於雲端平台上設計XML-based包裹式攻擊防禦機制之研究

Design Issues of XML-based Wrapping Attacks Protection Scheme in Cloud Platform

楊欣哲(Shin-Jer Yang) ； 黃妤萱(Yu-Hsuan Huang)

《資訊管理學報》 28卷2期 (2021/04) Pp. 155-182

摘要

由於雲端運算技術的迅速發展與應用普及，它是基於共享的計算資源透過虛擬化而形成的多台虛擬機器。政府企業皆使用雲端運技術來提高組織在資訊服務上的競爭力。雲端運算其服務可分為IaaS、PaaS與SaaS等三層，一般民眾也受益於雲端運算技術所帶來的好處。面臨雲端時代，雲端安全及用戶隱私也成為一項重要的議題。由於雲端用戶經常透過網路瀏覽器向雲端服務供應商請求服務，當一個經過簽署的訊息請求從服務供應端發送至服務接收端時，攻擊者可透過包裹式攻擊（Wrapping Attacks）來竄改網路上傳輸的XML或SOAP訊息，藉由躲避合法的驗證並在未被檢測到的情況下存取Web服務以實行包裹式攻擊。本文針對雲端運算環境下包裹式攻擊進行探討，透過整合並改善Node Counting預防機制，提出新的包裹式攻擊防禦機制，稱為ENC-WRAP。透過此ENC-WRAP防禦方法，延續Node Counting方法將判斷條件加以改良，分為攔截、檢測與記錄三個模組對傳入的XML或SOAP請求進行分析，除了比對子節點出現的次數，也對根節點至最終節點路徑上的元素進行檢測，以強化位在檢測模組上的驗證流程。模擬實驗結果顯示包裹式攻擊的ENC-WRAP方法相較Node Counting方法，於50、100、200、500個請求封包數量下，偵測率分別提升了2%、3.8%、3.7%、2.8%，準確率分別提升8%、7%、10.5%及9.5%。由於將路徑上的元素納入考量，平均處理時間上分別多花費了1%、1.3%、0.2%、0.6%的時間。未來，ENC-WRAP方法可利用Docker虛擬機器技術改善計算資源之使用率以縮短平均處理時間。整體而言，本文所提出的ENC-WRAP方法，於雲端運算環境下能更準確地判斷包裹式攻擊者，進而降低雲端服務之安全風險並提升其服務品質。

關鍵字

雲端運算 ； ENC-WRAP ； Node Counting ； 包裹式攻擊 ； SOAP

並列摘要

Purpose-Cloud computing technology is a virtual machine formed through virtualization based on the sharing of computing resources. There are three service models including IaaS, PaaS and SaaS. Facing the cloud era, cloud security and user privacy have also become essential issues in cloud platform. Since cloud users often use Web browsers to request for services from cloud service providers, when a signed message request is sent to the service receiver from the service provider, attackers can use wrapping attacks to tamper with the XML or SOAP messages transferred through the internet in order to avoid legal verifications and access Web services without being detected to implement wrapping attacks. This paper is to combine and improve Node Counting mechanism to propose a new XML-based wrapping attack protection scheme called ENC-WRAP under cloud platform. Design/methodology/approach-This ENC-WRAP is a continuation on the Node Counting method and the determining conditions were improved and divided into three modules: interception, detection and logging; it performs analysis to the incoming XML or SOAP requests. Not only does it compare the number of times the child node appears, but also perform detection to the elements on the path between the root node to the final node in order to enhance the verification procedure on the detection module. Findings-The experimental results of KPIs for ENC-WRAP scheme indicate that the Detection rate can be increased by 2%, 3.8%, 3.7% and 2.8%; the Accuracy rate can be increased by 8%, 7%, 10.5% and 9.5%; and the Average processing time is increased by 1%, 1.3%, 0.2% and 0.6% in 50, 100, 200, and 500 packet requests, respectively, under cloud computing environment. However, we will utilize Docker virtual machines technique to shorten the Average processing time. Research limitation/implications - In the future, we will enhance the utilizations of computing resources and shorten the Average processing time by Docker virtual technology. Also, we will perform more simulations to consider the other KPI of APT (Average Processing Time) to obtain more efficient and effective results. Practical implications - Practically, this paper designed new XML-based Wrapping Attacks Protection: scheme called ENC-WRAP to improve the verification process of the original Node Counting mechanism, the proposed ENC-WRAP can determine wrapping attackers more accurately to reduce the security risk and improve the quality of services in cloud computing platform. Originality/value-The XML or SOAP request sent by the sender, which will be intercepted; as compared from Node Counting, not only is the frequency of child node appearances compared, elements on the path from the root node to the end node were also detected to discover illegal incoming requests and deny the requests for enhancing the verification process in proposed ENC-WRAP scheme.

並列關鍵字

Cloud Computing ； ENC-WRAP ； Node Counting ； Wrapping Attacks ； SOAP

參考文獻

李根來、趙逢禹（2011），『基於策略斷言的 SOAP 消息簽名包裝攻擊檢測』，未出版碩士論文，上海理工大學，上海。

維基百科，『SOAP 簡單物件存取協定』，https://zh.wikipedia.org/wiki/%E7%AE%80%E5%8D%95%E5%AF%B9%E8%B1%A1%E8%AE%BF%E9%97%AE%E5%8D%8F%E8%AE%AE, Retrieved on 2019/09/10.

Gajek, S., Jensen, M., Liao, L. and Schwenk, J. (2009), ‘Analysis of signature wrapping attacks and countermeasures’, Proceedings of the IEEE International Conference on Web Services, Los Angeles USA, pp. 575-582.

Gupta, A.N. and Santhi, T.P. (2016), ‘Detection of XML signature wrapping attack using node counting’, in Vijayakumar, V. and Neelanarayanan, V. (Eds), Proceedings of the 3rd International Symposium on Big Data and Cloud Computing Challenges (ISBCC-16’). Smart Innovation, Systems and Technologies, Springer, Cham, Vol 49.

Jensen, M., Meyer, C., Somorovsky, J. and Schwenk, J. (2011), ‘On the effectiveness of XML schema validation for countering xml signature wrapping attacks’, 2011 1st International Workshop on Securing Services on the Cloud (IWSSC), IEEE, Los Angeles USA, July 9, pp. 7-13.