云计算中对SOAP消息中PDKEEPAAA签名的反包装攻击
Countering Wrapping Attack on XML Signature in SOAP Message for Cloud Computing
摘要：
众所周知，Web应用程序之间的信息交换是通过SOAP协议完成的。对于任何计算机网络来说，保护此协议显然都是一个至关重要的问题。然而，当涉及到云计算系统时，这个问题的敏感性上升，因为系统的客户端将他们的数据发布到云。采用XML签名来保证SOAP消息的安全。然而，也有一些弱点，已被确定，命名为XML签名包装攻击，已被归类为四个主要的群体：简单的查询上下文攻击，可选元素上下文攻击，兄弟值上下文攻击，兄弟顺序上下文。本文分析和研究了现有的两种引用SOAP消息签名部分的方法，即ID引用和验证方法。此外，提出了一种新的方法，并进行了测试，以确保SOAP消息。该方法利用XML数字签名的概念对SOAP消息进行签名，防止了XML任意签名包装攻击。实验结果表明，该方法的速度比传统方法快约3倍，甚至比ID快一点。
英文摘要：
It is known that the exchange of information between web applications is done by means of the SOAP protocol. Securing this protocol is obviously a vital issue for any computer network. However, when it comes to cloud computing systems, the sensitivity of this issue rises, as the clients of system, release their data to the cloud. XML signature is employed to secure SOAP messages. However, there are also some weak points that have been identified, named as XML signature wrapping attacks, which have been categorized into four major groups; Simple Ancestry Context Attack, Optional element context attacks, Sibling Value Context Attack, Sibling Order Context. In this paper, two existing methods, for referencing the signed part of SOAP Message, named as ID referencing and XPath method, are analyzed and examined. In addition, a new method is proposed and tested, to secure the SOAP message. In the new method, the XML any signature wrapping attack is prevented by employing the concept of XML digital signature on the SOAP message. The results of conducted experiments show that the proposed method is approximately three times faster than the XPath method and even a little faster than ID.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
