# Client-Aware Negotiation for Secure and Efficient Data Transmission
## 3 Methodology
### CAN Based on Renegotiation  
Typically, in the SSL/TLS protocol, the data transmission can begin once the handshake completes, but due to the limitation of the handshake protocol, it may take two handshakes before the data can be transmitted. The specific reason is shown in Figure 1. Negotiation of the encryption algorithm is completed in the server hello message. However, the client's certificate is sent to the server in the certificate message. Therefore, the identity information of the client cannot be obtained before negotiation. The flowchart of CAN based on renegotiation is shown in Figure 2. Firstly, the methods need to determine whether the handshake is completed, which means, in the near future, whether the session still needs to negotiate the way of communication. If the handshake is completed, the data transmission begins immediately after the session resume is completed. Session resume is used for the low-cost and fast resume of sessions, and data transmission can be carried out directly.If the handshake is not completed, the method needs to determine how many handshakes have been completed. If the current handshake is the first handshake, the client's certificate needs to be obtained, and the client's identity information needs to be obtained from the certificate. If the client being accessed needs the highest security strength of data transmission, renegotiation is not needed because the encryption security strength of the first handshake in the strategy is the highest. After completing the above operations by the client needing the highest security strength, the strategy considers the handshake as finished, and the data transmission starts. Figure 2: A flowchart of client-aware negotiation based on renegotiation. If a client does not need the highest level of security, first, the number of handshakes is changed in the corresponding position of the handshake information table. After that, the client information table is searched, then the corresponding encryption scheme is found and deployed. Finally, the server initiates the renegotiation, asking the client to re-initiate the handshake. When the client allows the renegotiation, the client initiates a second handshake. After a series of message exchanges, the client and server complete a second two-way authentication. Then, if the certificates of both parties meet the requirements, data transmission begins. The server cannot obtain the client's certificate before the handshake, so it cannot obtain the client's identity information. At this point, a unique connection can be determined by the IP and port of the client. During the server cache time, which means some client's information such as the number of handshakes is still stored in the server, a client corresponds to only one connection, and a connection serves only one client. Thus, clients can be differentiated by a connection, which makes it possible to determine how many handshakes the connection has completed with the second handshake. The connection information is stored in the handshake information table. Both the handshake information table and the client information table have their own processing mechanisms. The handshake information table maintains clients' handshake information, which is used to record the handshake number of the connection and whether the handshake was successful. This table needs to periodically remove redundant data; the storage time of the handshake information is the same as the server cache time. When the system deletes some cached data, the clients' handshake information is also deleted. The client information table records the client's corresponding secure data transmission scheme. Unlike the handshake information table, the client information table is stored as a file in the shared area. If the administrators want to change user information, just the file needs to be changed. The user information is not stored on the server. Take the actual scenario of deploying OpenSSL on the Apache server as an example.