Query Processor Timing Attack Mitigation via Branch Delay Equalization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Query processing systems are vulnerable to unauthorized data exploration through conditional operators and parameterized queries, where users can exploit processing delays to reveal sensitive information about the data set, such as record counts and schema, despite security restrictions.
Innovation Solution
A query processor identifies and reduces the processing delay between conditional branches in queries, applying a query adaptation to ensure both branches complete in approximately the same time, thereby preventing unintended disclosure of data set properties.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a query uses conditional operators with variable execution time branches, then the query can reveal data set properties through timing analysis, but the security policy restricting access to certain data properties is compromised
Solution Approach 1:
The system applies preliminary anti-action by detecting conditional operators in the query plan and proactively adding padding delays to equalize branch execution times before the query executes. This prevents timing analysis from revealing data properties, thereby maintaining security policy enforcement while allowing the query to function normally.
2Reliability
If the query processor executes all conditional branches to equalize timing, then security is maintained, but query processing time increases
Solution Approach 1:
The system applies partial action by selectively adding padding delays only to specific branches that would otherwise execute faster, rather than forcing all branches to execute fully. This equalizes timing sufficiently to prevent timing attacks while minimizing the additional processing time required, thus balancing security enforcement with query performance.
3Loss of information
If the query processor adds padding delays to equalize branch timing, then timing-based information leakage is prevented, but query execution time increases
Solution Approach 1:
The system applies parameter changes by dynamically adjusting the execution time parameter of conditional branches through padding delays. The padding duration is calculated based on the difference between the fastest and slowest branch execution times, ensuring that all branches complete within a uniform time window. This prevents information leakage while keeping the time penalty minimal and predictable.
Data Source
AI summary
Query processors often receive queries to be processed against a data set, such as by inserting user input into parameterized fields of a query template. Some queries may include a conditional statement, and manipulation of user input (e.g., injection attacks) may introduce a delay through a conditional branch. The time required to fulfill the query may indicate which conditional branch was taken, thus revealing properties of the data set that are intended to be withheld. Instead, a query processor may examine the query to identify, between a pair of conditional branches, a processing delay of the first conditional branch as compared with the second conditional branch. The query processor may identify a query adaptation that reduces the processing delay of the first conditional branch as compared with the second conditional branch, and evaluate the query against the data set according to the query adaptation to present a query result.