基于ROP的开放平台安全性研究

在对ROP框架和Web安全技术进行研究的基础上,介绍了ROP,并与其他技术进行比较,同时分析了XML消息重写攻击对消息本体的影响,并研究了其解决策略。使用Ecplise平台,基于B/S的架构设计实现了一个单点登录系统。采用ROP框架解决第三方平台认证授权问题,利用分层模型来降低系统层与层间的耦合度,提高了系统的可扩展性和可维护性。针对消息本体传输安全问题,提出了ROP-Jusnit方案,并通过测试验证了其安全性和可行性。

Open Platform Security Research Based on ROP

On the basis of research on ROP framework and Web security technology,this paper first introduces ROP and compares it with other technologies;at the same time,analyze the influence of XML message rewrite attack on the message body and study on its solution.Then utilize the Ecplise platform,design and realize a single sign-on system based on the B/S framework.Utilize the ROP framework to solve the authorization and certification problem of third party platform,utilize the layered model to lower the coupling degree between each layer in the system,increase the expandability and maintainability of system;secondly,target at the security problem of message body transmission,propose the ROP-Jusnit scheme and its security and feasibility have been verified by tests.