基于策略断言的SOAP消息签名包装攻击检测  

SOAP Messages Based on Policy Assertions Signature Wrapping Attacks Detection

作　　者：李根来[1] 赵逢禹[1] 

机构地区：[1]上海理工大学光电信息与计算机工程学院,上海200093

出　　处：《微计算机信息》2011年第10期129-131,共3页Control & Automation

摘　　要：不合理的使用XML签名会使经过签名的SOAP消息文档的安全性下降,容易受到恶意者的攻击。人们通常使用XML签名来保护SOAP消息,然而恶意者有能力通过改变有效的SOAP消息,以到达其在未获得合法授权的条件下访问被保护的消息的目的。文章首先介绍签名包装攻击的含义,然后模拟出签名包装攻击场景,最后提出一个合理的自定义检测策略断言。实验证明基于可选元素的签名包装攻击的自定义检测策略断言是可行的。Naive use of XML Signature may result in signed documents remaining vulnerable to undetected modification by an adversary.In the typical usage of XML Signature to protect SOAP messages,an adversary may be capable of modifying valid messages in order to gain unauthorized access to protected resources.In this paper,we first introduce the definition of signature wrapping attacks,then provide a possible scenario that enable these signature wrapping attacks,and last propose appropriate customized policy assertions.Our experiments show that the signature wrapping attacks detection based on customized policy assertions work very well.

关 键 词：SOAP消息 XML签名 包装攻击 安全策略断言 

分 类 号：TP311.133.1[自动化与计算机技术—计算机软件与理论]