Abstract: A type flaw attack on a security protocol is an attack where a field that is originally intended to have one type is subsequently interpreted as having another type. This paper describes type flaw attacks through some typical attack examples, and analyses the limitations of tagging scheme of preventing type flaw attack by J.Heather et al. In addition, other methods against type flaw attack by checking message length are presented.

Key words: security protocol, type flaw attack, protocol design

摘要： 类型漏洞攻击是对安全协议攻击的方法之一。当协议主体将所接收消息中的一种类型数据解释成其他类型数据时，就会发生类型漏洞攻击。该文描述了几种典型的类型漏洞攻击实例，结合实例指出了J.Heather等人提出的在消息中添加标识消息类型的附加信息以防止类型漏洞攻击的tag方法的局限性，并提出在协议实现中通过检测消息长度防止类型漏洞攻击的方法。

关键词: 安全协议, 类型漏洞攻击, 协议设计

CLC Number: 

• TP309