Esframework development manual (10)-Security Mechanism

Security is undoubtedly very important in Distributed communication systems.

Esframework/esplus is the development framework of the application layer. Here we only discuss the security of the application layer, because if hackers attack the application layer or the link layer, the system at the application layer is almost powerless. From the application layer, the importance of security is mainly reflected in the following aspects:

(1) prevent malicious users from testing the server by using incorrectly formatted messages.

(2) prevent malicious users from intercept communication messages or crack the contents even if they are intercepted by malicious users.

(3) prevent malicious users from sending disguised messages in the correct format to the server before successful logon.

(4) prevent malicious users from consuming server resources by using a large number of empty connections.

Esframework has some built-in security mechanisms to provide some protection for the above-mentioned security. The following describes them one by one. 

1. Message format Verification

Esframework defines the overall format of communication messages, while esplus defines the detailed format of messages.

When the network engine (either a server or a client) receives a batch of binary data from the network, it will try to parse it. If we find that the format of this batch of binary data is not the format of the defined message, it will be regarded as illegal messages. In this case, the network engine discards illegal data and closes the corresponding connection (if the engine is based on the TCP protocol), and then triggers the invalidmsgreceived event of the inetengine interface.

 
///<Summary>
///This event is triggered when incomplete or unresolved data is received.
///</Summary>
Event Cbgeneric<Useraddress,Messageinvalidtype> Invalidmsgreceived;
 

The useraddress parameter of the event indicates the user address from which the illegal message comes from, and the messageinvalidtype parameter indicates the type of the illegal message:

 Public   Enum   Messageinvalidtype 
{
 ///  <Summary>  
  ///  Normal message.
  ///  </Summary>  
 Valid = 0 ,
///  <Summary>  
  ///  Message Size overflow.
  ///  </Summary>  
 Messagesizeoverflow,
 ///  <Summary>  
  ///  Invalid Message Header
  ///  </Summary>  
 Invalidheader,
 ///  <Summary>  
  ///  Invalid identifier
  ///  </Summary>  
 Invalidtoken,
 ///  <Summary>  
  ///  Insufficient Packet Length
  ///  </Summary> 
 Datalacked,
 ///  <Summary>  
  ///  The client type is invalid.
  ///  </Summary>  
 Invalidclienttype
}

From this enumeration, we can see that the network engine cannot parse the received data for several reasons: the size of the message exceeds the specified size, the message header is invalid, and the message identifier is invalid.

2. message encryption

Key information cannot be transmitted over the network in plain text. Therefore, the message must be encrypted before being sent.

If you directly use the original esframework EngineWe can implement the imessagetransformer interface, and then link the implementation class instance to the corresponding location of the skeleton process to encrypt and decrypt incoming and outgoing messages, such:

 Public   Class   Messageencryptor : Imessagetransformer 
{
 Public   IMessage Capturebeforesendmessage ( IMessage MSG)
{
 //  Encrypt messages 
              Return Encrypt (MSG );
}

 Public   IMessage Capturereceivedmessage ( IMessage MSG)
{
 //  Decrypt messages  
              Return Decrypt (MSG );
}
}

In the rapid engine provided by esplus, encryption components are not used when assembling the skeleton process internally. However, we can still ensure information security when sending custom information. We still remember that we used icustomizeoutter to send custom information. Take the send method as an example:

 ///  <Summary>  
  ///  Send information to the server.
  ///  </Summary>  
  ///  <Param name = "informationtype">  Custom information type  </Param>  
 ///  <Param name = "info">  Information  </Param>  
     Void Send ( Int Informationtype, Byte [] Info );

Before calling the send method, we can encrypt the info of the content to be sent, and then send the encrypted result.

The receiver calls the handleinformation method of icustomizehandler to process the received information:

 ///  <Summary> 
  ///  Process custom information from the client.
  ///  </Summary>  
  ///  <Param name = "sourceuserid">  ID of the user who sent the information  </Param>  
  ///  <Param name = "informationtype">  Custom information type  </Param>  
 ///  <Param name = "info">  Information  </Param>  
    Void Handleinformation ( String Sourceuserid, Int Informationtype, Byte [] Info );

When implementing the handleinformation method, we can decrypt info first and then perform normal business processing.

Whether it is to mount the imessagetransformer component or manually encrypt or decrypt information when sending or receiving custom information, you must note that encryption and decryption consume both CPU and memory resources, for messages with high-frequency communication, this overhead cannot be ignored. So,We should try to encrypt only those extremely important messages/Information(Differentiated by messagetype or infomationtype), rather than treating all messages/information equally.

3. Verify Unlogged on messages

Some malicious users attempt to send other types of request messages to the server without logging on to the server after cracking the Message format. Esframework supports verifying the messages received by each connection on the server. If the verification fails, the corresponding connection is closed.

The interface of the component that verifies the message is imessageverifier: 

 Public   Interface  Imessageverifier{  ///   <Summary>         ///  Verify that messages are received on each TCP connection. If the verification fails, the TCP engine on the server closes the corresponding connection.  ///   </Summary>          ///   <Param name = "message">  Messages to be verified  </Param>          ///   <Param name = "Address">  Client address of TCP Connection  </Param>          ///   <Param name = "state">  TCP connection status </Param>          ///   <Returns>  Verify if it passes  </Returns>          Bool  Verifymessage (IpendpointAddress,ConnectionboundstateState,IMessageMessage );} 

 When this interface is implemented, we usually verify the connectionboundstate as notbound (not verified by login, not bound) messages, for example, to check whether it is a logon message. If not, the verifymessage method returns false, indicating that the verification fails. In this case, the server network engine closes the corresponding TCP connection.

Provided by esplusThe rapid engine has implemented the imessageverifier interface internally to verify the first message. It is mainly used to ensure that the message received on the notbound connection must be a logon message, and then combined with the login account password for verification, it can solve other types of business requests when malicious users are not logged on.

4. Bind the connection

After the account and password in the logon message are verified by the server, the server binds the account to the corresponding TCP connection to form a complete session. If the userid in the message header is inconsistent with the account bound to the TCP connection, the message is regarded as an invalid message, the server network engine will close the corresponding TCP connection. In this way, you can avoid using another account to request services after a successful login. 

5. Empty connection

By now, we have solved the first three problems mentioned in this chapter, which ensures that malicious users cannot send malicious messages to servers. However, malicious users can also do one thing at the application layer, that is, consume the TCP connection of the server. For each established TCP connection, the server must allocate resources for IT and manage it. If a malicious user Establishes Many idle connections with the server, the consumption of server resources cannot be ignored.

The server engine itcpserverengine provided by esframework supports timely disabling idle connections of the above malicious users. Itcpserverengine has an expiredspaninsecs attribute, which indicates that after a TCP connection is connected, if the server network engine cannot receive any data from the connection during the expiredspaninsecs time, the connection is closed.

Generally, after a normal TCP connection is established, the client immediately sends a logon message to the server for logon. Therefore, this mechanism can be established. We can set expiredspaninsecs to a valid value (such as 3 S) to reduce the impact of NULL connections. The reason is "Mitigate", rather than "eliminate", because in the application layer system, this problem cannot be completely avoided, as long as three seconds of timeout, the speed at which your server closes the connection cannot keep up with the speed at which malicious users establish the connection.

This situation is very difficult to handle at the application layer. A better way to solve this problem should be to set related policies on the firewall, such as shielding the IP addresses of malicious users and filtering the SYN packets sent by the addresses for TCP handshake requests.

 

Read more esframework development manual articles.

Certificate -----------------------------------------------------------------------------------------------------------------------------------------------

 Download the free version of esframework and demo source code 

 

For any questions about esframework, please contact us:

Tel: 027-87638960

Q: 372841921

Email:Esframework@oraycn.com