Protecting Web Services from DDOS Attack
-
Upload
ponraj -
Category
Investor Relations
-
view
3.195 -
download
0
description
Transcript of Protecting Web Services from DDOS Attack
Protecting Web Services from
DDOS Attacks
T.Ponraj MCA,
Research Assistant ,
Pondicherry University ,
Puducherry.
Web services
• Software components that can be published,
located, and run over the Internet using Extensible
Markup Language (XML).
• A web service is a software application that works
over the internet.
• A web service is service-oriented application that
communicates over the web using messages
• The web service is also a software, with its own
class and methods .
Working of web service
A request by the client application constitutesconstruction and sending a SOAP request usingHTTP to the web server.
For a web service to work, the computer has to beconnected to the internet.
The web server hosts the class and its methods of aweb service, for a client computer to request anduse.
Any client computer located any where in the world,with an internet connection can request and use theclass and its methods of the web service.
Web Service Technologies
The Web
XML
SOA
A web service is service-oriented application that
communicates over the web using messages.
Web Service Roles
Service provider :-
Who develops or supplies the service.
Service consumer (or) Requester :-
Who uses the service.
Service broker :-
Facilitates the advertising and discovery process.
Operation on web service
Register :-
The service provider registers the service with aservice broker.
Find :-
The service broker gives the service consumerdirections on how to find the service and its servicecontract .
Bind :-
The service consumer uses the contract to bind the client to the service, at which point the client and service can communicate.
Web Service Standards
WSDL :-
WSDL provides a mechanism to describe a Web
service.
UDDI :-
UDDI provides a mechanism to advertise and
discover a Web service.
SOAP:-
SOAP provides a mechanism for clients and
services to communicate.
Functional SOA
FIND
Denial Of Service
The prevention of authorized access to resources or the
delaying of time critical operations.
Targets for a DoS attack include the communications
bandwidth, memory buffers, computational resources,
the network protocol or application processing logic of
the victim, or any systems on which the victim depends
for delivering service e.g. the domain name system
(DNS) or credit card payment service.
DOS in Web Services
• WS messages are expressed using the XML
technology, which itself contains DoS vulnerabilities,
these extend to WS applications.
• The loosely-coupled nature of WS applications means
that clients need access to application metadata in
order to invoke services.
• The authentication of each and every request can itself
be exploited by attackers due to the heavy processing
required by some authentication systems, especially
those based on public-key cryptography.
Literature Survey
• Paper # 1 : “Protecting Web Services from DDOS
attacks by SOAP message validation”
• Paper # 2 : “Defending Web Services against DOS
attacks using Client puzzles”
• Paper # 3 : “Validating DOS vulnerabilities in Web
Services”, Sep 2010.
• Paper # 4 : “JXTA & Web Services using Secret key
based Encryption”
Paper # 1 : SOAP Validation
Attacks :-
Result :-
CheckWay Gateway
1. Protocol Deviation Attack
2. Resource Exhaustion
Author :-
Nils Gruschka
Norbert Luttenberger
Christian-Albrecht's-University of Kiel
1.1. Protocol Deviation Attacks
Protocol Deviation Attacks exploit vulnerabilities inimplementations of protocol processing entities.
In some cases a single packet that diverges fromthe intended protocol flow can make the attackedsystem crash.
A well-known example is Ping of Death.
1.2. Resource Exhaustion
Resource Exhaustion attacks consume the
resources necessary to provide the service
(network bandwidth, memory and computation
resources).
The simplest attack produces an extremly high
network traffic load to the system providing the
service.
A well-known example is Dump Flooding.
2.1 Results
CheckWay Gateway is an XML validation engine,
which validates the SOAP message to the
appropriate schemas.
If the validation is successful, the SOAP message
is forwarded.
SOAP messages containing an ”unlimited” number
of elements do not match the (hardened) schema
and are rejected.
2.1 CheckWay Web Service Firewall
Paper # 2 : Client Puzzles
Attacks :-
Result :-
Client Puzzles
1. Flooding Attack
2. Semantic Attack (or)
Heavy Cryptography Attack
Author :-
Suriadi Suriadi , Dougles Stebila ,
Andrew Clark And Hua Liu .
Queensland University of Technology ,
Australia.
2.1. Flooding Attack
This attack attempts to exhaust a server’s
resources by sending a large amount of
legitimate requests.
An attack cannot be detected by relying on a
signature-based XML firewall.
An attack is mitigated through some forms of
lower network layer packet analysis, such as IP
address analysis.
2.2. Semantic Attack
It is the heavy cryptographic processing attack in
which an attacker sends a payload with an
oversized WS-Security header containing many
cryptographic elements.
The goal is to overload the server’s resources,
either through parsing a large security header or by
forcing the server to process the numerous
cryptographic directives.
2.3. Result
• Client puzzles, also called proofs of work, can be usedto counter resource-depletion denial of service attacks.
• Before a server is willing to perform somecomputationally expensive operation, it requires thatthe client commit some of its own resources and solvesome moderately hard puzzle.
• The most commonly proposed type of client puzzle is ahash-based computation-bound puzzle, in which aclient is required to find a partial preimage in acryptographic hash function.
H(C;NS;NC;X) = 0 … 0 || Y
dH - Cryptography Hash Function , C - Client ,
NS - Server Nonce , CS - Client Nonce , X - Client Solution
d - Bits , Y - String .
The client puzzle protocol
Buffer
ServerClient
Service request R
O.K.
Request puzzle
Result puzzle
Paper # 3 : Validating DOS
Attacks :-
Result :-
SNMP
MIB
1. Deeply-Nested XML
2. WSDL Flooding
3. Heavy Cryptographic Processing
4. Malformed External Schema
Referencing
Author :-
Suriadi Suriadi , Andrew Clark And
Desmond Schmidt .
Queensland University of Technology ,
Australia.
3.1. Deeply – Nested XML
This type of attack exploits the SOAP format,
which allows the embedding of excessively nested
XML in the message body.
The SOAP message is then sent to a WSprovider.
The goal is to force the XML parser within the
service to exhaust the memory resources of the
host system by processing numerous deeply-
nested documents, and so cause a denial of
service.
3.2. WSDL Flooding
WSDL specifications are in most cases publicly
accessible, access is often unauthenticated.
As a result, a brute force DoS attack could be
initiated by sending a large number of WSDL
requests.
3.3. Heavy Cryptographic Processing
The SOAP message also allows for multiplesignature blocks to be included within a SOAPheader.
Therefore, an attacker could craft a SOAP messagecontaining only one <wsse:Security> header block,but with a large number of <ds:Signature> elements.
To process every <ds:Signature> element, resultingin CPU exhaustion, since the signature verificationprocess involves heavy public key cryptographicprocessing. A similar attack also targets messageencryption.
3.4.Malformed external Schema Referencing
The syntax of an XML schema specification allows adocument to reference an externally defined XMLnamespace.
An XML parser may then attempt to contact thereferenced location to obtain the schema.
This attribute of XML processing can result in varioustypes of DoS. One type of attack references amalformed schema.
In another type of attack a malicious provider maypoint to a bogus schema location that instead causesthe parser to retrieve a large or malicious payload.
3.5. Results
• The Network Interface Card may be saturated
with traffic and the available CPU and memory
resources may be very limited.
Two interface cards :-
• The monitoring network carries no attack traffic,
only monitoring requests, it is available for
measuring the performance of the target
machine.
• The monitoring technology used was the Simple
Network Management Protocol (SNMP).
Attack Network
Monitoring Network
Experimental DOS Testbed
Paper # 4 : Secret Key based
Encryption
Aim :-
Result :-
RSA
AES
To develop a distributed service discovery
mechanism.
Author :-
Sabiha Hossain , Upama Kabir ,
Shaila Rahman And Aloke Kumar Saha .
University Of Asia pacific (UAP) ,
Dhaka, Bangladesh .
4.1 Abstract
JXTA is a P2P (Peer-to-Peer) Semantic Web application.
The aim of this thesis will be to develop a distributed
service discovery mechanism.
JXTA's P2P provides perfect solution for Web Service
discovery and Algorithm for Web Service Security.
An implementation using an algorithm for web service
security by using RSA Cryptographic Library and AES
Encryption technology.
It focuses on peer-to-peer as a method to combine Web
Services and mobile ad hoc networks and to use JXTA
as peer-to-peer platform.
4.2 JXTA Protocols
• JXTA technology is a set of protocols.
• Each protocol is defined by one or more messages
exchanged among participants of the protocol.
• Each message has a pre-defined format.
• It is akin to TCP/IP.
• Peer Discovery Protocol
• Peer Resolver Protocol
• Peer Information Protocol
• Peer Membership Protocol
• Pipe Binding Protocol
• Endpoint Routing Protocol
4.3. JXTA Architecture
4.4. Service Invocation from a JXTA
Network
Client Application
Decrypt &
Authenticate
User Info
Encrypted
User Info
Service
JAX-WS JAX-WS
pip
e
JXTA
Pip
e
JXTAJXTA Message
SOAP
4.5. Web Service Security
• RSA Encryption :-
• AES :-
Ron Rivest, Adi Shamir, and Len Adleman
developed the public key encryption scheme that
is now known as RSA .
The Advanced Encryption Standard (AES) is a
symmetric-key encryption standard adopted by
the U.S. government.
4.6. Encryption Decryption Procedure
Client
• RSA Signing Private Key
• RSA Exchange Public
Server
• RSA Signing Public Key
• RSA Exchange Private Key
Secure Login (Single Sign on or Secure Login).
References
• “Defending Web Services Against Denial of Service Attacks Using
Client Puzzles” Suriadi Suriadi, Douglas Stebila, Andrew Clark, and
Hua Liu. Information Security Institute, Queensland University of
Technology Brisbane, Queensland, Australia.
• “Validating Denial of Service Vulnerabilities in Web Services” Suriadi
Suriadi, Andrew Clark, and Desmond Schmidt .Information Security
Institute Queensland University of Technology Brisbane,
Queensland, Australia.
• “JXTA & Web Services Using Secret Key Based Encryption” Sabiha
Hossain, Upama Kabir, Shaila Rahman and Aloke Kumar Saha.
• “Protecting Web Services from DDOS attacks by SOAP message
validation” Nils Gruschka ,Norbert Luttenberger, Christian-
Albrecht's-University of Kiel.
• “Web Service Security Management Using Semantic Web
Techniques” Diego Zuquim Guimarães Garcia , Maria Beatriz Felgar
de Toledo , University of Campinas ,POB 6176 – Postal Code
13.084-971 ,Campinas, SP, Brazil.
Thank You