Database structure random change-based SQL injection defense method and system

A technology of random change and defense system, applied in the field of network information security, to increase the difficulty, reduce the probability of success, and deploy flexible methods

Active Publication Date: 2017-11-24
FUDAN UNIV
View PDF8 Cites 5 Cited by
  • Summary
  • Abstract
  • Description
  • Claims
  • Application Information

AI Technical Summary

Problems solved by technology

This defense method causes a certain lag, and it is obviously difficult to be effective in the face of unknown forms of SQL injection attacks

Method used

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
View more

Image

Smart Image Click on the blue labels to locate them in the text.
Viewing Examples
Smart Image
  • Database structure random change-based SQL injection defense method and system
  • Database structure random change-based SQL injection defense method and system
  • Database structure random change-based SQL injection defense method and system

Examples

Experimental program
Comparison scheme
Effect test

Embodiment Construction

[0046] The following is a detailed description of the key technologies and implementation methods in the overall architecture of the invention, mainly including the management and maintenance of metadata and system parameters, the randomization of metadata names, the modification of metadata names, the script update of the Web server, the Web Terminal plug-ins and scheduled tasks.

[0047] 1. Management and maintenance of metadata and system parameters

[0048] In the management and maintenance function, set the list of metadata names that need to be randomized. Generally speaking, it is not necessary to record all the metadata names of the entire database into the SQL injection defense module, because different metadata have different impact on the attack. The roles of the two are not the same. Two key files are maintained here, namely system configuration files and metadata files.

[0049] System parameters can be stored in a simple system configuration file format. The ba...

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to view more

PUM

No PUM Login to view more

Abstract

The invention belongs to the technical field of network information safety, and specifically discloses a database structure random change-based SQL injection defense method and system. The method comprises the following steps of: firstly carrying out active and random change on a key metadata name in a database by using an active defense thought, and synchronizing the change with an application program at a Web side to ensure that metadata names of the whole database application system randomly change in a certain parameter space, so as to increase the difficulty of guessing the metadata names by attackers of SQL injection; and increasing the name space through setting proper time interval of parameter random change, so as to effectively reduce the SQL injection attack success probability and decrease the bad influences brought to normal users in the random change process. The system mainly comprises an SQL injection defense module and a Web side plugin; the SQL injection defense module and the Web side plugin form a novel framework to carry out safety reinforcement on an application system formed by a Web server and a database server; and the deployment is flexible and convenient.

Description

technical field [0001] The invention belongs to the technical field of network information security, and in particular relates to a SQL injection defense method and system. Background technique [0002] With the rapid development of Internet applications, the Web-based architecture has become the first choice for many business architectures due to its simplicity and easy deployment. In this architecture, Web services and database services are generally configured. Logically, these two services are separated, that is, users conduct business processing through Web pages, and during this process, the scripts contained in the pages access database services when necessary. However, because some web page programs do not judge the legality of the data passed in by the user or the parameters carried by the page, or the judgment method is not perfect, the attacker uses this vulnerability to implant a SQL statement into the passed in parameters, thereby Illegal operations such as des...

Claims

the structure of the environmentally friendly knitted fabric provided by the present invention; figure 2 Flow chart of the yarn wrapping machine for environmentally friendly knitted fabrics and storage devices; image 3 Is the parameter map of the yarn covering machine
Login to view more

Application Information

Patent Timeline
no application Login to view more
Patent Type & Authority Applications(China)
IPC IPC(8): G06F21/55G06F17/30
CPCG06F21/554G06F16/2282G06F16/951
Inventor 曾剑平黄智行
Owner FUDAN UNIV
Who we serve
  • R&D Engineer
  • R&D Manager
  • IP Professional
Why Eureka
  • Industry Leading Data Capabilities
  • Powerful AI technology
  • Patent DNA Extraction
Social media
Try Eureka
PatSnap group products

Browse by: Latest US Patents, China's latest patents, Technical Efficacy Thesaurus, Application Domain, Technology Topic.

© 2024 PatSnap. All rights reserved.Legal|Privacy policy|Modern Slavery Act Transparency Statement|Sitemap