SOAP Message Integrity via Tree Digest Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing web service security mechanisms, such as WS-Security, are vulnerable to XML rewriting attacks due to the flexibility of the SOAP extensibility model and limitations in XML Digital Signature, which allow attackers to intercept, modify, and replay SOAP messages without compromising cryptographic algorithms, posing a threat to the integrity and confidentiality of SOAP messages.
Innovation Solution
A method is proposed to protect SOAP messages from XML rewriting attacks by using a tree structure representation with unique IDs and hashing, where each message element is assigned a unique ID, and a digest value is calculated and sent with the message, allowing the receiver to detect any modifications or additions/deletions, and using attack preventing header blocks to carry structure-specific information about signed message elements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If XML Digital Signature and WS-Security are used to secure SOAP messages, then message integrity and confidentiality are improved, but the system becomes vulnerable to XML rewriting attacks due to SOAP extensibility
Solution Approach 1:
The patent segments the message structure by introducing a tree representation where each node (message element) is individually tracked with unique identifiers. This segmentation allows the system to monitor and verify the structural integrity of each component separately, preventing attackers from successfully rewriting message elements while maintaining the benefits of XML Digital Signature and WS-Security.
Solution Approach 2:
The patent applies preliminary action by pre-calculating and attaching a digest value of the message tree structure to the SOAP message before transmission. This digest serves as a preliminary verification mechanism that allows the receiver to detect any structural modifications before processing the message content, thereby preventing XML rewriting attacks while preserving message integrity.
2Adaptability or versatility
If SOAP extensibility model is used to allow intermediaries to process and modify headers, then message routing and filtering capabilities are improved, but security is compromised as attackers can inject malicious elements
Solution Approach 1:
The patent implements feedback by requiring that any intermediary modifications to the message tree structure must be reflected in the digest value. The receiver verifies the message tree against the attached digest, creating a feedback loop that immediately detects unauthorized modifications. This allows intermediaries to perform their routing and filtering functions while maintaining security through structural verification.
Solution Approach 2:
The patent introduces a message tree structure as an intermediary layer between the SOAP message and the security verification process. This tree structure acts as a mediator that captures the hierarchical relationships and structural information of the message, allowing intermediaries to process headers while the tree structure itself remains protected by the digest verification mechanism.
3Adaptability or versatility
If multiple security headers are allowed in SOAP messages, then authentication and authorization flexibility are improved, but attack surface increases for XML rewriting
Solution Approach 1:
The patent segments the security verification process by applying the message tree structure and digest verification to each security header independently. This segmentation allows multiple security headers to coexist with improved authentication and authorization flexibility, while the tree structure ensures that each header's position and integrity are verified, reducing the attack surface for XML rewriting.
Data Source
AI summary
A system may include an attack preventing creator module that is configured to create at least one attack preventing head block for a message having message elements in a tree structure with one or more of the message elements being signed, wherein the attack preventing header block includes structure specific information that comprises at least a digest value of a pre-order traversal list of the tree structure and for each signed message element a unique ID attribute, a depth, a parent's name and a parent's ID attribute. The system may include an attack preventing verifier module that is configured to verify the at least one attack preventing header block by comparing the structure specific information which can be derived from the message with the structure specific information carried by the first attack preventing header block.