Database Protection System Dynamic SQL Injection Mitigation

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing database protection systems (DPS) face challenges in detecting and mitigating SQL injection attacks, particularly when query parsers miss embedded commands or fail to recognize new syntax trees, leading to undetected injection attacks and scalability issues.

Innovation Solution

The DPS is enhanced to intercept and parse SQL queries, converting them into prepared statements by extracting syntax trees, applying hash functions to recognize and store known queries, and generating new prepared statements for unknown queries, ensuring only prepared statements are forwarded to the database server, thereby preventing injection attacks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If deep analysis is performed on every SQL query to detect injection attacks, then detection accuracy is improved, but system scalability deteriorates

Engineering Contradiction:

Improveinjection attack detection accuracyVSAvoidsystem scalability

Core Design Contradiction:

Measurement precisionVSProductivity

Solution Approach 1:

The system performs preliminary actions by pre-compiling regular expressions for common injection patterns and pre-validating query structures against these patterns before execution. This preparation work is done in advance, allowing rapid detection during actual query processing without performing heavy analysis on every query, thus maintaining both detection accuracy and scalability

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system applies partial analysis by focusing only on critical portions of SQL queries that are most susceptible to injection attacks, such as user input parameters and dynamic query constructs. Rather than analyzing every aspect of each query in depth, the system selectively applies validation rules to high-risk areas, achieving effective detection while reducing overall processing overhead

Inventive Principle:

Principle #16Partial or excessive action

2Reliability

If query parser vulnerability checks are performed on every SQL query, then security is improved, but processing speed deteriorates

Engineering Contradiction:

Improvesecurity against injection attacksVSAvoidquery processing speed

Core Design Contradiction:

ReliabilityVSSpeed

Solution Approach 1:

The system pre-identifies and caches vulnerability patterns from known parser weaknesses before query processing. During actual query execution, it performs rapid pattern matching against these pre-compiled vulnerability signatures rather than conducting comprehensive vulnerability analysis, thus maintaining security while improving processing speed

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system introduces an intermediary validation layer that sits between query parsing and execution. This intermediary performs lightweight structural validation and pattern matching checks that are less computationally intensive than full vulnerability analysis, allowing security checks to proceed at higher speed while maintaining protection against injection attacks

Inventive Principle:

Principle #24Intermediary (Mediator)

3Measurement precision

If comprehensive SQL query validation is performed, then detection accuracy is improved, but computational overhead increases

Engineering Contradiction:

Improvequery anomaly detection accuracyVSAvoidcomputational overhead

Core Design Contradiction:

Measurement precisionVSUse of energy by moving object

Solution Approach 1:

The validation system is segmented into multiple independent validation modules, each responsible for specific aspects of query validation such as syntax checking, pattern matching, and semantic analysis. This segmentation allows the system to apply only the necessary validation steps for each query type, reducing overall computational overhead while maintaining comprehensive detection accuracy through coordinated module operation

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The system applies different validation intensities to different portions of SQL queries based on their risk characteristics. High-risk sections such as user input parameters and dynamic query constructs receive rigorous validation, while low-risk sections use lighter validation approaches. This localized quality approach ensures detection accuracy where needed while minimizing computational overhead in safer areas

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS11562095B2Reinforcing SQL transactions dynamically to prevent injection attacks

Publication Date: 2023.01.24 INTERNATIONAL BUSINESS MACHINE CORPORATION

AI summary

A database protection system (DPS) mitigates injection attacks. DPS receives an unrestricted database query, extract a syntax tree, and evaluates whether it recognizes the query. To this end, DPS applies a hash function over the extracted syntax tree, and then determines whether the resulting hash has been seen by DPS before. If so, DPS retrieves a previously-generated prepared statement associated with the syntax tree, and that prepared statement is then forward to the database server in lieu of sending the original query. If the syntax tree is not recognized, DPS creates a new prepared statement, generates a hash of the syntax tree, and stores the hash and the new prepared statement, and forwards the new prepared statement. The prepared statements are configured based on the native wire protocol used by the database server, and DPS includes additional functionality by which it can learn the semantics of this protocol if necessary.