SSL page access with new authentication and new SSL session every request

Edit online

In this test case the client has an SSL connection to the WebSEAL server, which requires authentication and encryption, and accesses the Web page on the back end WebSphere® Application Server via an unencrypted connection (TCP junction). These transactions involve a handshake for every transaction and a transfer on 100 (encrypted) bytes.

Using a page size of 100 B

Encryption algorithm: AES-128

eseal13 — Figure 1. 100 B SSL page access BA

This test case puts a large load on the client machines. The client encryption and decryption is done in software and as the number of clients on a single machine increases, a single client becomes a bottleneck. For one of our test cases, four client machines were used. Performance Toolkit for z/VM® showed the utilization on the cryptographic accelerator cards as follows:

Total operations: 119589
Utilization: 18.7%

Table 1 shows the results of collecting statistics on the cryptographic card every 5 seconds during the workload execution. We were interested in the length of the pending operations queue.

Table 1. Collection statistics on the cryptographic card
Pending Queue Length											Total Operations
	0	1	2	3	4	5	6	7	8	Average	Card 1	Card 2
Frequency	4	13	16	10	3	7	2	1	4	2.88	63949	55640

Observations

Using software encryption leads to a complete utilization of the WebSEAL server with one CPU. Even with hardware encryption, the system is almost fully utilized, therefore, we did not increase the load further. Increasing the number of CPUs from one to two resulted in an improvement of 88% for the same workload. Here we have the biggest improvement when using hardware encryption support. It is between a factor of two and a factor of three for the same workloads. The average queue length of the cryptographic cards of 2.88 shows that the cards are under a significant load.

Conclusion

This test does only authentication with very small pages to generate the maximum overhead. Both hardware cryptographic features, the CPACF from the CPU for decryption and encryption of the requests and the CEX2C cryptographic adapter feature for the authentication are used. This enables the workload to be increased beyond what is possible using software encryption. In the last test we were able to improve the total throughput of the system by about a factor of three by using hardware cryptographic support.