作者投稿和查稿 主编审稿 专家审稿 编委审稿 远程编辑

计算机工程 ›› 2010, Vol. 36 ›› Issue (22): 129-131. doi: 10.3969/j.issn.1000-3428.2010.22.045

• 安全技术 • 上一篇    下一篇

基于SOAP消息的过度加密攻击检测算法

高文婕,赵逢禹   

  1. (上海理工大学光电信息与计算机工程学院,上海 200093)
  • 出版日期:2010-11-20 发布日期:2010-11-18
  • 作者简介:高文婕(1985-),女,硕士研究生,主研方向:SOA,Web服务安全;赵逢禹,教授
  • 基金资助:
    国家自然科学基金委员会与中国民用航空局联合基金资助项目(60979011);天津市自然科学基金资助项目(09JCYBJC02300)

Oversized Cryptography Attack Detection Algorithm Based on SOAP Message

GAO Wen-jie, ZHAO Feng-yu   

  1. (School of Optical-Electrical and Computer Engineering, University of Shanghai for Science and Technology, Shanghai 200093, China)
  • Online:2010-11-20 Published:2010-11-18

摘要: 分析Web服务中的过度加密攻击场景、攻击特点以及SOAP消息特征,提出一种基于简单对象访问协议消息(SOAP)消息的过度加密攻击检测算法。通过检测标签ReferenceList的属性个数统计SOAP消息的加密次数,并将统计出的加密次数与预先设定的阈值进行比较,从而判断是否存在过度加密攻击。在.net WSE安全平台下验证了该检测算法的有效性。

关键词: DoS攻击, 简单对象访问协议消息, 过度加密攻击, Web服务

Abstract: This paper analyzes attack scene, attack features of oversized cryptography and Simple Object Access Protocol(SOAP) message feature of oversized cryptography in Web service, and presents an oversized cryptography attack detection algorithm based on SOAP message. Encryption frequency is counted by detecting the number of attribute in the label of ReferenceList. Then, encryption frequency and the predetermined value are compared to determine oversized cryptography is included or not. The validity of detection algorithm is tested on Web service platform of Microsoft .net WSE.

Key words: DoS attack, Simple Object Access Protocol(SOAP) message, oversized cryptography attack, Web service

中图分类号: