SQL Injection Prevention Module Scanning Policies
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current software applications lack reliable solutions to prevent SQL injection vulnerabilities, which allow hackers to inject harmful SQL statements into databases, leading to unauthorized data retrieval and modification, with existing programming practices failing to cover all emerging SQL injection issues.
Innovation Solution
An SQL injection prevention module scans and compares all SQL statements formed by the application against anti-SQL injection policies, determining the severity of violations and taking appropriate actions such as dropping critical violations or encrypting non-critical data, ensuring that only authorized users can access or read confidential information.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional programming practices are used to prevent SQL injection, then basic security is maintained, but emerging SQL injection issues cannot be addressed and developers must re-program entire applications
Solution Approach 1:
The patent divides SQL injection prevention into a separate, dedicated module that operates independently from the main application code. This module scans and filters SQL statements before they reach the database, segmenting the security function from the business logic and allowing updates without re-programming the entire application.
Solution Approach 2:
The patent introduces an intermediary SQL statement scanning and filtering module between the application code and the database. This intermediary layer intercepts SQL statements, checks them against security policies, and only allows approved statements to reach the database, preventing SQL injection without modifying the original application code.
2Reliability
If all SQL statements are scanned and compared against security policies, then SQL injection prevention is improved, but processing time increases
Solution Approach 1:
The patent performs preliminary scanning and filtering of SQL statements before they are executed against the database. By pre-checking statements against security policies and blocking malicious ones in advance, the system prevents harmful operations without significantly impacting legitimate query processing performance.
Solution Approach 2:
The patent converts potentially harmful SQL statements into beneficial security checks by scanning all statements against security policies. The scanning process itself becomes a security feature, allowing the system to identify and block malicious patterns while maintaining normal database operations for approved statements.
3Object-affected harmful factors
If critical SQL injection violations are blocked immediately, then data security is improved, but legitimate operations may be interrupted
Solution Approach 1:
The patent applies different handling qualities to different types of SQL violations. Critical violations that pose immediate security threats are blocked with high severity responses, while non-critical violations may be logged or monitored with lower severity responses, allowing legitimate operations to continue uninterrupted.
Solution Approach 2:
The patent implements dynamic response based on violation severity levels. The system adjusts its blocking behavior according to the severity assessment, allowing flexible control over which violations are immediately blocked and which are monitored, thereby balancing security with operational continuity.
Data Source
AI summary
Hackers and other malicious users are prevented from injecting harmful SQL into a database and from retrieving confidential data. SQL statements formed by an application in response to user input (e.g., user Id and password), are scanned and compared to patterns of SQL commands and data embodied in one or more anti-SQL injection policies. If there is a match, the SQL statement is in violation of the policy. A severity level of the violation may be checked, for example, it may be determined whether the violation is critical or non-critical (normal). Different actions are taken depending on the severity of the violation. If the violation is critical, the SQL statement is dropped and the administrator is notified immediately and a trace of the violation is provided. If the violation is not critical, the data is retrieved and is compared against data in a confidential data registry. If any of the data is found to be confidential, that data is encrypted and then sent to the hacker. The hacker is not able to use or read the encrypted confidential data.