KR20080004904A - Real-time web intigrity verification system - Google Patents

Abstract

A system for verifying web integrity in real-time is provided to defend a direct homepage attack deleting or altering data of a web server, or changing a link of a webpage by constructing a robust security service added to a usual security system such as a firewall and an SSL(Secure Socket Layer)/TLS(Transport Layer Security). A real-time web integrity verifying system is implemented based on an Open SSL, and an integrity data generating module and an integrity verifying module using an SHA(Secure Hash Algorithm)-1 and an N-gram based indexing technique are linked with a squid proxy server and an Apache web server. The system includes an integrity data database for verifying the integrity and a raw data database for restoring raw data. The Apache web server is linked with the integrity data generating module and the squid proxy server is linked with the integrity verifying module. The integrity data generating module generates integrity data for all data used in the web server and stores the integrity data to the integrity data database. The integrity verifying module verifies the integrity of the raw data by loading the raw data and the integrity data from each database when a user requests the web service.

Description

Real-time Web Intigrity Verification System

Proxy Server

A server that acts as an intermediary between a workstation or PC user and the Internet, enabling the organization's security and administrative control and cache services. When a proxy server receives an Internet service request from a user, such as a web page request, it searches the local cache of previously downloaded web pages as a cache server. If the requested page is found, the page is presented to the user without the need to send a request to the Internet. If the page is not in the cache, the proxy server requests the page from a server on the Internet using one of its IP addresses as a client on behalf of the requesting user. When the requested page is received, the proxy server associates it with the original request and sends it to the user.

When designing the real-time web integrity verification system proposed in this paper, we use the squid proxy server which is used most often for fast internet service, and by verifying the integrity data in the proxy server, the web page that has already been verified is provided to the user upon request. We took full advantage of the use of a proxy server. In addition, the proxy server is designed in the reverse direction, so that a web server that provides the original data when data is tampered with is placed inside a firewall to form a more secure security system.

                    Reverse Proxy Server Diagram

2. SHA -One

Secure Hash Algorithm-1 (SHA-1) is a new version of SHA that was developed by modifying the weaknesses of SHA designed by NIST in 1993. SHA-1 is a 160-bit hash function based on MD4, and much of it is similar to MD5 because it has a common base of MD4. SHA-1 has a 160-bit state consisting of five 32-bit words, four rounds of 32-bit words, such as MD5, and instead of using each message block four times, SHA-1 Linear recurrence is used to stretch the 16 blocks of the message block to 80 words. The linear recursion used in SHA-1 ensures that each message bit can be used in at least 12 blending functions, thereby increasing the collision range in steps. SHA-1 is two to three times slower than MD5, but is widely used in the assessment that it is safer. In this paper, SHA-1 is used to generate and verify integrity data for each web service data such as HTML documents, images, and each web script file.

3. N-gram

Grammar processing is required to recognize and understand sentences and voices. However, since the grammar of natural language (Korean, English, etc.) is very complicated, human speech does not always follow the regular grammar. In the conventional sentence recognition, after the phoneme and word recognition, the grammar processing described according to the rules is applied and the error correction method is finally used. It is put to practical use. N-gram is a representative of such a stochastic language model. When a chain of n words is represented probabilistically, a record of a spoken sentence can be calculated.

N-grams are used for more accurate integrity verification of HTML documents. For example, if there is no problem even if the position of the document is changed with respect to the web page, it is verified that an error due to data tampering occurs during integrity verification through the hash value of SHA-1. In the case of such HTML documents, the integrity value is verified once more with the N-gram extracted result, so that even if the integrity verification error is a hash value, the correct web data can be determined to prevent the problem of incorrect integrity verification.

Real-time web integrity verification system is designed to provide more secure web services to users by adding to existing security systems such as firewall and SSL / TLS. The system verifies the integrity of the data for the requested web page before providing the web service to the user, preparing for direct homepage tampering attacks such as XSS vulnerability attacks, SQL injection attacks, and file upload vulnerability attacks. If the web service data is tampered with by hacking and an error occurs during the integrity verification, the original data is retrieved from the web server to provide the user with a web service at all times. Real-time web integrity verification system uses SHA-1 and N-gram based indexing techniques to generate and verify integrity data in proxy server and web server.

Basically, the real-time web integrity verification system is implemented based on Open SSL, and the generation and verification module using SHA-1 and N-gram-based indexing technique is integrated with Squid proxy server and Apache web server. The database is composed of the integrity data DB for integrity verification and the original data DB for original data recovery using MySQL. Basically, the security system of SSL and firewall is configured to prevent other hacking attacks in addition to homepage tampering attacks.

The real-time web integrity verification system is an interworking security technology between a proxy server and an Apache web server. An integrity data generation module is linked to an Apache web server, and an integrity verification module is linked to a squid proxy server. Integrity data generation module generates integrity data of all data used for web service and saves it in DB. Integrity verification module imports original data and integrity data from DB when user requests web service and checks integrity of original data. Verify.

            Diagram of Real-time Web Integrity Verification System Module

1. Integrity data generation module

The integrity data generation module linked to the Apache web server generates the integrity data as a hash value using SHA-1 and N-gram. Images and web script files of PHP or JSP generate integrity data using the original data in DB and store it in DB. Also, HTML document creates one more integrity data extracted from each command through N-gram, not just hash value, and stores it in DB. Web page update Instantly generate integrity data on web files in real time so that users can immediately verify integrity when using web services.

2. Integrity Verification Module

The integrity verification module linked to the Squid Proxy Server verifies the integrity of the data by comparing the original data with the integrity data. HTML document verifies integrity by using hash value and N-gram extracted data and verifies integrity by importing original data and integrity data of image and web script file suitable for each web page from DB. If there is no abnormality in the data, the web service is provided to the user immediately. If it is determined that the data has been tampered with, the secured web service is provided to the user by recovering the original data obtained through the original data DB connected to the web service.

By building a more robust security service, including real-time web integrity verification system in existing security systems such as firewalls, SSL / TLS, etc., you can delete or alter web server data of government agencies or corporations, or change links on web pages. You can defend against direct attacks. In addition, I believe that it will help to develop more secure home network security technology by constructing web-based integrity home network security service using OSGi to securely service user's status information.

Claims (1)

As part of constructing secure internet services, we propose a real-time web integrity verification system for providing secure web services to users. The interlocking security technology between proxy server and web server. Using efficient hybrid method of SHA-1 and N-gram for data integrity verification, this system defends against XSS vulnerability attack, SQL injection attack, file upload vulnerability, etc. Provides secure security services in home network environments as well as institutions and companies.