中国IDC产业年度大典---基于语义的WEB访问安全检测--下

1ValidatingWebAccessingWithSemanticconstraints基于语义的WEB访问安全检测胡振宇工信部NSACE项目技术专家启明星辰资深工程师2SemanticSecurity-Informally•DifferentstructuresmayhavethesamesemanticsQueryWHEREANDaccounts=SELECTcardnumFROM=unamejohncardtype+ChangedSQLsyntacticaltree211SELECTcardnumFROMaccountsWHEREuname='John'ANDcardtype=1+123SemanticSecurity-Informally•Thesyntaxisconcernedwiththeformofexpressionswhichareallowedinthelanguage.•Thesemanticdefinitioncoulddescribetheeffectofexecutingorevaluatinganysyntacticallycorrectexpressionorprogram,oritcoulddescribehowtoexecuteorevaluatethem.•Theessenceofwebapplicationsecurityisthesemanticsecurity(i.e.invalidationoftheintendedsemantic)4SemanticSecurity-Formally•Awebapplicationisafunctionwhichinputsn-tuplesofstringsandoutputsaqueryexpress•Ifthequeryexpressproducedbythewebapplicationcannotresultinviolationofintendedsemantic,theuserrequestiscalledsemanticsecurity.1(,,)nWebstrstrQueryexpress“红楼梦”,“2”“INSERTINTOorders(title,amount,cost)VALUES(‘红楼梦’,2,2*50)”5SemanticSecurity-Formally•The(denotational)semanticofaprogramisdetermineduniquelybyitssyntacticstructureandthesemanticofitems.•Justasthesyntactictree,thesemanticoftheprogramcanalsoberepresentedasaparsetree,whichwecalledassemantictree.6SemanticTemplate•Aprogramsemanticcanbeconductedbyconstrainingthesemanticofitemsinasyntacticstructure–Morespecifically,thesemanticofaprogramcanbedetonatedbyconstraintorassignthesemanticsofleafnodesinthesyntactictree.•Asyntactictreewithsemanticallyconstrainedleafnodesiscalledasemantictemplate.7SemanticTemplateBoxedCharactersimplysemanticconstraintsofuser’sinputsQueryWHEREANDaccounts=SELECTcardnumFROM=unamenamecardtypetypeSemantictemplateofaSQLqueryIntegerString8SemanticTemplate•Thesemantictemplateoforderproblem红楼梦QueryVALUES(title,amount,cost)INSERTINTOordersSQLsemantictemplateforordering*amountprice()500Integer10009SemanticValidation•ForeveryHTTPrequest,validatethequerystringproducedbythewebapplication.•Validatethesemanticofthequerystringtoconfirmthatusersubmissioncannotcauseanyunintendedsemanticwhenexecutedbythebackenddatabase10ValidationAlgorithm•Step1.Parsethequerystringassyntactictree;•Step2.Inthequerytree,cutoffalltheleavesthataredeeperthanthedepthofsemantictemplatetree;•Step3.Ifthetrimmedquerytreeisisomorphicwiththetemplatetree,and•Step4.Thesemanticofeachleavesofthetrimmedquerytreeisconfinedwithinthesemanticofthecorrespondedleavesofsemantictemplatetree,then•Step5.Thequeryissemanticsecurity11Implementation•Toformvalidsemantic,theuserinputsshouldbe–leavesofthesemantictemplatetree,–childrenofleavesofthesemantictemplatetree.•Sotheresultsemantictemplatecanbeconvertedintothesemanticconstraintsoftheuserinputs—usertemplate.12CaseStudy•Theusertemplatefortheorderingproblemisas:–name:type=string,maxlength=20,value=红楼梦,alterable=no;–amount:type=integer,constraint=“0and1000”;–price:type=float,value=50.00,alterable=no13Applications•SQLinjection•XSSinjection•Formmodification•XPathinjection•Shellinjection14ChallengeandFurtherWork•Constructionofsemantictemplate–Manually–Automatically–Hybridly•Furtherevaluationthetechnology15谢谢！