HTTPS Transmission Encryption Practice

HTTP and HTTPS

Concepts of HTTP and HTTPS

HTTP (HyperText Transfer Protocol) is among the most widely used network protocols on the Internet. It was originally designed to facilitate the publication and retrieval of HTML pages. Resources accessed via HTTP or HTTPS are identified using Uniform Resource Identifiers (URIs).

The HTTP protocol transmits data in plain text and does not offer any encryption. This means that if an attacker intercepts the data transfer between a browser and a website server, they can easily read the information. As a result, HTTP is not suitable for transmitting sensitive data, such as credit card details or passwords.

HTTPS (Hypertext Transfer Protocol over Secure Socket Layer) is a secure version of HTTP designed to enhance security. HTTPS integrates the SSL protocol with HTTP. SSL relies on certificates to verify the server's identity and to encrypt communication between the browser and the server.

Differences between HTTP and HTTPS

The differences between HTTPS and HTTP are mainly concentrated in the following 4 points:

• The HTTPS protocol requires the server to obtain a certificate from a trusted Certificate Authority (CA) in advance.
• HTTP transmits data in plain text, whereas HTTPS ensures secure transmission by using SSL encryption.
• HTTP and HTTPS operate with different connection methods and ports. HTTP uses port 80, while HTTPS operates on port 443.
• HTTP connections are simple and stateless. In contrast, the HTTPS protocol integrates SSL with HTTP to enable encrypted transmission and identity verification, making it significantly more secure than HTTP.

Use HTTPS to ensure BOS data security

BOS fully supports both HTTP and HTTPS transmission protocols. The specific interaction process between BOS and these protocols is illustrated in the following diagram.

Use HTTP

When a client uses the HTTP protocol for communication, the plain text nature of HTTP increases its vulnerability to malicious attacks, such as interception and tampering by intermediaries, during data transmission, posing potential security risks.

Using HTTPS

HTTPS ensures encrypted communication, and BOS has obtained a certificate from a CA. The certificate is only trusted by the client when it is properly associated with the BOS server.

During transmission, BOS will first send its certificate information to the client. The client then verifies its authenticity. Upon successful verification, the client and BOS will negotiate a random symmetric encryption key. Subsequently, all communication between the client and BOS is encrypted using a secure symmetric encryption algorithm. Even if intercepted by a malicious entity, the encrypted data remains secure and prevents attacks, ensuring the protection of transmission data.

Performance impact

Since HTTP uses plain text and HTTPS employs encrypted transmission, they differ in aspects such as response time (QPS), throughput (network bandwidth), and resource utilization. Factors contributing to response time include RTT (Round Trip Time), encryption and decryption times, and back-end read/write processing time. The impact also varies based on factors like the OpenSSL version, encryption algorithm used, and the RTT to the BOS server.

HTTPS introduces additional delay compared to HTTP due to the SSL interaction process, requiring two extra RTTs. For instance, if the ping time is 40 ms, HTTPS will incur an additional delay of 80 ms compared to HTTP.

In favorable network conditions with large files, the impact of choosing HTTPS is negligible. However, in poor network conditions with smaller files, such as in scenarios like image processing, the delay introduced by HTTPS becomes more pronounced.

Configuration example

To ensure the reliability of your data during transmission, we recommend using the HTTPS protocol. Currently, the BOS API and SDK fully support HTTPS configuration.

API method

When accessing via API, configure the port protocol to HTTPS based on the programming language you're using.

SDK method

When using SDK access, please refer to the configuration methods of SDKs in different languages:

• [Java SDK - Configuring HTTPS protocol to access BOS](BOS/SDK/Java-SDK/Initialization.md#Configure HTTPS access to BOS)
• [Python SDK - Configuring HTTPS protocol to access BOS](BOS/SDK/Python-SDK/Initialization.md#Configure HTTPS access to BOS)
• [PHP SDK - Configuring HTTPS protocol to access BOS](BOS/SDK/PHP-SDK/Initialization.md#Configure HTTPS access to BOS)
• [C# SDK - Configuring HTTPS protocol to access BOS](BOS/SDK/C-Dotnet-SDK/Initialization.md#Configure HTTPS access to BOS)
• [Android SDK - Configuring HTTPS protocol to access BOS](BOS/SDK/Android-SDK/Initialization.md#Configure HTTPS access to BOS)