Research On Cross-site Hijacking Vulnerability And Sub-protocol Defense Strategy In WebSocket Real-time Communication

The traditional B/S mode communication is based on the HTTP protocol,but HTTP communication is a typical “request-response” model.Therefore,it is obviously difficult for the HTTP protocol to achieve real-time communication between Browser and Server.In order to effectively solve this problem,the WebSocket protocol had been born.The WebSocket protocol is part of the HTML5 standard.It is a new network communication protocol that provides a full-duplex communication mechanism between the client and the server.WebSocket can improve network throughput,reduce latency,and reduce server load,which is very suitable for real-time communication in B/S mode.Although WebSocket brings the gospel to Web real-time communication,it also inevitably brings corresponding security risks,among which the cross-site WebSocket hijacking vulnerability is relatively harmful and easy to be ignored.The thesis focuses on WebSocket real-time communication.The main contents are as follows:1.The thesis researched Web real-time communication related technologies,AJAX short polling,Comet(AJAX long polling,Iframe streaming),browser plug-in technology and WebSocket protocol,and then analyzed and compared the advantages and disadvantages of various technologies,highlighting the advantages of the WebSocket protocol in the field of Web real-time communication.2.The thesis researched the WebSocket security characteristics,and then focused on the cross-site WebSocket hijacking vulnerability,and in view of the shortcomings of the existing random token defense scheme,combined with RSA algorithm and AES algorithm and proposed a one-time random token scheme based on hybrid encryption.After that,the scheme was tested by experiments to verify the effectiveness of the scheme.3.The thesis proposed a strategy of using WebSocket sub-protocol to prevent related security vulnerabilities,and designed a WebSocket custom sub-protocol called wsafe.The sub-protocol incorporates a one-time random token scheme based on hybrid encryption,which can prevent cross-site WebSocket hijacking,man-in-the-middle eavesdropping and common XSS attacks.After that,the wsafe sub-protocol was simulated in a WebSocket chat room,and the performance of the sub-protocol was tested.The experimental resultsshow that the sub-protocol improves the communication security of the WebSocket chat room and does not significantly affect the communication performance,thus verifying the feasibility of the sub-protocol defense strategy.