作者投稿和查稿 主编审稿 专家审稿 编委审稿 远程编辑

计算机工程 ›› 2008, Vol. 34 ›› Issue (8): 177-178. doi: 10.3969/j.issn.1000-3428.2008.08.062

• 安全技术 • 上一篇    下一篇

安全协议类型漏洞攻击研究

王 鹃1,张焕国1,高 峰2   

  1. (1. 武汉大学计算机学院,武汉 430072;2. 山东省南水北调管理局,济南 250013)
  • 收稿日期:1900-01-01 修回日期:1900-01-01 出版日期:2008-04-20 发布日期:2008-04-20

Type Flaw Attacks on Security Protocol

WANG Juan1, ZHANG Huan-guo1, GAO Feng2   

  1. (1. Computer School, Wuhan University, Wuhan 430072; 2. Office of South-to-North Water Transfer Project of Shandong Province, Jinan 250013)
  • Received:1900-01-01 Revised:1900-01-01 Online:2008-04-20 Published:2008-04-20

摘要: 类型漏洞攻击是对安全协议攻击的方法之一。当协议主体将所接收消息中的一种类型数据解释成其他类型数据时,就会发生类型漏洞攻击。该文描述了几种典型的类型漏洞攻击实例,结合实例指出了J.Heather等人提出的在消息中添加标识消息类型的附加信息以防止类型漏洞攻击的tag方法的局限性,并提出在协议实现中通过检测消息长度防止类型漏洞攻击的方法。

关键词: 安全协议, 类型漏洞攻击, 协议设计

Abstract: A type flaw attack on a security protocol is an attack where a field that is originally intended to have one type is subsequently interpreted as having another type. This paper describes type flaw attacks through some typical attack examples, and analyses the limitations of tagging scheme of preventing type flaw attack by J.Heather et al. In addition, other methods against type flaw attack by checking message length are presented.

Key words: security protocol, type flaw attack, protocol design

中图分类号: