Biblio

Most modern cloud and web services are programmatically accessed through REST APIs. This paper discusses how an attacker might compromise a service by exploiting vulnerabilities in its REST API. We introduce four security rules that capture desirable properties of REST APIs and services. We then show how a stateful REST API fuzzer can be extended with active property checkers that automatically test and detect violations of these rules. We discuss how to implement such checkers in a modular and efficient way. Using these checkers, we found new bugs in several deployed production Azure and Office365 cloud services, and we discuss their security implications. All these bugs have been fixed.

The operation and management of network is facing increasing complexities brought by the evolution of network protocols and the demands of rapid service delivery. In this paper, we propose a programmable network management architecture, which manages network based on NETCONF protocol and provides REST APIs to upper layer so that further programming can be done based on the APIs to implement flexible management. Functions of devices can be modeled based on YANG language, and the models can be translated into REST APIs. We apply it to the management of ADN (Address Driven Network), an innovative network architecture proposed by Tsinghua University to inhibit IP spoofing, improve network security and provide high service quality. We model the functions of ADN based on YANG language, and implement the network management functions based on the REST APIs. We deploy and evaluate it in a laboratory environment. Test result shows that the programmable network management architecture is flexible to implement management for new network services.