSphere Application Server via an unencrypted connection (TCP junction). In order to better show the benefits of the symmetric encryption acceleration, the page size was increased from 12 KB to 2.9 MB.

Encryption algorithm: AES-128

Impact of cryptographic hardware

For a better comparison, the throughput was normalized to throughput per client. Figure 4 shows the improvement using the cryptographic hardware for encryption for each request size.

Observations

Comparing Figure 1 in SSL page access through a TCP junction with Figure 1 in Non-SSL page access through a TCP junction, unauthenticated shows that using SSL encryption between the client and WebSEAL server degraded the throughput by about 35% for a page size of 5.8 KB without hardware support. Using hardware support increased the throughput by 30%, so the throughput was now only 12% below the unencrypted case. Figure 4 shows that the advantage of the hardware encryption increases with the page size as expected. For the 2.9 MB page size, the improvement was up to 143% which is more than twice what software encryption gets.

Conclusion

The additional effort for the SSL encryption and decryption requires CPU resources, which, in the case of a fully utilized system, leads to a degradation of the throughput. Using the CPACF hardware support reduces the cost to a minimum. For large pages we saw an improvement of a factor of 2.4 compared with software encryption.