Method for detecting database management system access control defects

Abstract

This invention provides a method for detecting access control defects in a database management system. The method includes performing permission interpolation on the operation sequence corresponding to the target database to obtain permission-aware test cases; determining unauthorized objects corresponding to ordinary users based on the query results of a first system table corresponding to administrators and a second system table corresponding to ordinary users; and detecting access control defects in the database management system based on the permission-aware test cases and the unauthorized objects. This invention dynamically configures user permissions for operation sequences, enabling the database to perform multiple operations under different permission states. It uses unauthorized objects as the criterion for detecting access control defects and automatically identifies potential defects in the database access control implementation by combining permission-aware test cases. This improves the efficiency and adaptability of the detection method and effectively discovers complex and hidden access control defects in DBMSs.

Description

Technical Field

[0001] This invention relates to the field of database management system security testing technology, and in particular to a method for detecting access control defects in database management systems. Background Technology

[0002] Access control is a core security mechanism of a Database Management System (DBMS). Its design aims to ensure that users can only access data and resources within their authorized scope through permission management, thereby preventing data leakage, tampering, or corruption. DBMSs often manage access permissions by implementing multi-level authorization mechanisms, such as role-based access control. However, as DBMS functionality becomes increasingly complex, the actual implementation of access control mechanisms often has subtle and difficult-to-detect problems, leading to "broken access control" (BAC) vulnerabilities. These vulnerabilities allow unauthorized users to perform operations beyond their privileges, potentially resulting in privilege escalation and unauthorized information disclosure, seriously threatening data confidentiality, integrity, and system security.

[0003] Existing methods for detecting database access control flaws primarily rely on manual testing and automated static analysis. However, manual testing is highly dependent on the experience of domain experts, is time-consuming, and difficult to scale. Furthermore, due to the multi-layered and dynamic nature of DBMS access control mechanisms and their support for massive amounts of Structured Query Language (SQL) commands, many potential access control flaws involving complex contextual interactions remain undetected. Existing static analysis methods struggle to construct an accurate and universally applicable model to characterize the complex, state-dependent access control behavior of DBMSs, making it difficult to reliably discover access control flaws. Therefore, existing methods for detecting database access control flaws suffer from low efficiency and poor adaptability, making it difficult to systematically and effectively discover complex and hidden access control flaws in DBMSs. Summary of the Invention

[0004] This invention provides a method for detecting access control flaws in database management systems. Existing technologies suffer from low efficiency and poor adaptability, making it difficult to systematically discover complex and hidden access control flaws in DBMSs. This invention dynamically configures user permissions for operation sequences, generates permission-aware test cases, and causes the database to perform various operations under different permission states. This systematically explores database states that may induce access control flaws. This invention uses unauthorized objects as the criterion for access control flaw detection, and combines permission-aware test cases to automatically identify potential defects in the database access control implementation, thereby improving the efficiency and adaptability of the detection method and effectively discovering complex and hidden access control flaws in DBMSs.

[0005] This invention provides a method for detecting access control defects in a database management system, comprising the following steps: Perform permission interpolation on the operation sequence corresponding to the target database to obtain permission-aware test cases; Based on the query results of the first system table corresponding to the administrator and the query results of the second system table corresponding to the ordinary user, the unauthorized object corresponding to the ordinary user is determined. Based on the permission-aware test cases and the unauthorized objects, access control defects in the database management system are detected.

[0006] According to a method for detecting access control defects in a database management system provided by the present invention, the step of performing permission interpolation processing on the operation sequence corresponding to the target database to obtain permission-aware test cases includes: determining the target permission corresponding to each operation command based on the database object corresponding to each operation command in the operation sequence; generating permission control statements corresponding to each operation command based on the target permissions corresponding to each operation command; and performing permission interpolation processing on the operation sequence based on each permission control statement and the executing user to obtain the permission-aware test cases.

[0007] According to a method for detecting access control defects in a database management system provided by the present invention, the step of determining the target permission corresponding to each operation command based on the database object corresponding to each operation command in the operation sequence includes: determining the target permission level corresponding to each operation command based on the database object corresponding to each operation command in the operation sequence; determining the target database object corresponding to each operation command based on the target permission level; and determining the target permission corresponding to each operation command based on the target database object and the permission type set corresponding to the target database object.

[0008] According to a method for detecting access control defects in a database management system provided by the present invention, the step of performing permission interpolation processing on the operation sequence based on each permission control statement and the executing user to obtain the permission-aware test cases includes: assigning an administrator's executing user to each permission control statement to obtain a first execution tuple corresponding to each operation command; assigning a regular user's executing user to each operation command to obtain a second execution tuple corresponding to each operation command; assigning an administrator's executing user to each operation command to obtain a third execution tuple corresponding to each operation command; and determining the permission-aware test cases based on each first execution tuple, each second execution tuple, and each third execution tuple.

[0009] According to a method for detecting access control defects in a database management system provided by the present invention, the step of determining the unauthorized object corresponding to the ordinary user based on the query results of a first system table corresponding to the administrator and the query results of a second system table corresponding to the ordinary user includes: performing a difference analysis on a first object tuple in the query results of the first system table and a second object tuple in the query results of the second system table to obtain at least one target object tuple that exists in the query results of the first system table but does not exist in the query results of the second system table; and determining the target object tuple as the unauthorized object.

[0010] According to a method for detecting access control defects in a database management system provided by the present invention, the method further includes: constructing a set of sample objects in an empty database; based on the sample objects, traversing each system table in the target database as an administrator to obtain a target system table set; traversing the system tables in the target system table set as an administrator to obtain at least one first database object, a first object type of each first database object, and a first dependent object of each first database object; constructing a first object tuple corresponding to each first database object based on each first database object, each first object type, and each first dependent object; determining the query result of the first system table based on each first object tuple; traversing the system tables in the target system table set as a regular user to obtain at least one second database object, a second object type of each second database object, and a second dependent object of each second database object; constructing a second object tuple corresponding to each second database object based on each second database object, each second object type, and each second dependent object; and determining the query result of the second system table based on each second object tuple.

[0011] According to the present invention, a method for detecting access control defects in a database management system includes detecting such defects based on the permission-aware test cases and the unauthorized object. The method comprises: executing a first execution tuple corresponding to a target operation command in the permission-aware test cases to obtain a test scenario corresponding to the target operation command; the target operation command being any operation command in the operation sequence; executing a second execution tuple corresponding to the target operation command in the test scenario to obtain a first execution result; and detecting the database management system access control defect based on the first execution result and the unauthorized object.

[0012] According to a method for detecting access control defects in a database management system provided by the present invention, the step of detecting the database management system access control defect based on the first execution result and the unauthorized object includes: if the first execution result is successful and the unauthorized object appears in the execution result, detecting the database management system access control defect as result set exposure; if the first execution result is an error and the unauthorized object appears in the execution result, determining the database management system access control defect as error information exposure; and if the first execution result is successful and the unauthorized object appears in the target operation command, determining the database management system access control defect as successful access to an unauthorized object.

[0013] According to the present invention, a method for detecting access control defects in a database management system further includes: if the first execution result is an error, executing the third execution tuple corresponding to the target operation command to obtain a second execution result; and based on the second execution result, continuing to execute subsequent operation commands in the permission-aware test case.

[0014] According to a method for detecting access control defects in a database management system provided by the present invention, the method further includes: determining the valid database object types in the target database; generating data definition statements, data operation statements, and data query statements based on the valid database object types and operation types; and determining the operation sequence based on the data definition statements, data operation statements, and data query statements.

[0015] The present invention also provides a detection device for access control defects in a database management system, comprising the following modules: The permission interpolation module is used to perform permission interpolation on the operation sequence corresponding to the target database to obtain permission-aware test cases. The determination module is used to determine the unauthorized object corresponding to the ordinary user based on the query results of the first system table corresponding to the administrator and the query results of the second system table corresponding to the ordinary user. The detection module is used to detect access control defects in the database management system based on the permission-aware test cases and the unauthorized objects.

[0016] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the database management system access control defect detection method as described above.

[0017] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements a method for detecting access control defects in a database management system as described above.

[0018] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements a method for detecting access control defects in a database management system as described above.

[0019] This invention provides a method for detecting access control defects in a database management system. It obtains permission-aware test cases by performing permission interpolation on the operation sequence corresponding to the target database. Based on the query results of the first system table corresponding to the administrator and the second system table corresponding to the ordinary user, unauthorized objects corresponding to the ordinary user are identified. Based on the permission-aware test cases and the unauthorized objects, access control defects in the database management system are detected. Thus, by dynamically configuring user permissions on the operation sequence and generating permission-aware test cases, the database performs various operations under different permission states to systematically explore database states that may induce access control defects. This invention uses unauthorized objects as the criterion for access control defect detection and automatically identifies potential defects in the database access control implementation by combining permission-aware test cases, thereby improving the efficiency and adaptability of the detection method and effectively discovering complex and hidden access control defects in DBMS. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0021] Figure 1 This is a schematic diagram illustrating access control defects in the OceanBase database provided by the present invention.

[0022] Figure 2 This is a flowchart illustrating the method for detecting access control defects in a database management system provided by the present invention.

[0023] Figure 3 This is an example diagram of the permission-aware test cases provided by the present invention.

[0024] Figure 4 This is a schematic diagram illustrating an example of unauthorized object identification provided by the present invention.

[0025] Figure 5A This is a schematic diagram of a first embodiment of system table consistency violation provided by the present invention.

[0026] Figure 5B This is a schematic diagram of the second embodiment of the system table consistency violation provided by the present invention.

[0027] Figure 5C This is a schematic diagram of the third embodiment of the system table consistency violation provided by the present invention.

[0028] Figure 6 This is a schematic diagram of the structure of the database management system access control defect detection device provided by the present invention.

[0029] Figure 7 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0031] Figure 1 This is a schematic diagram illustrating access control flaws in the OceanBase database provided by the present invention, as shown below. Figure 1 As shown, "CREATE TRIGGER hack_trigger BEFORE INSERT ON t0 FOR EACH ROW" indicates that a regular user with only basic permissions to manage their own table and create triggers creates a trigger that accesses other users' tables. "INSERT INTO t1 SELECT * FROM table_of_other_user" indicates that a SELECT operation on another user's table is embedded in the trigger definition. "INSERT INTO t0 VALUES ('')" indicates that the trigger is activated using the INSERT command. Figure 1The expected result shows that the INSERT operation failed, and the SELECT command accessing `table_of_other_user` within the trigger body was denied. When the trigger was activated, OceanBase only checked whether the user had the `CREATE TRIGGER` permission, ignoring the permissions required for the trigger's internal operations. This allowed the SELECT operation to bypass permission checks and successfully read sensitive data from other users. Figure 1 The actual result: The INSERT operation succeeded, and the contents of `table_of_other_user` were stored in table `t1` without any permission checks. The root cause of this flaw lies in the incomplete implementation of access control checks, failing to recursively verify permissions for nested operations within triggers. Similar implementation flaws can be widespread in various complex SQL commands and objects (such as views and stored procedures), posing a continuous threat to database security.

[0032] Manually constructing test scenarios relies primarily on testers manually writing SQL test sequences to verify whether the system behavior under specific permission configurations meets expectations. While manual testing may be effective for verifying known or preset scenarios, the process is highly dependent on the experience of domain experts, time-consuming, and difficult to scale. More importantly, DBMS access control mechanisms are multi-layered (e.g., global, database, table, column level), dynamic (permissions change in real time with user roles and operational contexts), and support a massive number of SQL commands. This makes it impractical to systematically cover all possible permission configurations and operation sequences through manual enumeration, resulting in a large number of potential access control flaws, especially those involving complex contextual interactions, going undetected.

[0033] Static analysis tools typically perform code path or permission policy checks based on predefined rules. However, in databases, access control logic is not static and immutable. The effectiveness, granularity, and objects of permission checks heavily depend on the database's runtime state (e.g., existing tables and schemas), user session history, and specific SQL command sequences. This high degree of dynamism and contextual dependency often renders rule-based analysis methods, which rely on the static assumption that "the same operation must trigger the same permission check," ineffective. For example, the same SHOW command may yield completely different permission check results under different preceding operation sequences. Therefore, existing static analysis methods struggle to construct an accurate and universally applicable model to characterize the complex, state-dependent access control behavior of DBMSs, making it difficult to reliably discover access control flaws in DBMSs.

[0034] To address the aforementioned problems, this invention proposes a method for detecting access control defects in database management systems. By dynamically configuring user permissions for operation sequences and generating permission-aware test cases, the database performs various operations under different permission states to systematically explore database states that may induce access control defects. This invention uses unauthorized objects as the criterion for detecting access control defects and automatically identifies potential defects in the database access control implementation by combining permission-aware test cases, thereby improving the efficiency and adaptability of the detection method and effectively discovering complex and hidden access control defects in DBMS.

[0035] The following is combined with Figure 2 Figure 5 illustrates the method for detecting database management system access control defects of the present invention. The subject executing this method can be an electronic device or a database management system access control defect detection device installed in the electronic device. The database management system access control defect detection device can be implemented by software, hardware or a combination of both.

[0036] Figure 2 This is a flowchart illustrating the method for detecting access control defects in a database management system provided by the present invention, as shown below. Figure 2 As shown, the method includes the following: Step 101: Perform permission interpolation on the operation sequence corresponding to the target database to obtain permission-aware test cases.

[0037] Here, the operation sequence can be an SQL sequence consisting of data definition statements, data manipulation statements, and data query statements, i.e., multiple SQL commands.

[0038] Here, permission interpolation refers to inserting corresponding permission control statements into each SQL command in the operation sequence.

[0039] Here, permission-aware test cases can include not only permission control statements, but also statements executed by administrators and statements executed by ordinary users.

[0040] Here, the operation sequence can contain commands for data definition statements, data manipulation statements, and data query statements.

[0041] Furthermore, the step of performing permission interpolation processing on the operation sequence corresponding to the target database to obtain permission-aware test cases includes: determining the target permission corresponding to each operation command based on the database object corresponding to each operation command in the operation sequence; generating permission control statements corresponding to each operation command based on the target permissions corresponding to each operation command; and performing permission interpolation processing on the operation sequence based on each permission control statement and the executing user to obtain the permission-aware test cases.

[0042] Here, database objects can include tables, databases, columns, etc. The permission level corresponding to a database is used to represent the hierarchy of database objects; for example, global level > database level > table level > column level.

[0043] Here, target permissions include, but are not limited to, CREATE, SELECT, INSERT, etc.

[0044] Here, the target permission can be determined directly based on the mapping relationship between the database object, the permission level of the database object, and the target permission; or the target permission level can be determined first based on the database object, and then the target permission can be determined based on the target permission level.

[0045] It should be noted that after determining the target permissions, permission control statements can be generated randomly. These statements may be grant (GRANT) or revoke (REVOKE).

[0046] After generating the permission control statements corresponding to each operation command, you can add a regular user as the execution user for each operation command and an administrator user as the execution user for each permission control statement. Then, combine the commands with the added execution users into permission-aware test cases.

[0047] In this embodiment of the invention, by generating permission control statements for each operation command, test scenarios under different permission conditions are constructed, and ordinary user permissions are dynamically configured, enabling the database to systematically explore the database access control logic under different permission states, thereby improving the coverage of access control defect detection.

[0048] Furthermore, determining the target permission corresponding to each operation command based on the database object corresponding to each operation command in the operation sequence includes: determining the target permission level corresponding to each operation command based on the database object corresponding to each operation command in the operation sequence; determining the target database object corresponding to each operation command based on the target permission level; and determining the target permission corresponding to each operation command based on the target database object and the permission type set corresponding to the target database object.

[0049] Here, the target permission level can be a permission level that is appropriate to or higher than the database object corresponding to the operation command. For example, if the database object corresponding to the operation command is a table and the permission level is global level > database level > table level > column level, then the target permission level can be table level, database level, or global level.

[0050] It should be noted that different permission levels have different sets of permission types, including permissions such as CREATE, ELECT, and NSERT.

[0051] After determining the target permission level, randomly select a permission from the set of permission types corresponding to the target permission level as the target permission.

[0052] In this embodiment of the invention, the target permission level is determined by the database object in the operation command, and the target permission is selected from the set of permission types of the target permission level to ensure comprehensive coverage of diverse SQL operations and permission configurations.

[0053] Furthermore, the step of performing permission interpolation processing on the operation sequence based on each of the permission control statements and the executing user to obtain the permission-aware test cases includes: assigning an administrator's executing user to each of the permission control statements to obtain a first execution tuple corresponding to each of the operation commands; assigning a regular user's executing user to each of the operation commands to obtain a second execution tuple corresponding to each of the operation commands; assigning an administrator's executing user to each of the operation commands to obtain a third execution tuple corresponding to each of the operation commands; and determining the permission-aware test cases based on each of the first execution tuple, each of the second execution tuple, and each of the third execution tuple.

[0054] Here, each operation command is assigned two execution users: an administrator and a regular user. During later execution, the operation command is executed first by the regular user. If the regular user fails due to insufficient permissions, the administrator continues to execute the operation command to ensure that subsequent tests can still be built on a consistent and valid database state.

[0055] Here, the first execution tuple, the second execution tuple, and the third execution tuple can be execution tuples consisting of the executing user and the operation command (such as an SQL statement).

[0056] It should be noted that each operation command, i.e., SQL statement, has a corresponding permission-aware test segment, and permission-aware test segments of multiple operation commands constitute permission-aware test cases.

[0057] Figure 3 This is an example diagram of the permission-aware test cases provided by the present invention, such as... Figure 3 As shown, the generated operation sequence includes Data Definition Language (DDL), Data Manipulation Language (DML), and Data Query Language (DQL). The permission-aware test cases include Access Control Language (DCL) commands. Figure 3 (Blue text) Commands executed by ordinary users ( Figure 3 (white statements in the text) and alternative commands ( Figure 3 (The grayed-out statements) are the backup commands that are executed only if a regular user's command execution fails.

[0058] In this embodiment of the invention, by configuring a first execution tuple, a second execution tuple, and a third execution tuple for various SQL operations, a permission-aware test sequence containing various SQL operations is automatically generated. During execution, ordinary user permissions and administrator permissions are dynamically configured, thereby systematically exploring the database access control logic under different permission states and improving the coverage of access control defect detection.

[0059] Step 102: Based on the query results of the first system table corresponding to the administrator and the query results of the second system table corresponding to the ordinary user, determine the unauthorized object corresponding to the ordinary user.

[0060] Here, unauthorized objects refer to database objects that are restricted to access by ordinary users, such as tables, columns, and triggers. The purpose of identifying unauthorized objects is to collect information on all objects in the database management system that are inaccessible to ordinary users, and to define the authorization boundaries for users under the current permission configuration. Since accessing these objects inherently constitutes a breach of access control, this information will be further used to detect unauthorized access behavior in the database.

[0061] Here, the query results of the first system table include objects visible to administrators, and the query results of the second system table include objects visible to ordinary users.

[0062] Here, by performing a difference analysis on the query results of the first system table and the query results of the second system table, if there is an object in the query results of the first system table that is not in the query results of the second system table, the object is identified as an unauthorized object.

[0063] Furthermore, determining the unauthorized object corresponding to the ordinary user based on the query results of the first system table corresponding to the administrator and the query results of the second system table corresponding to the ordinary user includes: performing a difference analysis on the first object tuple in the query results of the first system table and the second object tuple in the query results of the second system table to obtain at least one target object tuple that exists in the query results of the first system table but does not exist in the query results of the second system table; and determining the target object tuple as the unauthorized object.

[0064] Here, an object tuple can be a tuple consisting of an object name, an object type, and the names of its dependent objects. The dependent objects are used to describe the parent objects to which the object belongs, such as the schema to which the table belongs or the table to which the column belongs.

[0065] It should be noted that two object tuples are considered the same only if the three fields of object name, object type and dependent object name are exactly the same.

[0066] For example, a difference analysis is performed on the first object tuple in the query result of the first system table and the second object tuple in the query result of the second system table. If there is an object tuple in the query result of the first system table that is not in the query result of the second system table, then the object corresponding to the object tuple is an unauthorized object.

[0067] Figure 4 This is a schematic diagram illustrating an example of unauthorized object identification provided by the present invention, such as... Figure 4 As shown, the administrator has full privileges and can retrieve the query results of the first system table. Figure 4 The system table above; ordinary users have limited permissions and can obtain the query results of the second system table by querying it. Figure 4 The system table below, through difference analysis between the system table above and the system table below, reveals unauthorized objects. Figure 4 Medium blue indicates, Figure 4 Medium gray indicates authorized objects.

[0068] In this embodiment of the invention, by comparing the metadata results obtained by different users from querying the system table, database objects that ordinary users do not have the right to access are automatically identified, the authorization boundaries of users under the current permission configuration are characterized, and this is used as the basis for determining access control defects.

[0069] Furthermore, the method further includes: constructing a set of sample objects in an empty database; based on the sample objects, traversing each system table in the target database as an administrator to obtain a target system table set; traversing the system tables in the target system table set as an administrator to obtain at least one first database object, a first object type for each first database object, and a first dependent object for each first database object; constructing a first object tuple corresponding to each first database object based on each first database object, each first object type, and each first dependent object; determining the query result of the first system table based on each first object tuple; traversing the system tables in the target system table set as a regular user to obtain at least one second database object, a second object type for each second database object, and a second dependent object for each second database object; constructing a second object tuple corresponding to each second database object based on each second database object, each second object type, and each second dependent object; and determining the query result of the second system table based on each second object tuple.

[0070] Here, the sample object can be a table, view, function, etc.

[0071] Here, the target system table set is the minimum set of system tables that can cover all database objects.

[0072] For example, after constructing sample objects in an empty database, the administrator traverses each system table to determine which system tables will expose the names of the sample objects, and then selects the minimum set of system tables that can cover all database objects.

[0073] For example, in MySQL, information_schema.tables already reflects view information, so there is no need to query information_schema.views separately.

[0074] Here, the first database object refers to the database object that can be accessed by the administrator, the first object type refers to the type of the first database object, and the first dependent object refers to the object to which the first database object belongs.

[0075] After obtaining the target system table set, execute the system table query as an administrator to obtain information about accessible database objects, such as schemas, tables, columns, triggers, functions, and stored procedures. Combine the accessible database objects, the types of accessible database objects, and the dependent objects of the accessible database objects into a first object tuple. Based on all the first object tuples, obtain the first system table query results.

[0076] It should be noted that the administrator has administrative privileges, and therefore can query the metadata of all database objects.

[0077] In this embodiment of the invention, by pre-constructing sample objects in an empty database, a minimum set of system tables is obtained, ensuring that when administrators and ordinary users perform system table queries later, redundant query overhead is reduced without losing coverage capability, thereby improving efficiency.

[0078] Here, the second database object refers to a database object that can be accessed by ordinary users, the second object type refers to the type of the second database object, and the second dependent object refers to the object to which the second database object belongs.

[0079] After obtaining the target system table set, execute the system table query as a regular user to obtain accessible database object information, such as schemas, tables, columns, triggers, functions, and stored procedures. Combine the accessible database objects, the types of accessible database objects, and the dependent objects of accessible database objects into a second object tuple. Based on all the second object tuples, obtain the second system table query results.

[0080] In this embodiment of the invention, by performing system table queries on the target system table set, redundant query overhead is reduced and efficiency is improved without sacrificing coverage capability.

[0081] Step 103: Based on the permission-aware test cases and the unauthorized objects, detect access control defects in the database management system.

[0082] Here, by comparing the execution results of permission-aware test cases with those of unauthorized objects, access control defects in the database management system can be identified.

[0083] Here, database management system access control flaws can include information leakage flaws and privilege escalation flaws.

[0084] In this embodiment of the invention, user permissions are dynamically configured on the operation sequence to generate permission-aware test cases, enabling the database to perform multiple operations under different permission states. This systematically explores database states that may induce access control defects. The invention uses unauthorized objects as the basis for determining access control defects and automatically identifies potential defects in the database access control implementation by combining permission-aware test cases. This improves the efficiency and adaptability of the detection method and effectively discovers complex and hidden access control defects in DBMS.

[0085] Furthermore, the step of detecting access control defects in the database management system based on the permission-aware test cases and the unauthorized object includes: executing the first execution tuple corresponding to the target operation command in the permission-aware test cases to obtain the test scenario corresponding to the target operation command; the target operation command is any operation command in the operation sequence; under the test scenario corresponding to the target operation command, executing the second execution tuple corresponding to the target operation command to obtain a first execution result; and detecting access control defects in the database management system based on the first execution result and the unauthorized object.

[0086] Here, the first execution tuple refers to the access control statement. After executing the first execution tuple, the test scenario under the given access conditions is obtained. Then, the second execution tuple is executed to obtain the first execution result. Based on the specific content of the first execution result and the unauthorized objects, access control defects in the database management system are detected.

[0087] It should be noted that different execution results correspond to different database management system access control flaws.

[0088] It should be noted that, based on the initial execution result and unauthorized objects, detecting database management system access control flaws essentially involves verifying the consistency of system tables. Database objects visible to the user in the system tables should be consistent with the objects that the user can access during SQL command processing. If any unauthorized object is detected being accessed, exposed, or successfully manipulated during SQL execution, it can be considered a system table consistency violation.

[0089] In this embodiment of the invention, based on permission-aware test cases and unauthorized objects, the consistency between the access behavior of unauthorized objects and permission-aware test cases is detected, thereby automatically identifying defects in permission escalation and unauthorized information leakage in the database access control mechanism.

[0090] Furthermore, the step of detecting database management system access control defects based on the first execution result and the unauthorized object includes: detecting the database management system access control defect as result set exposure when the first execution result is successful and the unauthorized object appears in the execution result; determining the database management system access control defect as error information exposure when the first execution result is an error and the unauthorized object appears in the execution result; and determining the database management system access control defect as successful access to the unauthorized object when the first execution result is successful and the unauthorized object appears in the target operation command.

[0091] In the first embodiment, an unauthorized object is returned in the successful result set. If an unauthorized object appears in the result set of an SQL command, it indicates that the database did not correctly perform access control checks before returning the query results, leading to the leakage of unauthorized information. This rule is mainly used to detect access control flaws in data query commands. For example, if a view is an unauthorized object for a regular user, and the user sees the view name in the result set after executing the corresponding query command, it indicates that the database system has leaked object information that the user should not have accessed.

[0092] In the second embodiment, an unauthorized object is returned in the error message when execution fails. If the SQL command fails, but the error message contains an unauthorized object name, it indicates that the database system leaked object information that should not have been exposed to ordinary users when constructing the error message. This rule can be used to detect information leakage problems in various commands such as data definition, data manipulation, and data query. For example, if an ordinary user has no access rights to a table and its related columns, but the error message contains an unauthorized column name after the execution of an insert statement fails, it indicates that the database exposed sensitive metadata in the error path. It should be noted that if an unauthorized object appears both in the user-submitted SQL command and in the corresponding error message, it is generally not considered a defect, because in this case, the error message only echoes the user's known input and does not leak any new object information.

[0093] In the third embodiment, if the first execution result is successful and an unauthorized object appears in the target operation command, it indicates that the SQL command successfully accessed the unauthorized object. If an ordinary user's SQL command successfully accesses an unauthorized object at runtime, it indicates that the database system allows the user to perform operations on the unauthorized object, constituting a privilege escalation problem. This type of problem may lead to more serious consequences, such as unauthorized modifications to other user objects. This rule applies to various command types, including data definition, data manipulation, and data query. For example, if a table is an unauthorized object for an ordinary user, but the ordinary user successfully returns a check or operation command targeting that table, it indicates a defect in the database's authorization check or execution processing phase. Meanwhile, for some data query commands, even if the statement involves an unauthorized object, as long as the final execution is successful but the return result is empty, it should not be directly judged as this type of defect, because in scenarios containing filtering conditions, an empty result does not necessarily mean that access control has been bypassed.

[0094] Figure 5A This is a schematic diagram of a system table consistency violation embodiment provided by the present invention, as shown below. Figure 5A As shown, "SHOWTABLE STATUS" is an SQL command. The database executed successfully, and view1 (unauthorized object) appeared in the result set. Therefore, the database management system access control flaw is that it returns an unauthorized object in the result set.

[0095] Figure 5B This is a schematic diagram of a second embodiment of a system table consistency violation provided by the present invention, as shown below. Figure 5B As shown, “INSERTINTO t1(c2) VALUES(13)” is an SQL command. The database execution failed because the field 'c1' has no default value and c1 is an unauthorized object. Therefore, the database management system access control defect is that it returns an unauthorized object in the error message.

[0096] Figure 5C This is a schematic diagram of the third embodiment of the system table consistency violation provided by the present invention, as shown below. Figure 5C As shown, the database execution was successful with "CHECKTABLE t1", and the query was successful; t1 is an unauthorized object. Therefore, the database management system access control flaw is the successful access to an unauthorized object.

[0097] In this embodiment of the invention, different database management system access control defects are detected by using different execution results and unauthorized objects of permission-aware test cases, thereby improving the coverage of access control defect detection.

[0098] Furthermore, the method also includes: if the first execution result is an error, executing the third execution tuple corresponding to the target operation command to obtain a second execution result; and based on the second execution result, continuing to execute subsequent operation commands in the permission-aware test case.

[0099] Here, the third execution tuple executes the operation command as an administrator. After the third execution tuple is executed, subsequent operations by ordinary users that depend on this database object can be executed smoothly.

[0100] Here, continuing to execute subsequent operation commands in the permission-aware test case means continuing to execute the permission control statement and operation statement corresponding to another operation command in the operation sequence to perform system table consistency verification and determine whether there are any database management system access control defects.

[0101] It should be noted that if the first execution result is incorrect, subsequent operations that depend on that object will also lose their execution basis. Therefore, it is necessary for the administrator to perform a follow-up execution to ensure that the entire test sequence remains effective.

[0102] In this embodiment of the invention, the administrator executes the access control statement; subsequently, a regular user executes the corresponding operation command, i.e., the SQL command, to test whether they can successfully access the relevant object under the current access conditions; if the regular user fails, the administrator executes the same command again to maintain the database state on which subsequent tests depend. This is because if a critical preliminary operation fails, subsequent operations that depend on that object will lose their execution basis; therefore, the administrator needs to perform supplementary execution to ensure the continued effectiveness of the entire test sequence.

[0103] Furthermore, the method also includes: determining the valid database object types in the target database; generating data definition statements, data operation statements, and data query statements based on the valid database object types and operation types; and determining the operation sequence based on the data definition statements, data operation statements, and data query statements.

[0104] Here, a valid database object refers to a legitimate object existing in the target database. Valid database objects can be obtained by maintaining an internal schema structure, which can be viewed as a hierarchical mapping structure. At the top level, it records object types and a set of existing object names, while at the nested levels, it records subordinate information. Based on this internal schema structure, when generating specific statements, the system does not randomly embed object names, but rather selects targets from existing legitimate objects (except for objects created by the CREATE statement), thus ensuring that operations such as deleting indexes and querying columns always apply to real, existing objects.

[0105] In this embodiment of the invention, by obtaining valid database objects, the semantic correctness and executability of these commands are ensured. Furthermore, through an operation sequence consisting of data definition statements, data manipulation statements, and data query statements, the permission check paths in the database are fully triggered to systematically test the access control logic of the database management system.

[0106] The following describes the database management system access control defect detection device provided by the present invention. The database management system access control defect detection device described below and the database management system access control defect detection method described above can be referred to in correspondence.

[0107] Figure 6 This is a schematic diagram of the structure of the database management system access control defect detection device provided by the present invention, as shown below. Figure 6 As shown, the database management system access control defect detection device 600 includes the following: The permission interpolation module 610 is used to perform permission interpolation processing on the operation sequence corresponding to the target database to obtain permission-aware test cases. The determination module 620 is used to determine the unauthorized object corresponding to the ordinary user based on the query results of the first system table corresponding to the administrator and the query results of the second system table corresponding to the ordinary user. The detection module 630 is used to detect access control defects in the database management system based on the permission-aware test cases and the unauthorized objects.

[0108] In this embodiment of the invention, the permission interpolation module 610 is specifically used to: determine the target permission corresponding to each operation command based on the database object corresponding to each operation command in the operation sequence; generate the permission control statement corresponding to each operation command based on the target permission corresponding to each operation command; and perform permission interpolation processing on the operation sequence based on each permission control statement and the executing user to obtain the permission-aware test cases.

[0109] In this embodiment of the invention, the permission interpolation module 610 is further specifically used for: determining the target permission level corresponding to each operation command based on the database object corresponding to each operation command in the operation sequence; determining the target database object corresponding to each operation command based on the target permission level; and determining the target permission corresponding to each operation command based on the target database object and the permission type set corresponding to each target database object.

[0110] In this embodiment of the invention, the permission interpolation module 610 is further specifically used for: assigning an administrator's execution user to each of the permission control statements to obtain a first execution tuple corresponding to each of the operation commands; assigning a regular user's execution user to each of the operation commands to obtain a second execution tuple corresponding to each of the operation commands; assigning an administrator's execution user to each of the operation commands to obtain a third execution tuple corresponding to each of the operation commands; and determining the permission-aware test cases based on each of the first execution tuple, each of the second execution tuple, and each of the third execution tuple.

[0111] In this embodiment of the invention, the determining module 620 is specifically used to: perform difference analysis on the first object tuple in the query result of the first system table and the second object tuple in the query result of the second system table to obtain at least one target object tuple that exists in the query result of the first system table and does not exist in the query result of the second system table; and determine the target object tuple as the unauthorized object.

[0112] In this embodiment of the invention, the database management system access control defect detection device further includes a first system table query result determination module, specifically configured to: construct a set of sample objects in an empty database; based on the sample objects, traverse each system table in the target database as an administrator to obtain a target system table set; traverse the system tables in the target system table set as an administrator to obtain at least one first database object, a first object type of each first database object, and a first dependent object of each first database object; construct a first object tuple corresponding to each first database object based on each first database object, each first object type, and each first dependent object; and determine the first system table query result based on each first object tuple.

[0113] In this embodiment of the invention, the database management system access control defect detection device further includes a second system table query result determination module, specifically used for: traversing the system tables in the target system table set as a regular user to obtain at least one second database object, a second object type of each second database object, and a second dependent object of each second database object; constructing a second object tuple corresponding to each second database object based on each second database object, each second object type, and each second dependent object; and determining the second system table query result based on each second object tuple.

[0114] In this embodiment of the invention, the detection module 630 is specifically used to: execute the first execution tuple corresponding to the target operation command in the permission-aware test case to obtain the test scenario corresponding to the target operation command; the target operation command is any operation command in the operation sequence; under the test scenario corresponding to the target operation command, execute the second execution tuple corresponding to the target operation command to obtain the first execution result; and detect access control defects in the database management system based on the first execution result and the unauthorized object.

[0115] In this embodiment of the invention, the detection module 630 is further specifically configured to: detect that the database management system access control defect is exposed as a result set when the first execution result is successful and the unauthorized object appears in the execution result; determine that the database management system access control defect is exposed as an error message when the first execution result is an error and the unauthorized object appears in the execution result; and determine that the database management system access control defect is successfully accessed as an unauthorized object when the first execution result is successful and the unauthorized object appears in the target operation command.

[0116] In this embodiment of the invention, the detection module 630 is further specifically used to: if the first execution result is an error, execute the third execution tuple corresponding to the target operation command to obtain a second execution result; and based on the second execution result, continue to execute subsequent operation commands in the permission-aware test case.

[0117] In this embodiment of the invention, the database management system access control defect detection device further includes an operation sequence determination module, specifically used for: determining the valid database object type in the target database; generating data definition statements, data operation statements, and data query statements based on the valid database object type and operation type; and determining the operation sequence based on the data definition statements, data operation statements, and data query statements.

[0118] Figure 7 This is a schematic diagram of the structure of the electronic device provided by the present invention, such as... Figure 7As shown, the electronic device may include a processor 710, a communications interface 720, a memory 730, and a communication bus 740, wherein the processor 710, communications interface 720, and memory 730 communicate with each other via the communication bus 740. The processor 710 can call logical instructions in the memory 730 to execute a method for detecting access control defects in a database management system. This method includes: performing permission interpolation processing on the operation sequence corresponding to the target database to obtain permission-aware test cases; determining unauthorized objects corresponding to the ordinary users based on the query results of the first system table corresponding to the administrator and the query results of the second system table corresponding to the ordinary users; and detecting access control defects in the database management system based on the permission-aware test cases and the unauthorized objects.

[0119] Furthermore, the logical instructions in the aforementioned memory 730 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, essentially, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0120] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the database management system access control defect detection method provided by the above methods. The method includes: performing permission interpolation processing on the operation sequence corresponding to the target database to obtain permission-aware test cases; determining the unauthorized object corresponding to the ordinary user based on the query results of the first system table corresponding to the administrator and the query results of the second system table corresponding to the ordinary user; and detecting the database management system access control defect based on the permission-aware test cases and the unauthorized object.

[0121] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements a method for detecting access control defects in a database management system provided by the methods described above. This method includes: performing permission interpolation processing on an operation sequence corresponding to a target database to obtain permission-aware test cases; determining unauthorized objects corresponding to the ordinary users based on query results of a first system table corresponding to the administrator and query results of a second system table corresponding to the ordinary users; and detecting access control defects in the database management system based on the permission-aware test cases and the unauthorized objects.

[0122] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0123] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0124] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for detecting access control defects in a database management system, characterized in that, include: Perform permission interpolation on the operation sequence corresponding to the target database to obtain permission-aware test cases; Based on the query results of the first system table corresponding to the administrator and the query results of the second system table corresponding to the ordinary user, the unauthorized object corresponding to the ordinary user is determined. Based on the permission-aware test cases and the unauthorized objects, access control defects in the database management system are detected.

2. The method for detecting access control defects in a database management system according to claim 1, characterized in that, The permission interpolation process performed on the operation sequence corresponding to the target database to obtain permission-aware test cases includes: Based on the database object corresponding to each operation command in the operation sequence, determine the target permission corresponding to each operation command; Based on the target permissions corresponding to each of the operation commands, generate permission control statements corresponding to each of the operation commands; Based on the aforementioned permission control statements and the executing user, permission interpolation processing is performed on the operation sequence to obtain the permission-aware test cases.

3. The method for detecting access control defects in a database management system according to claim 2, characterized in that, The step of determining the target permission corresponding to each operation command based on the database object corresponding to each operation command in the operation sequence includes: Based on the database object corresponding to each operation command in the operation sequence, determine the target permission level corresponding to each operation command; Based on the target permission levels, determine the target database object corresponding to each operation command; Based on each target database object and the set of permission types corresponding to each target database object, the target permission corresponding to each operation command is determined.

4. The method for detecting access control defects in a database management system according to claim 2, characterized in that, The step of performing permission interpolation on the operation sequence based on each of the permission control statements and the executing user to obtain the permission-aware test cases includes: Assign an administrator user to execute each of the aforementioned permission control statements to obtain the first execution tuple corresponding to each of the aforementioned operation commands; Each of the operation commands is assigned an execution user from a regular user, resulting in a second execution tuple corresponding to each operation command. Assign an administrator execution user to each of the operation commands to obtain the third execution tuple corresponding to each of the operation commands; The permission-aware test cases are determined based on each of the first execution tuple, each of the second execution tuple, and each of the third execution tuple.

5. The method for detecting access control defects in a database management system according to claim 1, characterized in that, The process of determining the unauthorized object corresponding to the ordinary user based on the query results of the first system table corresponding to the administrator and the query results of the second system table corresponding to the ordinary user includes: Perform a difference analysis on the first object tuple in the query result of the first system table and the second object tuple in the query result of the second system table to obtain at least one target object tuple that exists in the query result of the first system table but does not exist in the query result of the second system table. The target object tuple is identified as the unauthorized object.

6. The method for detecting access control defects in a database management system according to claim 5, characterized in that, The method further includes: Construct a set of sample objects in an empty database; Based on the sample object, the system tables in the target database are traversed as an administrator to obtain the target system table set; As an administrator, traverse the system tables in the target system table set to obtain at least one first database object, a first object type for each first database object, and a first dependent object for each first database object; based on each first database object, each first object type, and each first dependent object, construct a first object tuple corresponding to each first database object; based on each first object tuple, determine the query result of the first system table. Traverse the system tables in the target system table set as a regular user to obtain at least one second database object, a second object type for each second database object, and a second dependent object for each second database object; construct a second object tuple corresponding to each second database object based on each second database object, each second object type, and each second dependent object; determine the query result of the second system table based on each second object tuple.

7. The method for detecting access control defects in a database management system according to claim 1, characterized in that, The method of detecting access control defects in the database management system based on the permission-aware test cases and the unauthorized objects includes: Execute the first execution tuple corresponding to the target operation command in the permission-aware test case to obtain the test scenario corresponding to the target operation command; the target operation command is any operation command in the operation sequence. In the test scenario corresponding to the target operation command, the second execution tuple corresponding to the target operation command is executed to obtain the first execution result; Based on the first execution result and the unauthorized object, a database management system access control defect is detected.

8. The method for detecting access control defects in a database management system according to claim 7, characterized in that, The step of detecting database management system access control defects based on the first execution result and the unauthorized object includes: If the first execution result is successful and the unauthorized object appears in the execution result, the database management system access control defect is detected as an exposure of the result set; If the first execution result is an error and the unauthorized object appears in the execution result, it is determined that the database management system access control defect is an error message exposure; If the first execution result is successful and the unauthorized object appears in the target operation command, the database management system access control defect is determined to be a successful access to the unauthorized object.

9. The method for detecting access control defects in a database management system according to claim 8, characterized in that, The method further includes: If the first execution result is an error, the third execution tuple corresponding to the target operation command is executed to obtain the second execution result; Based on the second execution result, the subsequent operation commands in the permission-aware test case are executed.

10. The method for detecting access control defects in a database management system according to claim 1, characterized in that, The method further includes: Determine the valid database object types in the target database; Based on the valid database object type and operation type, generate data definition statements, data operation statements and data query statements respectively; The operation sequence is determined based on the data definition statement, data operation statement, and data query statement.

Images