KR101015402B1 - Security method and apparatus for web-applications using security tag - Google Patents

Abstract

The present invention relates to a security method and apparatus that can effectively respond to an attack made by malicious manipulation of parameter input values such as cross-site scripting, SQL injection attack, malicious file execution, and the like among web application attacks. According to the present invention, a verification module is mounted in a web server as a module, and a security tag is inserted into a parameter of a web application. When the client requests a web page, the verification module operates according to the security tag inserted in the parameter to verify the input value and filter the attack to perform the web application security method of the present invention.

Description

Security method and apparatus for web-applications using security tag

The present invention relates to a security method and apparatus that effectively responds to a web application attack, and in particular, the present invention relates to a malicious manipulation of parameter input values such as cross-site scripting, SQL injection attack, malicious file execution, etc. It relates to a security method and apparatus that can effectively respond to the attack made by the.

Due to its nature, the web environment has a fundamental vulnerability that requires opening port 80 (HTTP) or port 443 (HTTPS) to provide services. Therefore, through this, the homepage hacking and web server hacking can be attempted by using the vulnerability of the web application itself due to a web program setting and development error. These attacks use existing attack patterns, but new hacking methods can be tried. Therefore, in addition to detecting existing attack types, it is also necessary to deal with new attacks in real time.

To solve this problem, web vulnerability scanners, signature-based security methods, and affirmative model-based security methods have been proposed. Among them, Web vulnerability scanner technology is a technology that prepares for future attacks by periodically performing vulnerability analysis on web servers and applications. Vulnerability scanners usually allow fast policy application through automatic policy establishment based on the vulnerability. It also has the advantage of providing excellent reporting on discovered vulnerabilities. However, it does not respond well to modern attacks such as zero-day attacks and has the disadvantage that periodic scanning causes increased traffic on the server side. Signature-based web application firewall uses the method of access control through pattern matching in case of malicious attack by storing pattern or signal of attack in database in advance. This technology has the advantage of being able to prepare for an attack by easily updating signatures when a new vulnerability occurs, but it cannot respond in case of no signature or zero-day attack, and it is necessary to update the signature on the attack periodically. Have

A positive model-based security technique is a technique of granting access only to the forms that are allowed access, rather than the negative access control of the existing pattern or signature matching. The affirmative model here is a definition of the forms that are allowed access. Unlike the signature method, this technology has the advantage that it can cope with the latest attacks such as zero-day attack without requiring periodic updates.

In the recently invented web application security method, a profiling technique is mainly used to collect normal data to block an attack. This method creates and updates the profile database for normal requests and uses it to detect and block abnormal requests, that is, attacks.

The following documents are known about conventional web application security methods.

KR 2007-0061017 A (Kim, Hwan-kuk, Kim Myung-eun, Seo Dong-il, June 13, 2007) 2.KR 2005-0048558 A (Byung-kyu Ahn, 2005, 5, 24)

[1] C. Kruegel, G. Vigna, W. Robertson. "A multi-model approach to the detection of web-based attacks" (Computer Networks: The International Journal of Computer and Telecommunications Networking, vol. 48, no. 5, August 2005) [2] Chae-Kum Park, Bong-Nam Noh, “Design of Profile-based Detection System for Web Application Security” (Korea Information Processing Society 2005 Fall Conference and Regular Conference, November 2005)

The problem to be solved by the present invention is that it is difficult to prepare for a new attack of signature-based firewall, and overcomes the disadvantages of existing web application security technologies such as incorrect model definition and operation overload. Its purpose is to provide an invention for a new type of web application security technique.

To this end, the present invention introduces and employs the concept of a security tag, and proposes a new web application firewall technology using a web application input validation and filter technique based on the security tag.

In accordance with a first aspect, the present invention provides a web application security method that effectively responds to an attack made by maliciously manipulating a parameter input value in a web application attack of a client, wherein the security tag is assigned to the parameter name. Inserting; And using the security tag, when requesting a web service of the client, limiting a range of parameter input values included in request data or requesting verification of a specific attack in the input data. do.

Preferably, the security tag is used to prevent web application attacks using malicious input values, and includes a basic security tag for defining a range of allowed input values; And a user-defined security tag for requesting verification for a particular attack.

 According to a second aspect of the present invention, there is provided a web application security apparatus that effectively responds to an attack made by maliciously manipulating a parameter input value in a web application attack of a client, wherein the client requests a web service. A verification module manager which determines whether a parameter having a security tag inserted in the request data is used and calls a verification module according to the security tag; A user-defined tag verification unit which performs input value verification according to a user-defined security tag included in the security tag; A basic tag verification unit configured to perform input value verification according to a basic security tag for defining a range of an input value allowed in the security tag; And an attack filtering module for causing the web server to reject the request determined to be an attack according to the input value verification result of the user-defined tag verifier and the basic tag verifier, or to allow the web server to accept the request determined to be normal. A web application security device is provided.

Preferably, the verification module manager comprises: a request analysis module configured to analyze the web service request to obtain a parameter name and an input value; And a verification request module for calling the verification module according to the security tag.

Preferably, the user-defined tag verification unit comprises a module for verifying cross-site scripting for the user-defined security tag; A module for verifying instruction insertion; And a module for verifying file insertion.

Preferably, the basic tag verifier comprises: a module for verifying an input value allowed domain with respect to the basic security tag; And a module for verifying an input value length.

According to a third aspect of the present invention, there is provided a web application security method corresponding to an attack made by manipulating a parameter input value in a web application attack when a client requests a web service. Extracting parameters and input values included in the request data when the service is requested; (b) checking whether a security tag is inserted in the extracted parameters and input values; (c) calling a verification module according to the inserted security tag to perform verification; And (d) delivering the verification result to a web server.

Preferably, the step (a) includes extracting the parameter and the input value transfer part for POST delivery, or extracting the parameter and the input value for GET delivery. do.

Preferably, the step (b) includes checking whether a security tag is inserted by checking a parameter name in the parameter and an input value.

Preferably, in the step (c), when the user-defined security tag is inserted into the parameter, the user inputs the parameter by calling a cross-site scripting verification module, an instruction insertion verification module, and a file insertion verification module. Performing a verification of the value and receiving the result; If the basic security tag is inserted in the parameter, calling the input value domain validation module, input value length verification module of the basic type tag verification unit, and performing the verification of the input value for the parameter and receiving the result; It is characterized by.

Preferably, the step (d) is to reject the request by sending an error page to the client through the web server, leaving an error message in the web server log according to the verification result received from the verification request module. step; If it is determined that the verification result is normal, it is characterized in that it comprises the step of normalizing the request.

In accordance with a fourth aspect, the present invention provides a computer-readable recording medium containing a program for performing the above-described web application security method.

According to the web application security method and security device using the security tag of the present invention, it is possible to respond to web application attacks in real time through the parameter input value verification and filtering method using the security tag. If this method is applied and deployed on a web server such as Apache or IIS that is currently used, the security of the web server can be greatly enhanced by simply adding a tag to a parameter in the document when creating the web document.

1 is a diagram showing an example of using a web application security device according to the present invention.
2 is a block diagram showing a schematic configuration of a web application security apparatus according to the present invention.
3 is a flowchart illustrating an operation of a web application security method according to the present invention.
4 is a detailed flowchart of the parameter and input value extraction step of FIG. 3.
FIG. 5 is a detailed flowchart of a security tag usage checking step of FIG. 3.
6 is a detailed flowchart of a verification performing step of FIG. 3.
7 is a detailed flowchart of the verification result transferring step of FIG. 3.

Hereinafter, exemplary embodiments of a web application security method and a security device using a security tag according to the present invention will be described with reference to the accompanying drawings.

In the present invention, a security tag is used to block a web application attack using a malicious parameter input value. The security tag is an indicator that indicates the type of the value that each parameter can have when inserted in the parameter of the web application. It is an indicator that specifies the range and range of the value that the parameter can have. One example of a type of security tag is shown in Table 1, which is a basic security tag used to represent common input values, and a custom security request that validates web application attacks with complex input values or specific patterns. Tag is used.

type

Security tag
meaning







Basic type
Security tag
L xx
Allow input value up to xx

A
English alphabet allowed

N
Integer Numbers Allowed

B
Allow use of white space

S
Allow use of special characters

K
Hangul Allow





Custom
Security tag
X
Require Cross Site Scripting (XSS) Validation

F
Decimal number

R
Remote file include (RFI) verification required

I
Instruction insertion verification required

The process of inserting the security tag may be performed manually, but in this case, there is a disadvantage in that the convenience is greatly reduced. In addition, in the case of a complicated web page, the security tag insertion is made in an automated manner. It is preferable. Automatic insertion of security tags first reads the syntax and determines whether the source code, or pattern, that contains the vulnerability associated with the tag exists in the syntax. After mapping and saving, after the vulnerability analysis step is completed, tags are created in a batch.

1 is a diagram showing an example of using a web application security device, that is, a device for blocking a web application attack according to the present invention.

As shown in FIG. 1, the web application security apparatus 200 as an input value verification and attack blocking apparatus is mounted as a module in the web server 100 to connect the Internet network 50 from the client (attack) terminal 10. After receiving the request transmitted to the web server 100 from the web server, the result of the verification thereof is transmitted to the web server 100 again.

2 is a block diagram showing a configuration of a web application security apparatus 200 according to an embodiment of the present invention. The verification module management unit 210, the user-defined tag verification unit 220, the basic tag verification unit 230, and the user-defined tag are large. Generation unit 240 is included.

The verification module manager 210 receives the web page request from the web server 100, analyzes the request, classifies the parameter and the input value, and requests the verification module to verify the verification according to the security tag inserted in the parameter. Filtering and transmitting the result to the web server (100). More specifically, the verification module management unit 210 retrieves the request from the client 10 from the web server 100 in the request analysis module 211, and extracts the parameter and the input value part through the analysis and verifies the verification request module. Request 213 to perform verification of the input value for the parameter. The verification request module 213 performs verification by calling the verification module of the user-defined tag verification unit 220 or the basic tag verification unit 230 according to the security tag inserted in the parameter.

The user-defined tag validator 220 performs an input value verification based on a signature or a user defined verification rule. More specifically, the user-defined tag verification unit 220 is connected to the user-defined security tag, the corresponding verification module is performed for each tag. The cross-site scripting verification module 221 is called when the X tag is inserted in the parameter, the instruction insertion verification module 222 is called when the I tag is inserted, and the file insertion verification module 223 when the R tag is inserted. Is called to perform each validation.

The basic tag verification unit 230 verifies the input value allowable domain and length. In more detail, the basic tag verification unit 230 is connected to the basic security tag, and the corresponding security tags include L, A, N, B, S, and K. When the L tag and the maximum length are inserted in the parameter, the input value length verification module 232 is called, and other tags are called by the input value allowable domain verification module 231 to perform input value verification.

By default, user-defined tags and basic tags are not mixed. If it is necessary to use a mixture of the user-defined tag and the basic tag, it is used by redefining the new user-defined tag through the user-defined tag generation unit 240. New user-defined tag generation is automatically generated when the user inputs the content to be verified through the new tag in the generator and is used for the verification process without any additional configuration change.

The present invention is applied to a web application security method that effectively responds to an attack made by malicious manipulation of a parameter input value in a web application attack of a client. The security tag is inserted into a parameter name and the security tag is used. When the client requests a web service, the web application security method is performed by restricting a range of parameter input values included in the request data or requesting verification of a specific attack from the input values. As described above, the security tag applied to the present invention is used to prevent web application attack using malicious input values, and includes a basic security tag for defining a range of allowed input values; And a user-defined security tag for requesting verification for a particular attack.

3 is a flowchart illustrating an operation of a web application security method according to the present invention. Referring to FIG. 3, when a client requests a web service, the web application security method that effectively responds to an attack by malicious manipulation of a parameter input value among web application attacks receives the web service request data (S10). Extract the parameter and the input value included in the request data (S30), check whether the security tag is used in the extracted parameter and the input value (S32), call the verification module according to the inserted security tag to verify the verification It performs (S34) and delivers the verification result to the web server (S36).

4 is a detailed flowchart of the parameter and input value extraction step of FIG. 3.

Referring to FIG. 4, the step of extracting the parameter and the input value included in the web service request data (S30) may extract the parameter and the input value transfer part for the POST method delivery (S30A) or the GET method delivery. Extracting the parameter and the input value transfer unit extracts the parameter and the input value (S30B).

FIG. 5 is a detailed flowchart of a security tag usage checking step of FIG. 3.

Referring to FIG. 5, in the checking of whether the security tag is used in the extracted parameter and the input value (S32), the step of checking whether the security tag is used by checking the front part of the parameter name in the parameter and the input value (S32A) It includes.

6 is a detailed flowchart of a verification performing step of FIG. 3.

According to Figure 6, the step of performing the verification by calling the verification module according to the inserted security tag (S34) when the user-defined security tag is inserted into the parameter, the cross-site scripting verification module of the user-defined tag verification unit, Calling the command insertion verification module and the file insertion verification module to perform verification and receiving a result (S34A); When the basic security tag is inserted into the parameter, calling the input value allowable domain verification module and the input value length verification module of the basic tag verification unit to perform verification and receive the result (S34B).

7 is a detailed flowchart of the verification result transferring step of FIG. 3.

According to FIG. 7, in operation S36, when the verification result is determined to be an attack according to the verification result received from the verification request module, an error message is left in the web server log and the web server is sent through the web server. Rejecting the request by sending an error page to the client (S36A); And if it is determined that the verification result is normal, normalizing the request (S36B).

In the web application attack of the client according to the present invention, a program for executing a web application security method that effectively responds to an attack caused by malicious manipulation of a parameter input value is stored in a computer-readable recording medium and executed on a computer.

As described above, in the present invention, the verification module is mounted in the form of a module in a web server, and a security tag is inserted into a parameter of a web application. When the client requests a web page, the verification module operates according to the security tag inserted in the parameter to verify the input value and filter the attack to perform the web application security method of the present invention.

10 ... Client
50.Internet
100 ... Web Server
200 ... Web Application Security

Claims (6)

In the web application security method corresponding to the attack made by manipulating the input value of the parameter among the web application attack when the client requests a web service,
(a) extracting a parameter and an input value included in the request data when the web service request is made;
(b) checking whether a security tag is inserted in the extracted parameters and input values;
(c) calling a verification module according to the inserted security tag to perform verification of input values for the parameters; And
(d) transmitting the verification result to a web server. The method of claim 1, wherein the step (a) extracts the parameter and the input value transfer part for POST delivery or extracts the parameter and the input value transfer for GET delivery. Web application security method comprising the step of. The method of claim 1, wherein the step (b) includes checking whether a security tag is inserted by checking a parameter name in the parameter and an input value. The method of claim 1, wherein the step (c) includes calling a cross-site scripting verification module, an instruction insertion verification module, and a file insertion verification module when the user-defined security tag is inserted into the parameter. Performing verification of an input value for and receiving the result;
If the basic security tag is inserted in the parameter, calling the input value domain validation module, input value length verification module of the basic type tag verification unit, and performing the verification of the input value for the parameter and receiving the result; Web application security method, characterized in that. The method of claim 1, wherein the step (d) is based on the verification result received from the verification request module, and if the verification result is determined to be an attack, leaves an error message in the web server log and sends an error page to the client through the web server. Rejecting;
And if it is determined that the verification result is normal, processing the request normally. A computer-readable recording medium containing a program for performing the method according to any one of claims 1 to 5.

Images