FreeBSD优化：应对高带宽应用的TLS性能提升策略

127 浏览量更新于2024-08-25 收藏 400KB PDF 举报

本文档《Optimizing TLS for High-Bandwidth Applications on FreeBSD - Netflix (asiabsd_2015_tls)》主要探讨了在现代互联网中，随着 Transport Layer Security (TLS) 的广泛应用，对高带宽应用服务器性能的影响以及针对这一问题的优化策略。作者们来自 Netflix，分别来自公司本身和外部咨询顾问，他们关注的是 Netflix 的 Open Connect Appliance (OCA) 在启用 TLS 时遇到的CPU计算和数据移动开销。首先，文章强调了TLS在保障网络通信安全方面的重要性，特别是在当前不安全的互联网环境下，它被视为不可或缺的技术。然而，这同时引发了两个主要挑战：一是对客户端性能的影响，二是服务器端，特别是处理大量视频流量时，CPU和数据传输效率的显著下降。服务器端的性能瓶颈主要体现在加密/解密、证书验证、以及与客户端的密集交互上，这些操作消耗了大量的计算资源。针对这些问题，作者深入研究了在FreeBSD系统上启用TLS对OCA的具体影响，并探索了可能的优化措施。他们着重分析了FreeBSD系统在TLS处理中的瓶颈，包括内核级优化、网络堆栈的改进以及OpenCryptoFramework（OCF）的潜力。OCF是一个用于加速加密算法的框架，通过调整和扩展其内部实现，可以提高性能。文中提到的具体优化策略可能包括但不限于： 1. **内核级优化**：通过改进TLS内核模块，减少不必要的系统调用，提升数据处理的效率。 2. **高效数据缓存**：利用内存缓存技术减少重复加密和解密操作，减少CPU负载。 3. **硬件加速**：利用SSL/TLS加速卡或者Intel QuickSync等硬件特性来加速加密过程。 4. **协议优化**：研究和实施更高效的TLS版本或协议变种，如QUIC（Quick UDP Internet Connections），以降低延迟和带宽占用。 5. **并发处理**：优化多线程或异步处理机制，提高并发连接的处理能力。未来，作者们还提到了FreeBSD在OpenCryptoFramework方面的改进计划，这些改进旨在进一步提升性能，例如增强算法支持、减少内存消耗，以及更好地整合硬件加速能力。本文为IT专业人士提供了一种视角，展示了如何在确保网络安全的前提下，通过系统优化和架构设计，降低TLS在高带宽应用中的性能损耗，这对于数据中心和网络服务提供商来说具有实际的指导意义。

Optimizing TLS for High–Bandwidth Applications

in FreeBSD

Randall Stewart

Netﬂix Inc.

100 Winchester Circle

Los Gatos, CA 95032

USA

Email: rrs@netﬂix.com

John-Mark Gurney

Consultant

Oakland, CA

USA

Email: jmg@freebsd.org

Scott Long

Netﬂix Inc.

100 Winchester Circle

Los Gatos, CA 95032

USA

Email: scottl@netﬂix.com

Abstract—Transport Layer Security (TLS) is becoming in-

creasingly desirable and necessary in the modern Internet.

Unfortunately it also induces heavy penalties on application

CPU performance for both the client and server. In this paper

we examine the server-side performance implications on CPU

computational and data-movement overhead when enabling TLS

on Netﬂix’s OpenConnect Appliance (OCA [1]) network. We then

explore enhancements to FreeBSD to reduce the costs that TLS

adds when serving high volumes of video trafﬁc. Finally we

describe recent changes and future improvements to FreeBSD’s

OpenCrypto Framework that can be used to further improve

performance.

I. INTRODUCTION

Transport Layer Security [2] (TLS) is becoming an opera-

tional requirement in today’s unfriendly Internet. It provides

both encryption and authentication to any application that

enables it; but as with many improvements it also comes at a

high cost in terms of additional CPU cycles. Up until recently

Netﬂix has not enabled TLS on its OpenConnect Appliances

(OCA).

An OCA is a FreeBSD-based appliance that serves movies

and television programming to Netﬂix subscribers. Conﬁden-

tial customer data like payment information, account authenti-

cation, and search queries are exchanged via an encrypted TLS

session between the client and the various application servers

that make up the Netﬂix infrastructure. The actual audio and

video content session is not encrypted. At ﬁrst glance, this

might seem like a glaring oversight, but the audio and video

objects are already protected by Digital Rights Management

(DRM) that is pre-encoded into the objects prior to them being

distributed to the OCA network for serving. The addition of

TLS encryption to these objects was previously not considered

to be a high priority requirement.

Evolving market forces as well as the changing landscape of

the internet [3] have caused us to re-evaluate our view on TLS.

The computational cost of TLS serving is high, so with this

in mind Netﬂix launched a small pilot project to explore what

impacts enabling TLS would have on its products. We also

started to examine recent innovations in FreeBSD for ways

that we might be able to reduce the costs of TLS.

Fig. 1. Classic Web Serving

II. THE IDEA

The Netﬂix OpenConnect Appliance is a server-class com-

puter based on an Intel 64bit Xeon CPU and running FreeBSD

10.1 and Nginx 1.5. Each server is designed to hold between

10TB and 120TB of multimedia objects, and can accommodate

anywhere from 10,000 to 40,000 simultaneous long-lived TCP

sessions with customer client systems. The servers are also

designed to deliver between 10Gbps and 40Gbps of continuous

bandwidth utilization. Communication with the client is over

the HTTP protocol, making the system essentially into a large

static-content web server.

A traditional web server will receive a client request for

an object stored on a local disk, allocate a local buffer for

the object data via the malloc(3) library call, then issue a

read(2) system call to retrieve and copy the contents of the

object into the buffer, and ﬁnally issue a write(2) system call

to copy the buffer contents into a socket buffer which is then

transmitted to the client. This process usually involves two

or more data copies handled directly by the CPU as well

as some associated consumption of CPU cache and memory

bandwidth. This simple data ﬂow model (see Fig 1) works

well and is easily maintainable for low-bandwidth needs, but

is taxing on the CPU for high bandwidth applications. Early

tests in the OCA development process showed that the server

下载后可阅读完整内容，剩余5页未读，立即下载

weixin_38663169

粉丝: 2
资源: 915

FreeBSD优化：应对高带宽应用的TLS性能提升策略

[Linux英文原版图书系列].PRENTICE_HALL-Optimizing_Linux_Performance_A_Hands_On_Guide_To_Linux_Performance_Tools.chm

Optimizing--pulse-moment.rar_核磁共振

Intel Parallel Studio XE

spark structured streaming

AI-Assisted Low Information Latency Wireless Networking

visual studio openssl

Optimizing Multi-UAV Deployment in 3D Space to Minimize Task Completion Time in UAV-Enabled Mobile Edge Computing Systems

com.netflix.client.ClientException: Load balancer does not have available server for client: mleip-service-base

aggregation applications

最新资源