【作者】 朱军；

【导师】 肖凌；

【作者基本信息】 华中科技大学 ， 计算机技术， 2016， 硕士

【摘要】 WebSocket作为HTML5中引入的客户端与服务器进行异步全双工通信的方案,在服务器推送和实时通信等领域中得到广泛应用。但是WebSocket协议没有对请求连接的用户进行身份认证,存在连接被跨站劫持的风险,攻击者可能利用该漏洞冒充用户身份,建立恶意连接。在分析WebSocket标准协议及其连接握手和数据传输安全性的基础上,对伪装用户身份或者在用户不知情的情况下劫持用户连接的问题进行研究,提出构建WebSocket安全子协议wsguard进行漏洞防御的方案。然后从理论上分析安全子协议的可行性,设计协议语法、语义以及时序,核心在于身份认证和数据传输机制。子协议通过混合加密算法协商密钥、传输身份认证信息,在连接请求处理和数据解析时验证确认客户端身份,保障数据安全,较好地解决了WebSocket存在的跨站劫持风险。在Node平台上通过一个简单的系统对设计的协议进行了实现,为了验证有效性,将其添加到现有的开源项目中,使用Iron WASP、Burp Suite等漏洞测试工具对子协议进行针对性的扫描和攻击测试,并从功能和性能两个角度对比分析测试结果,证明子协议能够大幅提升WebSocket安全性,并且没有显著影响应用响应时间,符合预期需求。更多还原

【Abstract】 WebSocket as a client and server asynchronous full-duplex communication scheme were introduced in HTML5,which widely used in server-push, real-time communications and other fields. But the WebSocket protocol is not authenticate the user which request for connection,so the connection has risk of been cross site hijacked. Attacker could exploit the vulnerability to pretend to be a user’s identity and establish malicious connections.Based on thoroughly analyze the standard protocol and its security of connection handshake and data transmission, this paper discuss the issue which disguise user’s identify or hijack the connection without user’s knowledge, propose a defense strategy which construct a security subprotocol called wsguard of WebSocket. Then analyzes the theoretical feasibility security of subprotocol and design the syntax, semantics and timing sequence, the core is identity authentication and data transmission mechanism. The subprotocol wsguard guarantee the security of data and can be well solved the risk of cross site hijacking in WebSocket via use the hybrid encryption algorithm to negotiate the key,transfer identity authentication information and verify the identity of the client when handle connection request and parse data.According to the design of protocol, it is implemented based on the Node platform via a sample system. In order to verify the effectiveness of subprotocol, it is configured in the existing open source project, scan and attack it by vulnerability testing tool such as Iron WASP and Burp Suite, then compare with the test results and analysis,it is proved that the sub-protocol can significantly improve the security of WebSocket, and has no significant impact on the application response time, in line with the expected demand.更多还原