基于策略断言的SOAP消息签名包装攻击检测

SOAP Messages Based on Policy Assertions Signature Wrapping Attacks Detection

不合理的使用XML签名会使经过签名的SOAP消息文档的安全性下降,容易受到恶意者的攻击。人们通常使用XML签名来保护SOAP消息,然而恶意者有能力通过改变有效的SOAP消息,以到达其在未获得合法授权的条件下访问被保护的消息的目的。文章首先介绍签名包装攻击的含义,然后模拟出签名包装攻击场景,最后提出一个合理的自定义检测策略断言。实验证明基于可选元素的签名包装攻击的自定义检测策略断言是可行的。

Naive use of XML Signature may result in signed documents remaining vulnerable to undetected modification by an adversary.In the typical usage of XML Signature to protect SOAP messages,an adversary may be capable of modifying valid messages in order to gain unauthorized access to protected resources.In this paper,we first introduce the definition of signature wrapping attacks,then provide a possible scenario that enable these signature wrapping attacks,and last propose appropriate customized policy assertions.Our experiments show that the signature wrapping attacks detection based on customized policy assertions work very well.