Information Flow Graph Query Vulnerability Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Applications using query languages, such as SQL, remain vulnerable to query language injection attacks due to the complexity of software, which can lead to data integrity compromise and denial of service, despite existing defenses.
Innovation Solution
A method and system for detecting security vulnerabilities by comparing the information flow of a target query to a permitted query, using information flow graphs to determine if the target query releases more information than the permitted query, thereby identifying potential malicious queries.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If query language injection defenses are implemented, then security against malicious queries is improved, but application complexity increases and vulnerabilities may still remain due to software complexity
Solution Approach 1:
The patent segments the query analysis process into distinct components: extracting query parameters (disclosed columns, accessed columns, predicate), constructing information flow graphs, and comparing against permitted queries. This segmentation allows complex security validation to be broken down into manageable steps that can be systematically applied without overwhelming complexity.
Solution Approach 2:
The patent introduces an intermediary mechanism - the information flow graph - that mediates between the query execution engine and the security validation logic. By representing query behavior as graphs that can be systematically compared, the intermediary simplifies the validation process and makes it more manageable despite the underlying complexity of query processing.
2Reliability
If runtime query validation is performed to prevent injection attacks, then data security is improved, but execution time increases
Solution Approach 1:
The patent applies preliminary action by pre-defining permitted information flows and their corresponding graphs before query execution occurs. By establishing the baseline of acceptable query behavior in advance, the validation process during query execution becomes a simpler comparison operation rather than a complex analysis, reducing runtime overhead while maintaining security.
Solution Approach 2:
The patent creates a copy of the permitted query's information flow graph and compares it against the target query's graph. This copying approach allows for efficient comparison without re-analyzing the entire permitted query structure from scratch, reducing the computational cost of validation and thereby minimizing time loss while maintaining data security.
3Measurement precision
If information flow comparison is performed to detect vulnerabilities, then detection accuracy is improved, but processing complexity increases
Solution Approach 1:
The patent extracts the essential characteristics of query information flow into distinct components: disclosed columns, accessed columns, and predicate conditions. By taking out these key elements and representing them as separate graph elements, the complex task of comparing query behaviors is simplified into a systematic comparison of extracted components, improving detection accuracy without proportionally increasing processing complexity.
Data Source
AI summary
A method for detecting a security vulnerability in code may include obtaining (i) a permitted information flow graph for a permitted query and (ii) a target information flow graph for a target query in the code, determining, by traversing the permitted information flow graph, a permitted information flow including permitted disclosed columns, permitted accessed columns, and a permitted predicate, determining, by traversing the target information flow graph, a target information flow including target disclosed columns, target accessed columns, and a target predicate, comparing the permitted information flow and the target information flow to obtain a comparison result, and determining, based on the comparison result, that the target query includes the security vulnerability.