KR100805316B1 - Web service security system based on command code control list and method - Google Patents

Abstract

The present invention relates to a web service security system based on a command code control list. More particularly, the present invention relates to a web service security system based on a command code control list. The request for packets aims to provide a web service security system based on a command code control list capable of patterned and high speed network processing of a responding structure.

In the web service security system based on the command code control list according to the present invention, the web service security system based on the command code control list includes: a data transmission / reception module capable of transmitting and receiving data by opening or closing a socket. module, a web server check module for checking pages, links and parameter information among the data, and malicious parameters for preventing misuse and overuse of system resources in the checked pages, links and parameter information. Insert & Injection module for inserting the malicious parameter command according to the Malicious Parameter Instruction Database (Database), which stores the command in a database, and checks the vulnerability of the data in which the malicious parameter command is inserted. Vulnerability Check Module (Vu) to send and receive modules a lnerable check module, a web server response check module that determines a vulnerability after retransmitting the response status of the web server according to the data, and an instruction validation control list according to the vulnerability analysis result Command Code Control List Creation Module (Vulnerable Page & Parameter List Up Module) for creating a list.

Description

Web service security system based on command code control list and method thereof {Method and System of Instruction Validation Control list Base}

The present invention relates to a web service security system based on a command code control list, and more particularly, to determine whether an internal web application and a database system are vulnerable to an external web hacking attack, and to exclude the list. The request for packets is to provide a web service security system based on a command code control list capable of patterned and high speed network processing of a responding structure.

In general, security against hacking includes network security, system security, and web application security. Among these, web application security plays an important role in an environment where an office work environment changes to an office form.

Web Application Firewall or Web Firewall is a web-based attack that can not be detected by intrusion detection system (IDS) or intrusion prevention system (IPS) with a more specialized inspection engine based on application layer analysis technology and normalization technology. You can defend them. In addition, the access control function according to the URL and the function of self-decrypting and inspecting encrypted SSL traffic are different from the existing security system.

More than 80% of Security Holes during web application services allow the web application or related database to improperly request an invalid value if an invalid parameter value or input is sent from the client. Occurs in the response part.

FIG. 1 illustrates how a typical web service security system operates when an inappropriate input value included in a web client's web access request is included.

As shown in FIG. 1, when looking at the request from the client in detail, notice_view.asp needs a parameter and a value of board, searchType, and searchValue. In this case, the hacker is using the B part of the searchType input parameter.

If an attacker adds an inappropriate value such as "'" "in the C part to searchType =", the web services security system checks the error message in the D part, which is the response of the server, and then checks whether the actual parameter value is vulnerable. Verify that it is not.

Meanwhile, as shown in FIG. 2, the web service security system performs a full check on all packets requested for all web hacking attack detection patterns of positive and negative verification blocks.

In this inspection, the notive_view.asp of the C part requires 3 boards, searchType, and searchValue. If only 1 searchType is found to be vulnerable, the web service security system checks the board and searchType for 2 parameters. Unnecessary packet verification is performed and the problem of web service security system resource consumption is reached.

In other words, it is possible to have an auditing capability for web service hacking attacks in a web server zone that processes millions of session web requests by performing an unspecified whole check instead of checking only the vulnerable parameters that cause the problem. There were no drawbacks.

Specifically, referring to FIG. 2, the web service security system consumes web service security system resources that must match all rules related to the positive and negative schemes for all request divisions requested from the actual client. Among these, the positive rule includes a web hacking detection pattern for a client's request having an absolutely impossible value in normal web communication. Negative rules contain a set of malicious code for web hacking or for causing malicious web security problems.

In other words, it is a method of unconditionally auditing whether or not a web server application or database requested by a client is vulnerable.

Indiscriminate verification and auditing of the request by the client causes a problem of significantly delaying the response speed of the web server as well as the actual web server.

In order to solve the above problems, an object of the present invention is to provide a web application firewall that blocks various web hacking and harmful traffic after real-time analysis / detection using web vulnerabilities such as personal information leakage and web content forgery / modulation.

In addition, by determining whether the internal web application and the database system are vulnerable to the external web hacking attack and listing in advance, the request for the packets excluded from the list is responded to the high speed network processing by the structural patterning. The purpose is to provide a web service security system based on the possible command code control list.

It also aims to make command code control list easier by owning module which can open or close socket in web service security system.

In order to achieve the above object, a web service security system based on a command code control list according to the present invention includes a data send and receive module capable of transmitting and receiving data by opening or closing a socket, and the data. Web server check module that checks pages, links and parameter information, and malicious parameter commands to store misuse and overuse of system resources in the checked pages, links and parameter information. Insert & Injection module for inserting a malicious parameter command according to the Malicious Parameter Instruction Database, and a vulnerability for checking the vulnerability of the data in which the malicious parameter command is inserted and transmitting it to the data transmission / reception module. Vulnerable Check Module and the data Vulnerability analysis module (Web Server Response Check Module) to determine the vulnerability after retransmitting the response status of the web server according to the command, and command code control list for creating an instruction validation control list according to the vulnerability analysis result Characterized in that it comprises a module (Vulnerable Page & Parameter List Up Module).

In order to achieve the above object, the web service security system based on the command code control list according to the present invention is a time schedule module for managing time for rewriting the command code control list after a certain time. / Link / Parameter Update Check Module).

In order to achieve the above object by using an instruction code control list (Instruction Control List Adaptation Module) for mounting the command code control list of the web service security system based on the command code control list according to the present invention, and using the command code control list It is characterized in that it further comprises a Web Hacking Detection Engine (Web Hacking Detection / Block / Redirect Engine) that prevents web hacking of the external client.

In order to achieve the above object, a command code control list interoperability module for interoperating a command code control list system and a command code control list based web command security system based on the present invention with an external system; It further comprises a web hacking detection engine (Web Hacking Detection / Block / Redirect Engine) that prevents web hacking of the external client by using the command code control list, characterized in that the interworking with the external system of the system.

In order to achieve the above object, the command code control list of the web service security system based on the command code control list according to the present invention includes a start line including a start line request header and body, which is a vulnerable web page, and a weak page, link, and parameters. It is characterized in that it comprises a malicious parameter command according to the malicious parameter command database attackable by the client.

In order to achieve the above object, the web service security method based on the command code control list according to the present invention includes a database step in which a malicious parameter command database stores and stores a malicious parameter command in order to prevent misuse and overuse of system resources. A transmission / reception step of transmitting / receiving data by opening or closing a socket by a data transmission / reception module, a web server checking step of checking a page, link and parameter information among the data by a web server check module, and inserting the checked page An insertion step of inserting a malicious parameter command according to the malicious parameter command database into a link and parameter information; a checking step of checking a vulnerability of the malicious parameter command by a vulnerability check module; and a web server according to the malicious parameter by a vulnerability analysis module Answer Command code, characterized in that it comprises a vulnerability analysis step of determining the vulnerability after receiving the status retransmission, and command code control list creation module to create a control list to create a command code control list according to the vulnerability analysis results Control list based web service security method.

In order to achieve the above object, the web service security method based on the command code control list according to the present invention further includes a time schedule step of managing a time for the time schedule module to rewrite the command code control list after a certain time. Characterized in that it comprises a.

In order to achieve the above object, in the web service security method based on the command code control list according to the present invention, the command code control list interoperation module interoperates the command code control list to interoperate the command code control list with the system. And adapting the command code control list externally by the adaptation module, and preventing the web hacking of an external client by using the command code control list by the web hacking prevention engine. Characterized in that it comprises a.

In order to achieve the above object, in the web service security method based on the command code control list according to the present invention, the command code control list interoperation module interoperates the command code control list with the system to interwork with an external system of the system. After the step of adapting the command code control list to the interoperability to interoperate, the command code control list interoperation module is interoperable step for the system and the external system to interoperate the command code control list, and the web hacking prevention engine And preventing web hacking of an external client using the command code control list.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

3 is a diagram illustrating a configuration of a web service security system based on a command code control list according to an embodiment of the present invention.

Hereinafter, the simplified Korean terminology is used while describing the components according to the present invention, but its role and function are not reduced to and interpreted.

Referring to FIG. 3, a web service security system based on a command code control list according to an embodiment of the present invention includes a data send and receive module 10 and a web server check module (web server check module). 20), Insert & Injection module (30), Malicious Parameter Instruction Database (35), Vulnerable Check Module (40), Vulnerability Analysis Module (Web) Server Response Check Module) 50 and a Commandable Code Control List Up Module 60.

The data transmission / reception module 10 serves to transmit and receive data by opening or closing a socket. Therefore, it is possible to more easily create a command code control list by owning a module capable of opening or closing a socket for the purpose of the present invention.

The web server check module 20 checks pages, links, and parameter information among the data.

The insert module 30 inserts a malicious parameter command according to a malicious parameter command database for storing and storing a database of malicious parameter commands for preventing misuse and overuse of system resources in the checked pages, links, and parameter information. do.

The vulnerability check module 40 checks the vulnerability of data into which the malicious parameter command is inserted and transmits the vulnerability to the data transmission / reception module.

The vulnerability analysis module 60 determines the vulnerability after receiving the response state of the web server according to the data again.

The command code control list creation module 70 generates an instruction code control list according to the vulnerability analysis result.

The command code control list includes a start line request header and body, which is a vulnerable web page, a start line including a vulnerable page, links, and parameters, and a malicious parameter command according to a database of malicious parameter commands that can be attacked by a client.

In addition, the web service security system based on the command code control list according to the present invention uses an instruction control list adaptation module (70) for mounting the command code control list and an external device using the command code control list. It may further include a web hacking detection engine (Web Hacking Detection / Block / Redirect Engine) 90 to prevent web hacking of the client.

Further, the web service security system based on the command code control list according to the present invention further includes a time schedule module for managing time for rewriting the command code control list after a certain time has elapsed (Time Schedule Web Server Page / Link /). Parameter Update Check Module) 5 may be further included.

4 is a diagram illustrating a configuration of a web service security system based on a command code control list for interoperating a command code control list with an external system according to another embodiment of the present invention.

5 is a diagram illustrating a sequential flow of a web service security system based on the command code control list of FIG. 3 according to an embodiment of the present invention.

The web service security system based on the command code control list according to the present invention further includes an ILC Interoperability Module 80 for interoperating the system with the command code control list with an external system. The command code control list may be connected to the Web Hacking Detection / Block / Redirect Engine 90 that prevents web hacking of an external client and interoperate with an external system of the system.

Here, the external system refers to a plurality of systems for broadly using the command code control list of the web service security system based on the command code control list according to the present invention by connecting to another external web hacking engine.

As shown in FIG. 3 and FIG. 5, the web service security system based on the command code control list according to the present invention receives a socket from the data transmission / reception module 10 and receives a page / link / parameter from the web server check module 20. Check and insert the malicious parameter command according to the malicious parameter command database 35 in the insert module 30 to the vulnerability check module 40, analyze it in the vulnerability analysis module 50, and generate a command code control list module. In (60), it operates as a sequential step of creating a command code control list.

FIG. 6 is a diagram for requesting and receiving data from a web server of a web service security system based on a command code control list according to an embodiment of the present invention.

In the sequential steps as shown in FIG. 5, the data transmission / reception module 10 transfers predetermined data to the web server and the database 250 to retransmit the directory / file type / parameter name of the current web server.

FIG. 7 is a diagram illustrating a directory, file type, and parameters of a command code control list-based web service security system according to an embodiment of the present invention.

As shown in FIG. 7, a method of requesting an invalid parameter value or input value according to a known hacking attack includes a start line request header & body 210, a start line command 220, and a malicious message. It is composed of a parameter command database 35.

The start line 220 includes a Derectory 221 indicating a current directory, a File Type 222 indicating a file type, and a ParameterName 223 indicating a parameter name.

Therefore, the command code control list according to the malicious parameter command database 35 is a start line request header and body 210, which is actually a vulnerable web page, and a start line 220 including an vulnerable page, a link and a parameter, and an attackable parameter. It consists of a malicious parameter command included in the malicious parameter command database 35 which is a value.

The web service security system based on a command code control list to be described below will be described using a method of blocking hacking through a command code control list for a specific hacking method. Naturally, other hacking methods besides such hacking methods can be blocked by the hacking blocking method through the command code control list.

Hereinafter, the command code control list will be described step by step according to an embodiment of the command code control list based web service security system according to the present invention.

8A is a diagram illustrating a list of command code control lists of a web service security system based on a command code control list according to an embodiment of the present invention.

FIG. 8B is a view showing a command code control list prepared by FIG. 8A.

First, the request syntax requested by the user 150 is passed through a predetermined module inside the web application firewall through the web server and the database 250, respectively, to each Derectory 221, File Type 222, and ParameterName 223. Are stored separately.

Hereinafter, in FIG. 8A, each of the divided parameter 221, the file type 222, the parameter name 223, and the previously stored malicious parameter command database 35 will be described.

The malicious parameter command database 35 includes the Derectory 221, the File Type 222, the ParameterName 223, and the command code control list 400 according to the malicious parameter command database 35, as shown in FIG. 8B. It will be in list form.

As shown in FIG. 8B, one sub list in which the Derectory 221, the File Type 222, and the ParameterName 223 are integrated is one sub list which is the command code control list 400. : Matches 1 to indicate list form

Specifically, the first list 401 of FIG. 8B shows “/board/login.asp?” In which the first Derectory 221, the File Type 222, and the ParameterName 223 are integrated. id = ”is combined with the second list of the command code control list 400,“ or 1 = 1 ”.

In addition, the second list 402 of FIG. 8B shows the “POST / board / login.php?” In which the second Derectory 221, the File Type 222, and the ParameterName 223 are integrated. dbname = ”is the first list of the command code control list 400,“ 1 ”having 1 = 1; -”

That is, the insert module sequentially matches 1: 1 the malicious parameter command according to the malicious parameter command database to the page, the link and the parameter information, or corresponds to the plurality of malicious parameter commands to the one of the page, the link and the parameter information. Let's do it.

Accordingly, the command code control list 400 is preferably configured and listed independently without overlapping each other.

9 is a diagram illustrating performing an audit function according to a request from an external client of a web service security system based on a command code control list according to an embodiment of the present invention.

In conclusion, as shown in FIG. 9, when all of the request phrases 110 requested by the client 100 pass through the web application firewall 200 to which the malicious parameter command database 35 according to the present invention is applied, the second message is transmitted. Equivalent to

Only “http://www.victim.com/board/login.asp?id=“ or 1 = 1 & password = 1234 ”is a drop. This is because the malicious parameter command database 35

Derectory1 (221) is “/ board /” and File Type1 (222) is “login.php? File Type 1 222 is “dbname =” and the second list of command code control lists according to the malicious parameter command database 35 is “” or 1 = 1-“.

Therefore, it is possible to determine the vulnerability of the internal web application and the database system against the external web hacking attack through the malicious parameter command database.

As described above, the web service security system based on the command code control list according to the present invention blocks the web after real-time analysis / detection of various web hacking and harmful traffic using web vulnerabilities such as personal information leakage, web content forgery / modulation, etc. It has the effect of providing an application firewall.

In addition, the web service security system based on the command code control list according to the present invention has the effect of enabling high-speed network processing by determining in advance whether the internal system is vulnerable to external web hacking attacks.

Hereinafter, with reference to Figures 10 and 11 will be described in detail according to an embodiment of the present invention.

FIG. 10 is a diagram illustrating whether a vulnerability is determined due to an injection flow hacking attack of a web service security system based on a command code control list according to an embodiment of the present invention.

In general, injection flaws mean that a hacker uses a web application to deliver malicious code to another system and hacks it using system calls of the corresponding system. Such hacks include hacking systems connected to web applications through system calls, shell commands, and SQL commands.

User authentication is performed using the ID and password entered by the user in the web application. This is not a problem if the user submits a username and password normally, but if a malicious user submits a certain username and password, the authentication process may be invalidated in a web application that has a vulnerability. In the following ID authentication procedure, if the ID is “Id =” or 1 = 1-“, it will be described below on the assumption that the authentication process is invalidated.

As shown in Figure 10, a malicious client has a "POST / board / login.asp? Id = 1 'having 1 = 1; --- ”request, the web hacking prevention engine 90 checks whether it corresponds to the command code control list according to the present invention and blocks it to block the request of“ Http 200 OK ”for the client's request. Will respond with a signal.

Then, the client will say “POST / board / login. asp? If Id = overclass ”request is checked, it does not correspond to the command code control list and then bypassed.

Therefore, the web application program having the above vulnerability can ignore the authentication process through the wrong input value, but the injection flow hacking ignores the authentication process by the web service security system based on the command code control list according to the present invention. That's how you can prevent it.

FIG. 11 is a diagram illustrating whether a vulnerability is determined according to a cross-site scripting hacking attack of a web service security system based on a command code control list according to an embodiment of the present invention.

In general, malicious code that can be executed in a user's browser may be delivered by a cross site scripting (XSS) hacking method that can be used across various platforms. In other words, it is a hacking method that exploits a vulnerability of a web site that allows other users to browse data including data of unauthorized users.

In addition, cross-site scripting is accomplished through the delivery of script structures on the network that allow malicious system vulnerabilities to be exploited, thereby exposing vulnerabilities such as data leakage, privacy breaches, or malicious code injection. As a general result, it may be possible to cause malicious JavaScript to be executed in a web browser, and to gain elevation of privilege for accessing a particular website or service.

As shown in Figure 11, a malicious client has a "POST / board / login.asp? If the request is Id = <SCRIPT> a = / XSS / alert (a.source) </ SCRIPT> ”, the web hacking prevention engine 90 checks whether it corresponds to the instruction code control list according to the present invention and then blocks it. blocking) and responds with a Warning Page signal of “Http 200 OK” to the client's request.

Then, the client will say “POST / board / login. asp? If Id = overclass ”request is checked, it does not correspond to the command code control list and then bypassed.

Hereinafter, a procedure for implementing a web service security system based on a command code control list according to the present invention will be described.

12A and 12B are flowcharts illustrating a sequence of a web service security method based on a command code control list according to an embodiment of the present invention.

First, the malicious parameter command database stores the malicious parameter command as a database to prevent the misuse and overuse of system resources (S100).

The data transmission / reception module opens or closes the socket to transmit and receive data (S110).

Subsequently, the web server check module checks pages, links, and parameter information among the data (S120).

The insert module inserts a malicious parameter command according to the malicious parameter command database into the checked page, link and parameter information (S130).

Subsequently, the vulnerability check module checks the vulnerability of the malicious parameter command (S140).

Then, the vulnerability analysis module determines the vulnerability after receiving the resend response state of the web server according to the malicious parameter (S150).

Subsequently, the command code control list preparation module creates a command code control list according to the vulnerability analysis result (S160).

Subsequently, when not using an external system (S170), the adaptation module is mounted on the web hacking prevention engine so that the command code control list can be operated internally (S171).

Then, the web hacking prevention engine prevents web hacking of the external client by using the command code control list (S172).

On the other hand, when interworking with an external system of the system (S170), after the command code control list interoperation module to adapt the command code control list for interoperation to interoperate the command code control list with the system, The code control list interoperation module interoperates the command code control list between the system and the external system (S173).

Subsequently, the web hacking prevention engine prevents web hacking of an external client using the command code control list (S174).

In addition, although not shown in the figure, the time schedule module may manage a time for re-creating the command code control list after a certain time passes.

The present invention described above is not limited to the above-described embodiments and the accompanying drawings, and various substitutions, changes, and modifications are possible in the technical field of the present invention without departing from the technical spirit of the present invention. It will be clear to those of ordinary knowledge.

1 is a diagram schematically illustrating a configuration of a web service security system based on a command code control list according to the related art.

2 is a diagram schematically illustrating a configuration of a web service security system based on an instruction code control list including positive and negative verification blocks according to the related art.

3 is a diagram illustrating a configuration of a web service security system based on a command code control list according to an embodiment of the present invention.

4 is a diagram showing the configuration of a command code control list based web service security system for interoperating a command code control list with an external system according to another embodiment of the present invention.

5 is a diagram illustrating a sequential flow of a web service security system based on the command code control list of FIG. 3 according to an embodiment of the present invention.

6 is a view showing requesting and receiving data from a web server of a web service security system based on a command code control list according to an embodiment of the present invention.

FIG. 7 is a diagram illustrating a directory, file type, and parameters of a command code control list based web service security system according to an embodiment of the present invention.

8A is a diagram illustrating a list of command code control lists of a web service security system based on a command code control list according to an embodiment of the present invention.

FIG. 8B is a view showing a command code control list created by FIG. 8A; FIG.

9 is a diagram illustrating performing an audit function on request from an external client of a web service security system based on a command code control list according to an embodiment of the present invention.

FIG. 10 is a diagram illustrating whether a vulnerability is determined by an injection flow hacking attack of a web service security system based on a command code control list according to an embodiment of the present invention. FIG.

FIG. 11 is a diagram illustrating whether a vulnerability is determined according to a cross site scripting hacking attack of a web service security system based on a command code control list according to an embodiment of the present invention.

12A and 12B are flowcharts illustrating a sequence of a web service security method based on a command code control list according to an embodiment of the present invention.

<Description of the symbols for the main parts of the drawings>

5: Time Schedule Module

10: data transmission / reception module 20: web server check module

30: insert module 35: malicious parameter command database

40: vulnerability check module 50: vulnerability analysis module

60: command code control list creation module

70: adaptation module 80: command code control list interoperation module

90: Web Hacking Engine 100: Client

110: request syntax 200: web application firewall

210: Star Line 221: Derectory

222: File Type 223: ParameterName

250: web server and database 300: database

400: Command Code Control List

Claims (9)

In a web service security system based on a command code control list including a web server, A data transmission / reception module capable of transmitting and receiving data by opening or closing a socket; A web server check module for checking page, link and parameter information among the data; Insert module for inserting a malicious parameter command according to the malicious parameter instruction database (Database) for storing the database of malicious parameter commands to prevent misuse and overuse of system resources in the checked page, link and parameter information ( Insert & Injection module); A vulnerability check module for checking a vulnerability of data into which the malicious parameter command is inserted and transmitting the same to the data transmission / reception module; A vulnerability analysis module (Web Server Response Check Module) for determining a vulnerability after receiving the response state of the web server according to the data into which the malicious parameter command is inserted; A Vulnerable Page & Parameter List Up Module for creating an Instruction Validation Control List according to the vulnerability analysis result; Command code control list based web service security system, characterized in that configured to include. The method of claim 1, Command code control list, characterized in that it further comprises a time schedule module (Time Schedule Web Server Page / Link / Parameter Update Check Module) for managing the time for rewriting the command code control list after a certain time Based web service security system. The method of claim 1, An instruction control list adaptation module for mounting the instruction code control list; A web hacking prevention engine (Web Hacking Detection / Block / Redirect Engine) for preventing web hacking of an external client using the command code control list; Command code control list based web service security system, characterized in that further comprises a. The method of claim 1, An ICL Interoperability Module for interoperating the command code control list of the web service security system with an external system of the web service security system; And a web hacking prevention engine (Web Hacking Detection / Block / Redirect Engine) that prevents web hacking of an external client using the command code control list. Web service security system based on command code control list. The method of claim 1, The command code control list contains malicious parameter commands according to the database of malicious parameter commands that can be attacked by the client and the start line, which includes vulnerable web pages, the start line request header and body, and vulnerable pages, links and parameters. Web service security system based on the command code control list, characterized in that configured to include. In the method using a web service security system based on the command code control list according to claim 1, A database step of storing the malicious parameter command database into a database storing the malicious parameter command for preventing misuse and overuse of system resources; A data transmitting / receiving module for transmitting and receiving data by opening or closing a socket; A web server checking step of the web server checking module checking a page, a link and parameter information among the data; Inserting, by an insert module, a malicious parameter command according to the malicious parameter command database into the checked page, link and parameter information; A checking step of a vulnerability checking module checking a vulnerability of the malicious parameter command; A vulnerability analysis step of determining a vulnerability after the vulnerability analysis module retransmits the response state of the web server according to the malicious parameter; A control list preparation step of creating a command code control list according to the vulnerability analysis result by the command code control list creation module; Web code security method based on the command code control list, characterized in that configured to include. The method of claim 6, A time schedule step of managing, by a time schedule module, a time for re-creating the command code control list after a predetermined time has elapsed; Web code security method based on the command code control list, characterized in that the configuration further comprises. The method of claim 6, An adaptation step, wherein an adaptation module adapts the command code control list for internal operation to operate the system and the command code control list; Preventing, by the web hacking prevention engine, web hacking of an external client using the command code control list; Web code security method based on the command code control list, characterized in that the configuration further comprises. The method of claim 6, In order for the web service security system to interwork with an external system of the web service security system, After an adaptation step, the command code control list interoperation module adapts the command code control list to operation to interoperate the command code control list between the web service security system and its external system. Interoperating, by the command code control list interoperation module, to interoperate the command code control list between the web service security system and an external system of the web service security system; Preventing, by the web hacking prevention engine, web hacking of an external client using the command code control list; Web code security method based on the command code control list, characterized in that the configuration further comprises.

Images