# Client-Aware Negotiation for Secure and Efficient Data Transmission
## 3 Methodology
### CAN Based on Renegotiation
To handle HTTPS transmission, the Apache server interacts with OpenSSL through the default module of Apache: mod_ssl. In OpenSSL, an SSL structure is used to represent an SSL connection. The structure preserves the information during a handshake and cleans up some messages after a handshake is complete. After a certain amount of time, the connection information is cleared by the server. The implementation of the SSL/TLS handshake protocol is controlled by OpenSSL, specifically by the function SSL_Accept in OpenSSL. This function is responsible for the overall processing of the handshake protocol and realizes the handshake message exchange through the state machine mechanism. One-way authentication, two-way authentication, and session resume are all realized by function SSL_Accept through the state machine mechanism. In theory, the CAN method based on renegotiation can be implemented by modifying SSL_Accept in OpenSSL. However, because the implementation of OpenSSL is not inherited and varies widely from version to version, it is less compatible due to the large differences between versions. For example, there are considerable differences between OpenSSL 1.0.2, OpenSSL 1.1.0, and OpenSSL 1.1.1. The implementation at the Apache server level is inherited, so this method can be applied to different versions of OpenSSL. The scenario discussed in this section was deployed on the Apache server and revolves around the handshake. The Apache server controls the handshake through the Input Output (IO) module in mod_ssl, which is used at the beginning of both receiving and sending data. For the server, the handshake is the first behavior initiated by the client, so the handshake function is executed first in the input function. In the first handshake, the client certificate is sent to the server via a certificate message. For standard client certificates in X509 format, Apache stores certificate information in the SSL structure. In the client's certificate, the subject_name field contains the client identity information \(C=\{n,e,s,v\}\). Therefore, this field can be used to obtain the identity information of the client and the corresponding security transmission policy of the client through the client information table. These secure transmission schemes are embodied in OpenSSL as cipher suites and certificates for clients to set up key exchange, authentication, data encryption, and signature. The CAN-SEAT strategy ensures that the corresponding secure transmission scheme is used for the next SSL handshake and data transmission by setting the corresponding cipher suite for the SSL connection and encrypting the certificate using the asymmetric encryption algorithm of the corresponding security strength. Renegotiation can only be performed during the full handshake phase. However, it cannot be performed in the session resume stage with only partial handshake behavior, as the system security will be seriously affected. First, we need to set the renegotiation flag to \"allow\" before invoking the renegotiation. Renegotiation can operate against SSL structures. After the operation is invoked, the server requests the client to perform the renegotiation by sending a hello request message. During the second handshake, the cipher suite negotiation is completed after the server sends the server hello message. At this point, a client-aware set of secure transmission strategies is implemented. However, since the client still needs to provide the certificate for the second handshake, the two submitted certificates still need to be compared at this point. If the client refuses to submit the certificate the second time or if it is different from the first certificate, the connection will fail to handshake. Finally, the renegotiation flag needs to be banned to avoid security issues. After the previous steps are completed, CAN based on renegotiation is fully deployed. Let us consider the design of an encryption scheme. Firstly, a default encryption scheme needs to be set for the first handshake.