Schutz von Web Services durch erweiterte und effiziente Nachrichtenvalidierung (English shop)

Abstract
Network services are exposed to a wide variety of attacks. In particular, so-called denial-of-service attacks (DoS attacks) pose a major threat. In the case of Web Services, such attacks are also considerably easier to carry out than against “classical” services (such as the WWW). Experimental investigations have shown that it is readily possible to severely impair availability with only a few or even a single message. It was also found that many attacks are based on deviation from the correct protocol. One of the most important countermeasures against DoS attacks is therefore the verification of the conformity of messages with respect to the protocol definition. However, most of today’s network protection systems are unsuitable for analysing Web Service messages (SOAP messages) and thus for detecting attacks on Web Services. There are various reasons for this. First, the XML-based SOAP messages require a fundamentally different processing method than “classical” protocol messages. Furthermore, SOAP defines only a generic message envelope. The definition of the concrete Web Service messages results only from a set of metadata, which differ for each Web Service.

To solve these problems, this thesis develops methods for the verification of Web Service messages and for the protection of Web Service systems against attacks. The core of these countermeasures is the so-called extended and efficient message validation.

Extended validation is understood as the examination of messages for conformity with all the definitions involved. This encompasses both the Web Service standards that define message formats and the metadata that is specific to each Web Service and that is propagated to other Web Service systems. It has been shown that this type of validation is effective not only against DoS attacks.

The greatest problem of extended validation is the realisation of message processing. Validation requires message processing that is robust against attack messages. The tree-based XML processing predominantly used in today’s Web Service systems is unsuitable for analysing potential attack messages. Therefore, this thesis develops algorithms for the processing and validation of Web Service messages that are based entirely on the so-called event-based processing methodology.

The validation mechanisms and protective measures based on this were implemented in the form of a Web Service firewall, which can be used to protect conventional Web Service systems. The evaluation of the implementation confirmed the derived runtime and memory complexity and thus the theoretical protective effect. In addition, the Web Service firewall demonstrated its protective effect against concrete attacks and its low resource requirements.