25 About what prevent spoofing of misusing a session information

Size: px

Start display at page:

Download "25 About what prevent spoofing of misusing a session information"

せせらたなせ
5 years ago
Views:

1 25 About what prevent spoofing of misusing a session information

2 Web Web [1]. [2] SAS-2(Simple And Secure password authentication protocol, ver.2)[3] SAS-2 i

3 Abstract About what prevent spoofing of misusing a session information Hiroki TAHARA It s increasing XSS(cross-site scripting) in a web-application vulnerability recently. XSS is used for one of a misusing session information. And a attacker get spoofing with the misusing session information. In this paper, I have proposed to prevent spoofing using SAS-2(Simple And Secure password authentication protocol, ver.2) to confirm a regular user when a session information leak. And i was to evaluate safety and compare the preceding method. key words Session-management, XSS, SAS-2 ii

4 ID ID ID HTML HTML ID Cookie SAS SAS iii

5 SAS ID Cookie iv

6 ID ID ID SAS SAS i i v

7 vi

8 1 web SNS EC SNS EC Web ID ID HTTP ID Web ID ID 1

9 2 2.1 Web 2.1 Web Web Web Web Web Web Web ID ID Web ID Web 2

10 2.2 ID ID ID Cookie 2.2 Cookie Web Web HTTP Cookie ID Cookie Web Cookie Web HTTP Cookie Web Cookie ID Cookie Web Web Web Web Cookie [4][7] A 3

11 ID A ID ID A A [2] ID ID ID 4

12 ID ID ID 2.5 ID 5

13 2.3 ID ID 2.6 ID ID [2] ID 2.3 HTTP [8][9] 6

14 2.3 Cookie Cookie ID URL Cookie ID 2.7 7

15 [2] HTML HTML HTML HTML < > & HTML < > & HTML HTML HTML <script> javascript: <xscript> xjavascript: java&#09:script javascript: HTML 8

16 2.3 HTTP Content-Type Content-Type: text/html: charset=utf-8 charset HTML Content-Type HTML +ADw-script+AD4-alert(+ACI-test+ACI- )+ADsAPA-/script+AD4- UTF- <script>alter( test );</script> 2.8 9

17 IPA [1] ID ID ID 2 ID Cookie 10

18 2.4 ID ID ID ID ID ID Cookie ID Cookie Cookie Web javascript ID ID Cookie Web 2 11

19 3 ID Cookie SAS-2(Simple And Secure password authentication protocol, Ver.2) SAS SAS-2 SAS-2 SAS-2 [3][5][6] User Server User ID 12

20 3.1 SAS-2 S X F H H(x) x i N i i SAS-2 SAS-2 SAS SAS-2 1. ID S N 1 ID S N 1 A=X(ID S N 1 ) 2. ID A 3. ID A 13

21 3.1 SAS SAS-2 SAS i SAS-2 1. ID S N i A=X(ID S N i ) N i+1 User Server =C (F(C)+A) =F(C) A 2. ID Input ID,S Generates a rondom number N1 3. and Stores N1 A F(C) = A A=X(ΙD,S N1) C= (F(C)+A) F(C) F(ID, C) ID,Α (secure) Stores ID,A 14

22 3.1 SAS-2 4. A C = H(ID,F(C)) H(ID,F(C)) 15

23 3.1 SAS-2 User Data strages : Ni Server Data strages : ID,A Input ID,S A=X(ΙD,S Ni) Generates a rondom number Ni+1 and stores Ni+1 C=X(ΙD,S Ni+1) F(C)=F(ID,C) α=c (F(C)+Α) β=f(c) Α ID,α,β F(C)=β Α C=α (F(C)+Α) True F(C)=F(ID,C)? Authentication fail True A=C γ=η(ιd,f(c)) γ 3.2 SAS False i γ=h(id,f(c))? True Authentication fail 16

24 3.2 SAS-2 SAS-2 (i+1) = E (F (E) + C) = F (E) C ID. = x (F (x) + C) = F (x) C ID i SAS SAS-2 SAS-2 17

25 3.2 SAS Application Web browser Web browser Web Web server web Q web P I ID Web browser Cookie R HTTP X F H H(x) x i N i i SAS-2 ID 18

26 3.2 SAS-2 ID N 1 A=X(N 1 ) 2. Q A Q A 3. Q P 4. IDI I A 5. HTTP R IDI 6. I Cookie I 19

27 3.2 SAS

28 3.2 SAS-2 ID ID 3.4 i 1. N i A=X(N i ) N i+1 C=X(N i+1 ) = C A = (F(C) + A) A 2. IDI 3. A = A C = (F( ) + A) 4. A 5. A C = (A) 6. HTTP R 7. H(F(X(N i ))) Cookie N i N i+1 21

29 3.2 SAS i 22

30 4 4.1 ID Cookie ID ID i +1 = E (F (E) + C) = F (E) C 23

31 4.2 = x (F (x) + C) = F (x) C i LAN ID Cookie Cookie ID Cookie Cookie Cookie ID i Cookie Cookie

32 java java HTTP java API HttpURLConnection HttpURLConnection A POST Cookie PHP POST A 160bit SHA

33 4.2 H/W OS PHP CPU 4.1 centos 64bit php GHz intel Coure 2 Duo 480Mb H/W OS mac osx 10.6 java CPU 4.2 JDK GHz intel Coure 2 Duo 4Gb 26

34 URL SAS API 2 java API currenttimemillis Google Chrome SSL HTTP 2 Google Chrome HTTP ms/ 17.4 SSL ms/ ms/ SAS HTTP ms/ SAS ms/ ms/

35 ID ID Cookie ID SSL ID ID SSL 41.8 ms SAS ms SSL 6 SAS HTTP HTTP HTTP SSL

36 5 SAS ID SSL ID ID Cookie Cookie java Google Chrome fire fox 29

37 30

38 [1] IPA,, [2] IPA, 6,, pp.22-28, [3] T.Tsuji, A.Shimizu, A one-time password authentication method for low spec machines and on internet protocols, IEICE Trans.Commun., vol.e87-b, no.6. pp , [4], Web : HTTP URI HTML REST,, pp.80-87, [5], SAS-2,,, pp.31-34, [6], SAS Web,,, pp.19-33, [7] IETF, HTTP State Management Mechanism, [8],,,,,, pp.31-32, [9],,, www,:, pp.22-24, [10],,,,,

LAN LAN LAN LAN LAN LAN,, i

22 A secure wireless communication system using virtualization technologies 1115139 2011 3 4 LAN LAN LAN LAN LAN LAN,, i Abstract A secure wireless communication system using virtualization technologies