UPnP安全性分析与模糊测试技术  

Vulnerability Analysis and Fuzz Testing of UPnP Protocol

作　　者：夏天一 梅阳 祝佳 XIA Tianyi;MEI Yang;ZHU Jia(No.30 Institute of CETC,Chengdu Sichuan 610041,China)

机构地区：[1]中国电子科技集团公司第三十研究所,四川成都610041

出　　处：《通信技术》2024年第4期416-422,共7页Communications Technology

基　　金：中国电科青年拔尖人才基金。

摘　　要：通用即插即用协议(Universal Plug and Play,UPnP)可以简化网络设备的发现、连接和配置过程,广泛应用于路由网关、智能家居等物联网设备。通过深入分析UPnP协议的通信机制和消息格式,分析了其潜在的安全风险。随后,采用模糊测试技术生成多样性的协议消息,通过发送这些消息识别UPnP实现中的潜在漏洞。不仅对UPnP协议的安全性做了全面的评估,而且提供了一种模糊测试方案,最后给出了安全防护建议。UPnP(Universal Plug and Play)protocol is designed to simplify the discovering,connecting and configuring process of network devices.It is widely used in IoT devices such as routers,gateways,and smart home appliances.The potential security risks of the UPnP protocol are analyzed through a detailed examination of its communication mechanism and message format.Subsequently,a diverse set of protocol messages is generated by using fuzz testing techniques,which is then sent to identify potential vulnerabilities in the UPnP implementation.This paper not only provides a comprehensive assessment of the security of the UPnP protocol,but also presents a fuzz testing approach and finally gives recommendations for security protection.

关 键 词：UPNP协议 模糊测试 漏洞挖掘 Boofuzz 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]