Raju Halder

Obfuscation-based analysis of SQL injection attacks

In this paper, we propose an obfuscation/ deobfuscation based technique to detect the presence of possible SQL Injection Attacks (SQLIA) in a query before submitting it to a DBMS. This technique combines static and dynamic analysis. In the static phase, the queries in the application are replaced by queries in obfuscated form. The main idea behind obfuscation is to isolate all the atomic formulas from other control elements of the query. During the dynamic phase, the user inputs are merged into the obfuscated atomic formulas, and the dynamic verifier analysis the presence of possible SQLIA at atomic formula level. Finally, a deobfuscation step is performed to recover the original query before submitting it to the DBMS.

Abstract interpretation of database query languages

In this paper, we extend the Abstract Interpretation framework to the field of query languages for relational databases as a way to support sound approximation techniques. This way, the semantics of query languages can be tuned according to suitable abstractions of the concrete domain of data. The abstraction of relational database system has many interesting applications, in particular, for security purposes, such as fine grained access control, watermarking, etc.

Cooperative query answering by abstract interpretation

A common problem for many database users is how to formulate and submit correct queries in order to get useful responses from the system, with little or no knowledge of the database structure and its content. The notion of cooperative query answering has been explored as an effective mechanism to address this problem. In this paper, we propose a cooperative query answering scheme based on the Abstract Interpretation framework. In this context, we address three key issues: soundness, relevancy and optimality of the cooperative answers.

A persistent public watermarking of relational databases

In this paper, we propose a novel fragile and robust persistent watermarking scheme for relational databases that embeds both private and public watermarks where the former allows the owner to prove his ownership, while the latter allows any end-user to verify the correctness and originality of the data in the database without loss of strength and security. The public watermarking is based on a part of the database state which remains invariant under processing of the queries associated with the database, whereas the private watermarking is based on an appropriate form of the original database state, called abstract database, and the semantics-based properties of the data which remain invariant under processing of the associated queries.

Abstract program slicing of database query languages

In this paper, the notions of semantic relevancy of statements, semantic data dependences and conditional dependences are extended to the case of programs embedding SQL statements in both concrete and abstract domains. This allows us to refine traditional syntax-based Database-Oriented Program Dependence Graphs, yielding to a more accurate semantics-based abstract program slicing algorithm.

Abstract program slicing on dependence condition graphs

Context: Mastroeni and Zanardini introduced the notion of semantics-based data dependences, both at concrete and abstract domains, that helps in converting the traditional syntactic Program Dependence Graphs (PDGs) into more refined semantics-based (abstract) PDGs by disregarding some false dependences from them. As a result, the slicing techniques based on these semantics-based (abstract) PDGs result in more precise slices. Aim: The aim of this paper is to further refine the slicing algorithms when focusing on a given property. Method: The improvement is obtained by (i) applying the notions of semantic relevancy of statements and semantic data dependences, and (ii) combining them with conditional dependences. Result: We provide an abstract slicing algorithm based on semantics-based abstract Dependence Condition Graphs (DCGs) that enable us to identify the conditions for dependences between program points.

Abstract Interpretation of Recursive Queries

In this paper, we extend recent works on concrete and abstract semantics of structured query languages by considering recursive queries too. We show that combining abstraction of data and widening operators that guarantee the convergence of the computation may be useful not only for static analysis purposes, but also as a sound and effective tool for query language transformations.

Persistent Watermarking of Relational Databases

Digital watermarking for relational databases emerged as a candidate solution to provide copyright protection of relational data, maintaining integrity of the database information, tamper detection, traitor tracing etc. In this paper, we introduce the notion of persistent wa- termarking that serves as a way to recognize the integrity and ownership proof of the database bounded with a set of queries. It allows the evaluation of the database while applying the queries. We preserve the persistency of the watermark by exploiting two invariants of the database state w.r.t. the set of queries: Stable Cells and Semantics- based Properties of the data. We discuss how we can improve the existing techniques in terms of the persistency of the watermark. Moreover, we propose a novel persistent watermarking scheme that strictly improves the algorithm proposed by Li and Deng. Keywords-Watermarking, Databases, Security

An internet-based IP protection scheme for circuit designs using linear feedback shift register (LFSR)-based locking

IP reuse is rapidly proliferating recent automated circuit design. It is facing serious challenges like forgery, theft and misappropriation of intellectual property (IP) of the design. Thus, protection of design IP is a matter of prime concern. In this paper, we propose a novel Internet-based scheme to tackle this problem. Input to the proposed scheme is a graph corresponding to a digital system design. Watermarking of the graph and its encryption are achieved using a new linear feedback shift register(LFSR)-based locking scheme. The proposed scheme makes unauthorized disclosure of valuable design almost infeasible, and can easily detect any alteration of the design file during transmission. It ensures authentication of the original designer as well as non-repudiation between the seller and the buyer. Empirical evidences on several benchmark problem sets are encouraging.

Dependence condition graph for semantics-based abstract program slicing

Many slicing techniques have been proposed based on the traditional Program Dependence Graph (PDG) representation. In traditional PDGs, the notion of data dependency between statements is based on syntactic presence of a variable in the definition of another variable or in a conditional expression. Mastroeni and Zanardini introduced semantics-based data dependency both at concrete and abstract domain. This semantics-based data dependency is computed at expression level over all possible (abstract) states appearing at program points. In this paper, we strictly improve this approach by (i) considering semantic relevancy of statements (not only expressions), and (ii) adopting conditional dependency. This allows us to transform the semantics-based (abstract) PDG into a semantics-based (abstract) Dependence Condition Graph (DCG) that enables to identify the conditions for dependence between program points. The resulting program slicing algorithm designed this way is strictly more accurate than the Mastroeni and Zanardinis one.