由於幾乎所有的電子商務網站都是使用SSL/TLS協定來保護資料傳輸過程的安全，本論文主要是探討在已安裝並執行SSL/TLS安全協定的伺服器在面對阻斷服務攻擊(Denial-of-Service,DoS)攻擊時，可能發生的狀況，例如服務延遲、當機或甚至於有破壞安全協定的情形。為了能使攻擊行為可以完全針對已安裝SSL/TLS安全機制的伺服器，並能有更精緻深入的討論，實驗上捨棄網路上現成的DoS/DDoS攻擊軟體來做實驗，而是自行設計一個SSL Client端連線程式來進行攻擊實驗，如此可以在SSL協商(SSL negotiation)過程中的每個不同階段發動不同型態的DoS攻擊，以徹底檢驗並瞭解SSL伺服器的防禦能力。

Because almost all e-commerce sites use SSL / TLS protocol to secure the data transmission process, this thesis is to study, test and further understand what will happen to an installed SSL server (for example, service delay, crash, or some other conditions which may occur) when it is attacked by DoS (Denial-of-Service).

In order to make the attack completely focus on SSL server, and to have more refined and in-depth study, we abandoned the available DoS attack software, but to design a SSL client-side program to launch the attacks in different stages of SSL negotiation process for a more thorough test and better understand SSL server’s defense ability.

This study focuses on the own designed client-side program, in-depth analyzing SSL server fault tolerance ability when it is attacked by DoS.

[1] Larry D.Bisel, “The Role of SSL in Cybersecurity”, IT Professional, Vol. 9, Issue 2, pp. 22-25, 2007.
[2] Zhang Yun, Yang Kuihe, Wang Yanhua, and Zhou Zhifeng, “Research on Protecting the Safety in Web System With SSL”, the Eighth International Conference on Electronic Measurement and Instruments (ICEMI), 2007.
[3] Wesley Chou, “Inside SSL: The Secure Sockets Layer Protocol”, IT Professional, Vol. 4, Issue 4, pp. 47-52, 2007.
[4] P. Chandra, M. Messier, and J. Viega，”Network Security with OpenSSL－Cryptography for Secure Communications,” O'Reilly Press, June 2002.
[5] Stephen Wilson, “The Importance of PKI Today”, China Communications, pp. 15-21, December 2005.
[6] The Internet Engineering Task Force (IETF). http://www.ietf.org/.
[7] B. Ramsdell and S. Turner, “Secure/Multipurpose Internet Mail Extensions (S/MIME) Version 3.2”, RFC 5751, January 2010. http://tools.ietf.org/html/rfc5751.
[8] J. Callas, L. Donnerhacke, H. Finney, D. Shaw, and R. Thayer, “OpenPGP Message Format”, RFC 4880, November 2007. http://tools.ietf.org/html/rfc4880.
[9] S. Kent and K. Seo, “Security Architecture for the Internet Protocol”, RFC 4301, December 2005. http://tools.ietf.org/html/rfc4301,
[10] R. Housley, ”Using Advanced Encryption Standard (AES) CCM Mode with IPsec Encapsulating Security Payload (ESP)”, RFC 4309, December 2005.
[11] Zhihua Hu, ”The Study of E-Commerce Security Protocol”, in the IEEE International Conference on Intelligence Science and Information Engineering, pp. 349-352, 2011.
[12] C. Neuman, T. Yu, S. Hartman, and K. Raeburn, “The Kerberos Network Authentication Service (V5)”, RFC 4120, July 2005.
[13] T. Dierks and E. Rescorla,“The Transport Layer Security (TLS) Protocol Version 1.2“, August 2008. http://www.ietf.org/rfc/rfc5246.txt.
[14] Xiaoyun Wang and Hongbo Yu, “How to Break MD5 and Other Hash Functions”, in the Proceedings of EUROCRYPT, LNCS3494, pp. 19-35, 2005.
[15] Bert den Boer and AntoonBosselaers, “Collisions for the Compression Function of MD5”, in the Proceedings of EUROCRYPT, pp. 293-304, 1993.
[16] Xiaoyun Wang, Yiqun Lisa Yin, and Hongbo Yu, “FindingCollisions in the Full SHA-l”, in the Proceedings of Crypto’05, pp. 17-36, 2005.
[17] Hash, CRC, and HMAC Calculator, SlavaSoft HashCalc, http://www.slavasoft.com/hashcalc/.
[18] OpenSSL: The Open Source toolkit for SSL/TLS, http://www.openssl.org/.
[19] Debian Corp., “Openssl  predictable random number generator”, http://www.debian.org/security/2008/dsa-1571.
[20] Takeshi NisHhimura and Hiroyuki Sato,” Analysis of a Security Incident
of Open Source Middleware– Case Analysis of 2008 Debian Incident of
OpenSSL –“, IEEE Ninth Annual International Symposium on
Applications and the Internet, 2009
[21] PhoneFactor Inc., “SSL/TLS Authentication Gap (SSL Gap)”, http://www.phonefactor.com/sslgap.
[22] PhoneFactor Inc., “SSL/TLS Authentication Gap – Status of Patches”,
http://www.phonefactor.com/sslgap/ssl-tls-authentication-patches.
[23] Richard Ford and Michael Howard, “Man-in-the-Middle Attack to the HTTPS Protocol”, IEEE Security & Privacy, Vol. 7, Issue 1, pp. 78-81, 2009.
[24] Kefei Cheng, Tingqiang Jia and Meng Gao, ”Research and Implementation of Three HTTPS Attacks”, Journal of Networks, Vol. 6, No. 5, pp. 757-764, May 2011.
[25] Kefei Cheng, Meng Gao and Ruijie Guo, “Analysis and Research on HTTPS Hijacking Attacks”, in the IEEE Proceedings of the Second International Conference on Networks Security, Wireless Communications and Trusted Computing, pp. 223-226, April 2010.
[26] The Court of Haarlem declared bankrupt DigiNotar in Beverwijk, September 20, 2011. http://www.diginotar.nl/.
[27] Juliano Rizzo, “BEAST: Surprising crypto attack against HTTPS”, ekoparty Security Conference, http://www.ekoparty.org/2011/juliano-rizzo.php.
[28] R. Housley, W. Ford, W. Polk, and D. Solo, “X.509 Public Key Infrastructure Certificate and CRL Profile”, RFC 2459, 1999. http://www.ietf.org/rfc/rfc2459.txt
[29] Wang Zhenzhong and Wang Yao, ”An Improvement SSL Protocol Application Research”, IEEE International Conference on Electronic & Mechanical Engineering and Information Technology, pp. 4010-4013, 2011.
[30] Zhao Huawei and Liu Ruixia, “A Scheme to Improve Security of SSL”, IEEE Pacific-Asia Conference on Circuits, Communications and System, pp. 401-404, 2009.
[31] Liu Niansheng, Yang Guohao, Wang Yu, and Guo Donghui, “Security Analysis and Configuration of SSL Protocol”, the International Conference on Anti-counterfeiting, Security and Identification, pp. 216-219, 2008.
[32] Yunyoung Lee, Soonhaeng Hur, Dongho Won, and Seungjoo Kim, ” Cipher Suite Setting Problem of SSL Protocol and It’s Solutions”, IEEE International Conference on Advanced Information Networking and Applications Workshops, pp. 26-29, 2009.
[33] Youngsang Shin, Minaxi Gupta, and Steven Myers, “A Study of the Performance of SSL on PDAs”, in the Proceedings of the 28th IEEE international conference on Computer Communications Workshops (INFOCOM), 2009.
[34] Zhikao Ren, Minghua Liu, Chen Ye, and Chuansheng Wang, ”A Scheme of E-Commerce Security based on ECC & SSL Protocol”, IEEE International Symposium on Computer Network and Multimedia Technology, 2009.
[35] Xiandi Zhang, Feng Yang, Zhongqiang Liu, Zhenzhi Wang, and Kaiyi Wang, ”Research and Application of Data Security for Mobile Devices”, IFIP Advances in Information and Communication Technology, Vol. 346/2011, pp. 46-56, 2011.
[36] The Apache interface to OpenSSL. http://www.modssl.org/.
[37] PeerSec Networks MatrixSSL-Open Source Embedded SSL.
http://www.matrixssl.org/
[38] AxTLS embedded SSL. http://axtls.sourceforge.net/
[39] Daesung Lee, Hyun Sook Jang and Ki Chang Kim, ”A Lightweight Protocol Based on the SSL Protocol for Handheld Devices”, IEEE International Conference on Information Science and Applications, 2011.
[40] AbdelNasir Alshamsi and Takamichi Saito, ”A Technical Comparison of IPSec and SSL”, IEEE International Conference on Advanced Information Networking and Applications, pp. 395-398, 2005.
[41] Kefei Cheng, Meng Gao, and Ruijie Guo, ”Analysis and Research on HTTPS Hijacking Attacks”, IEEE International Conference on Networks Security, Wireless Communications and Trusted Computing, pp. 223-226, 2010.
[42] Zhe Chen, Shize Guo, Rong Duan and Sheng Wang, ”Security Analysis on Mutual Authentication against Man-in-the-Middle Attack”, the IEEE International Conference on Information Science and Engineering (ICISE2009), pp. 1855-1858, 2009.
[43] Fang Qi, Zhe Tang and Guojun Wang, “Attacks vs. Countermeasures of SSL Protected Trust Model”, the IEEE International Conference for Young Computer Scientists, pp. 1986-1991, 2008.
[44] Liu Wu, Ren Ping, Zhang Yong and Duan Hai-Xin, “SSL-DP: A Rootkit of Network Based SSL and TLS Traffic Decryptor”, the IEEE Second Cybercrime and Trustworthy Computing Workshop, pp. 29-33, 2010.
[45] Yu Yue, Sun Hao and Kong Yanan, ”Expand the SSL/TLS Protocol on Trusted Platform Module”, the IEEE International Conference on Computer Application and System Modeling , 2010.
[46] Ethereal, http://www.ethereal.com/
[47] WinPcap, http://www.winpcap.org/.
[48] SSL與TLS實務應用–架構全球網路的安全機制, 許建隆譯,碁峯書局，2004.
[49] Eric Rescorla, “SSL and TLS – Designing and Building Secure Systems” http://www.amazon.com/SSL-TLS-Designing-Building-Systems/dp/0201615983.
[50] Stephen Thomas, “SSL and TLS Essentials”, Published by John Wiley & Sons Inc, 2000
[51] Wiliiam Stallings,“Network Security Essentials – Applications and
Standards (4th edition)”, Published by Prentice Hall, 2011