论文标题
OpenAPI规范扩展安全方案：一种减少损坏对象级别授权流行率的方法
OpenAPI Specification Extended Security Scheme: A method to reduce the prevalence of Broken Object Level Authorization
论文作者
论文摘要
API已成为实现服务间通信的首选技术。 API部署的增长推动了解决其缺乏安全标准的紧迫性。鉴于OpenAPI标准中缺乏标准化授权，API安全是一个主题，不当的授权为已知和未知漏洞的可能性打开了可能性，在过去的几年中，恶意参与者利用了这些漏洞，导致数据丢失。本文研究了API安全性中的第一漏洞：损坏的对象级别授权（BOLA），并提出了降低此漏洞流行率的方法和工具。 Bola影响了各种API框架，我们的范围固定在OpenAPI规范（OAS）上。 OAS是描述和实施API的标准；流行的OAS实施是Fastapi，Connexion（烧瓶）等。这些实现具有与API属性知识相关的利弊。打开的API规格安全属性未解决对象授权，也没有提供标准化的方法来定义此类对象属性。这使对象级的安全受到开发人员的摆布，这给出了无意间创造攻击向量的风险增加。我们的目的是通过引入1）OAS ESS（OpenAPI规范扩展安全方案）来解决这一空白，其中包括OAS中对象的声明性安全控制（基于设计的方法），以及2）一个可以将授权模块导入API服务（BLASK/FASTAPI）以在对象级别（基于开发的方法）进行授权检查。构建API服务时，开发人员可以从API设计（规范）或其代码开始。在这两种情况下，都引入了一组机制，以帮助开发人员减轻和降低Bola的患病率。
APIs have become the prominent technology of choice for achieving inter-service communications. The growth of API deployments has driven the urgency in addressing its lack of security standards. API Security is a topic for concern given the absence of standardized authorization in the OpenAPI standard, improper authorization opens the possibility for known and unknown vulnerabilities, which in the past years have been exploited by malicious actors resulting in data loss. This paper examines the number one vulnerability in API Security: Broken Object Level Authorization(BOLA), and proposes methods and tools to reduce the prevalence of this vulnerability. BOLA affects various API frameworks, our scope is fixated on the OpenAPI Specification(OAS). The OAS is a standard for describing and implementing APIs; popular OAS Implementations are FastAPI, Connexion (Flask), and many more. These implementations carry the pros and cons that are associated with the OASs knowledge of API properties. The Open API Specifications security properties do not address object authorization and provide no standardized approach to define such object properties. This leaves object-level security at the mercy of developers, which presents an increased risk of unintentionally creating attack vectors. Our aim is to tackle this void by introducing 1) the OAS ESS (OpenAPI Specification Extended Security Scheme) which includes declarative security controls for objects in OAS (design-based approach), and 2) an authorization module that can be imported to API services (Flask/FastAPI) to enforce authorization checks at the object level (development-based approach). When building an API service, a developer can start with the API design (specification) or its code. In both cases, a set of mechanisms are introduced to help developers mitigate and reduce the prevalence of BOLA.
