关键词: security-websocket子协议, 跨站劫持, 身份认证, AES加密算法, 通信

Abstract: In 2011, HTML5 proposed a persistent protocol—WebSocket protocol, which is very popular in real-time communication as a full-duplex communication protocol. However, the agreement is not restricted by the same-origin policy, and there may be a risk of cross-site hijacking. Some criminals take the opportunity to impersonate users and communicate with the server to steal private data. At present, there is very little research on the security issues of the WebSocket protocol. In order to improve the security of WebSocket, this article designs and implements a WebSocket sub-protocol "security-websocket" against the cross-site hijacking vulnerabilities of the WebSocket protocol. Later, the client needs protocol authentication and identity authentication. After the authentication is completed, the server needs to send the key to the client. After each data transmission, the client needs to use the AES symmetric encryption algorithm to encrypt the data and send the authentication information to the server. Communication can only be carried out after verifying the identity information. The experimental results show that although the security-websocket sub-protocol has a little longer transmission time than the WebSocket protocol, within the controllable range, the protocol can prevent cross-site hijacking vulnerabilities to a certain extent, thereby improving the security of WebSocket.

Key words: security-websocket sub-protocol, cross-site hijacking, identity authentication, AES encryption algorithm, communication