Hiding the Source Code of Stored Database Programs

Abstract

The objective of the article is to reveal an approach to hiding the code of stored programs stored in the database. The essence of this approach is the complex use of the method of random permutation of code symbols related to a specific stored program, located in several rows of some attribute of the database system table, as well as the substitution method. Moreover, with the possible substitute of each character obtained after the permutation with another one randomly selected from the Unicode standard, a legitimate user with the appropriate privileges gets access to the source code of the stored program due to the ability to quickly perform the inverse to masking transformation and overwrite the program code into the database. All other users and attackers without knowledge of certain information can only read the codes of stored programs masked with format preserving. The proposed solution is more efficient than the existing methods of hiding the code of stored programs provided by the developers of some modern database management systems (DBMS), since an attacker will need much greater computational and time consumption to disclose the source code of stored programs.

Technique for Searching Data in a Cryptographically Protected SQL Database

“…To encrypt/decrypt data of fields of various types of a tuple row of a certain table R of a database, a scheme is used based on the use of keys K R 1 , K j 2 , K γ 3 similar to that described in [36,37], where K R 1 is a unique 128-bit random value (secret key) generated by a cryptographically strong pseudo-random number generator (PRNG) for each table R, constant for all values that will be encrypted in this table; K j 2 is a unique 128-bit random value (secret key) generated by a cryptographically strong PRNG for each attribute j of table R; and K γ 3 is the value of the integer identifier of the primary key of the γ-th row of the table R. Secret (symmetric) keys K R 1 , K j 2 are encrypted by one of the cryptographically strong algorithms and stored in the special database table R sec . The values of these keys are never shown.…”

Intelligent Classification Method of Low Occupancy Big Data Based on Grid Index

“…Effective analysis of this low occupancy big data can obtain implicit data and knowledge, resulting in data value added and providing and attaching a variety of services [3,4], which shows that low occupancy big data is very key. ese low occupancy big data are stored in the form of message file or database and rise exponentially [5], so high-quality storage methods are required. Intelligent classification technology is a very important big data management technology.…”

Technique for Evaluating the Security of Relational Databases Based on the Enhanced Clements–Hoffman Model

“…In the DB with UBR, which can be used as an ordinary DB, a data warehouse of various subject domains (SDs) or a configuration DB of the dataspace management environment [73][74][75], various security measures are implemented [76][77][78][79][80]. These measures are based on the provisions of the theory of relational databases [8,30,81], formal access control models [82,83] and ensuring data integrity [84], the potential of the modern blockchain model [85,86], row-level security (RLS) technology [87], SQL capabilities [45].…”

“…; -w 2 -tools provided by the DBMS and special developed means in the DB schema with UBR (means that ensure the maintenance of a special log-table of the modified data, the formation of data for a special table of users and some others [76]), allowing to identify and eliminate incorrectly assigned privileges; -w 3 -tools provided by the DBMS and special developed means in the DB schema with UBR (means providing the formation of data from a special table of the access privilege distribution to the data of other users and some others [76]), allowing to identify and eliminate incorrectly assigned privileges; -w 4 -tools provided by the DBMS and special developed means in the DB schema with UBR (means providing the data formation from a special table of restrictions on access rights to a specific data element and some others [76]), allowing to identify and eliminate incorrectly assigned privileges; -w 5 -means that allow to identify and eliminate excessive privileges; detect vulnerabilities, missing patches from vendors; inactive accounts, modify default passwords; properly configure the event auditing system, including tracking unusual user access activity, etc. Timely installation of patches or the use of virtual patches to protect the database; -w 6 -means that allow detecting unusual user access activity and complicating the leakage of confidential data from database tables (including the use of means for masking data provided by the DBMS and proposed in [79]; the usage of means of restricting access rights to a specific data element [76] implemented in the DB with UBR); -w 7 -means to detect unusual user access activity and complicate code disclosure of confidential persistent modules (including the use of means for masking data provided by the DBMS and proposed in [77]); -w 8 -means that allow to identify and eliminate incorrectly assigned privileges, detect vulnerabilities, inappropriate session duration, improper implementation of the algorithm, authentication protocol, settings. Timely installation of critical updates or the use of virtual patches to protect the database from attempts to exploit vulnerabilities until a full-fledged and permanent patch is deployed; -w 9 -means that allow controlling resource consumption (for example, through the profile mechanism-a named set of resource restrictions that can be used by the user); -w 10 -means that allow controlling the integrity of the trigger code and persistent stored modules, including those based on the potential of the modern blockchain model proposed in [78] and implemented in a DB with UBR; -w 11 -using parameterized queries, stored procedures, least privileges; escaping user input; converting data types to the type that was assumed by the logic of the program, checking the data entered by the user for compliance with the allowed character sequences; -w 12 -maintenance of the list of "prohibited" functions, procedures, the usage of which should be avoided; -w 13 − -anti-virus software; -w 14 -means providing support for data integrity (both built into the DBMS and specially developed in the DB schema with UBR [76,80]), as well as implementing security models based on discretionary and role-based policies; -w 15 -means that implement security models based on: discretionary, mandatory, role-based, attribute policy, including those specific to a database with UBR…”

“…Timely installation of patches or the use of virtual patches to protect the database; -w 6 -means that allow detecting unusual user access activity and complicating the leakage of confidential data from database tables (including the use of means for masking data provided by the DBMS and proposed in [79]; the usage of means of restricting access rights to a specific data element [76] implemented in the DB with UBR); -w 7 -means to detect unusual user access activity and complicate code disclosure of confidential persistent modules (including the use of means for masking data provided by the DBMS and proposed in [77]); -w 8 -means that allow to identify and eliminate incorrectly assigned privileges, detect vulnerabilities, inappropriate session duration, improper implementation of the algorithm, authentication protocol, settings. Timely installation of critical updates or the use of virtual patches to protect the database from attempts to exploit vulnerabilities until a full-fledged and permanent patch is deployed; -w 9 -means that allow controlling resource consumption (for example, through the profile mechanism-a named set of resource restrictions that can be used by the user); -w 10 -means that allow controlling the integrity of the trigger code and persistent stored modules, including those based on the potential of the modern blockchain model proposed in [78] and implemented in a DB with UBR; -w 11 -using parameterized queries, stored procedures, least privileges; escaping user input; converting data types to the type that was assumed by the logic of the program, checking the data entered by the user for compliance with the allowed character sequences; -w 12 -maintenance of the list of "prohibited" functions, procedures, the usage of which should be avoided; -w 13 − -anti-virus software; -w 14 -means providing support for data integrity (both built into the DBMS and specially developed in the DB schema with UBR [76,80]), as well as implementing security models based on discretionary and role-based policies; -w 15 -means that implement security models based on: discretionary, mandatory, role-based, attribute policy, including those specific to a database with UBR [76]; -w 16 -special documented diagnostic functions capable of identifying the causes of defects caused by the incorrect formation of primary keys, entering incorrect data, inadmissible entry, deletion, modification of data, unauthorized access to data, unauthorized changes to the database schema with UBR and its objects (including using the capabilities of blockchain technology [78]); special triggers that can be used to intercept and log operations performed in the database; DBMS audit tools; -w 17 -audit means built into the DBMS, including specially developed means in the DB schema with UBR (means that ensure the maintenance of a special log-table of the modified data); -w 18 -masking data of tables based on the approach described in [79]; -w 19 -masking of stored objects using the means provided by the DBMS, as well as based on the approach described in [77]; -w 20 -using transparent data encryption (TDE) and cryptographically strong primitives built into the DBMS as well as national encryption standards (for example, the symmetric block cipher "Kalyna" from the national standard of DSTU 7624: 2014); -w 21 -timely installati...…”