Reinforcing SQL transactions dynamically to prevent injection attacks
A database protection system (DPS) mitigates injection attacks. DPS receives an unrestricted database query, extract a syntax tree, and evaluates whether it recognizes the query. To this end, DPS applies a hash function over the extracted syntax tree, and then determines whether the resulting hash has been seen by DPS before. If so, DPS retrieves a previously-generated prepared statement associated with the syntax tree, and that prepared statement is then forward to the database server in lieu of sending the original query. If the syntax tree is not recognized, DPS creates a new prepared statement, generates a hash of the syntax tree, and stores the hash and the new prepared statement, and forwards the new prepared statement. The prepared statements are configured based on the native wire protocol used by the database server, and DPS includes additional functionality by which it can learn the semantics of this protocol if necessary.
1. A method operative in a database protection system wherein database requests directed from a client to a database server are monitored to identify suspicious behavior, comprising:
receiving an unrestricted database query;
applying a hash function over a syntax tree extracted from the unrestricted database query to generate a hash;
determining, based on the hash, whether the syntax tree is recognized as being associated with a prior database query;
upon determining that the syntax tree is recognized as being associated with a prior database query, retrieving a prepared statement associated with the syntax tree;
upon determining that the syntax tree is not recognized as being associated with the prior database query, creating a new prepared statement; and
in lieu of forwarding the unrestricted database query, forwarding to the database server one of: the prepared statement, and the new prepared statement.
2. The method as described in claim 1 wherein the prepared statement or the new prepared statement is implemented in a wire protocol associated with the database server.
3. The method as described in claim 2 further including discovering one or more characteristics of the wire protocol prior to forwarding the prepared statement or the new prepared statement.
4. The method as described in claim 3 wherein the one or more characteristics are discovered by opening a connection from the database protection system, providing an output on the connection, and analyzing a wire packet associated with that output.
5. The method as described in claim 4 wherein the output is provided to one of: a dummy service, and the database server.
6. The method as described in claim 1 wherein the hash function is a cryptographic hash.
7. The method as described in claim 1 where creating a new prepared statement includes generating a hash of the syntax tree not recognized as being associated with the prior database query, and storing the hash and the new prepared statement.
8. Apparatus for use in a database protection system wherein database requests directed from a client to a database server are monitored to identify suspicious behavior, comprising:
a processor;
computer memory holding computer program instructions executed by the processor, the computer program instructions comprising program code configured to:
receive an unrestricted database query;
apply a hash function over a syntax tree extracted from the unrestricted database query to generate a hash;
determine, based on the hash, whether the syntax tree is recognized as being associated with a prior database query;
upon determining that the syntax tree is recognized as being associated with a prior database query, retrieve a prepared statement associated with the syntax tree;
upon determining that the syntax tree is not recognized as being associated with the prior database query, create a new prepared statement; and
in lieu of forwarding the unrestricted database query, forward to the database server one of: the prepared statement, and the new prepared statement.
9. The apparatus as described in claim 8 wherein the prepared statement or the new prepared statement is implemented in a wire protocol associated with the database server.
10. The apparatus as described in claim 9 wherein the program code is further configured to discover one or more characteristics of the wire protocol prior to forwarding the prepared statement or the new prepared statement.
11. The apparatus as described in claim 10 wherein the one or more characteristics are discovered by opening a connection from the database protection system, providing an output on the connection, and analyzing a wire packet associated with that output.
12. The apparatus as described in claim 11 wherein the output is provided to one of: a dummy service, and the database server.
13. The apparatus as described in claim 8 wherein the hash function is a cryptographic hash.
14. The apparatus as described in claim 8 wherein the program code configured to create a new prepared statement includes program code configured to generate a hash of the syntax tree not recognized as being associated with the prior database query, and store the hash and the new prepared statement.
15. A computer program product in a non-transitory computer readable medium, the computer program product holding computer program instructions executed by a processor in association with a database protection system wherein database requests directed by a client to a database server are monitored to identify suspicious behavior, the computer program instructions comprising program code configured to:
receive an unrestricted database query;
apply a hash function over a syntax tree extracted from the unrestricted database query to generate a hash;
determine, based on the hash, whether the syntax tree is recognized as being associated with a prior database query;
upon determining that the syntax tree is recognized as being associated with a prior database query, retrieve a prepared statement associated with the syntax tree;
upon determining that the syntax tree is not recognized as being associated with the prior database query, create a new prepared statement; and
in lieu of forwarding the unrestricted database query, forward to the database server one of: the prepared statement, and the new prepared statement.
16. The computer program product as described in claim 15 wherein the prepared statement or the new prepared statement is implemented in a wire protocol associated with the database server.
17. The computer program product as described in claim 16 wherein the program code is further configured to discover one or more characteristics of the wire protocol prior to forwarding the prepared statement or the new prepared statement.
18. The computer program product as described in claim 17 wherein the one or more characteristics are discovered by opening a connection from the database protection system, providing an output on the connection, and analyzing a wire packet associated with that output.
19. The computer program product as described in claim 18 wherein the output is provided to one of: a dummy service, and the database server.
20. The computer program product as described in claim 15 wherein the hash function is a cryptographic hash.
21. The computer program product as described in claim 15 wherein the program code configured to create a new prepared statement includes program code configured to generate a hash of the syntax tree not recognized as being associated with the prior database query, and store the hash and the new prepared statement.