XML重写攻击检测技术研究

Study on Detecting Technique for XML Rewriting Attack

细粒度的XML数字签名中存在重写攻击的问题,已有多种方案用来检测XML重写攻击。文中在分析评估了这些检测方案的基础上,讨论了针对各种常见重写攻击类型的安全应对方案以及各种检测方案的最佳应用场景。研究结果表明:安全策略、验证互补(过滤器)、Fast XPath以及标记DOM树中元素位置方案能有效地检测到常见的重写攻击方式,且除内联法及验证互补(位置指示器)方案外,已有方案都可应用于有效的检测中间人攻击和重放攻击的场景中。然而,针对修改签名元素上下文关联信息的攻击方式,已有方案都不能检测到。

There is rewriting attack problem in the free-grained XML digital signature now. There are several can be used to detect XML rewriting attack. It makes a discussion on the security scheme to deal with the common rewriting attacks and the best appli- cation scenarios of the existing detection scheme based on the analysis and evaluation of the existing detection scheme. The study results show that security policy,verification complementary （filter） ,FastXPath and mark element position scheme in the DOM tree can detect the common attacks effectively and existing scheme can apply to detecting man-in-the-middle attack and repay attack effectively except for inline approach and verification complementary （position indicator ） scheme. However, for attacks against modifying signature element context-sensitive information, all the existing detection scheme can＇t detect.