中文摘要：

HTML5应用程序缓存使浏览器可以离线地访问Web应用,同时也产生了新的缓存中毒攻击手段。首先,对应用程序缓存中毒攻击的原理及危害进行了分析,然后针对使用应用程序缓存的站点,首次提出了2次替换manifest文件的新式缓存中毒攻击方法 RFTM。在RFTM攻击中,服务器端不会收到客户端发送的异常HTTP请求,故对服务器进行配置无法防范,攻击更具隐蔽性。最后设计了一套能有效防止此类攻击的应用层轻量级签名防御方案Sec-Cache。实验表明Sec-Cache防御方案能够有效地防御RFTM攻击,并有良好的性能与兼容性。

英文摘要：

HTML5 application cache （AppCache） allowed Web browser to access Web offline. But it also brought a new method of cache poisoning attack that was more persisting. As for websites which used the AppCache, a novel poisoning method RFTM （replace file twice method）, in which the attacker replaced the manifest file twice to poison the client＇s AppCache, was proposed. Compared with the original attack, the legal server would not receive abnormal HTTP requests from the client in the attack. Therefore, changing the server configuration could not prevent the client from the RFTM AppCache poisoning. To avoid the attack mentioned above, a lightweight signature defense scheme Sec-Cache in application layer was designed. Furthermore, experiments show that it has good performance and compatibility.