CN102622548A - Detection method for database covert channel - Google Patents

Abstract

The invention discloses a database covert channel detection method, the steps of which are as follows: firstly establish a database covert channel scene, including the database operation corresponding to the high security level subject sending signal 0 and sending signal 1 and the low security level subject receiving signal 0 and receiving signal 1 corresponding to the database operation. Next, configure the database covert channel detection. Then according to the database covert channel scenario, the high-security-level subject sends signal 0, and the low-security-level subject receives signal 0; the high-security-level subject sends signal 1, and the low-security-level subject receives signal 1. If the subject with high security level can successfully send signal 0 and signal 1, and the subject with low security level can successfully receive signal 0 and signal 1, then there is a database covert channel that can be implemented in this scenario, otherwise there is no database covert channel that can be implemented in this scenario . The invention has low implementation cost and can detect the hidden channel of the database caused by the system defect.

Description

A Database Covert Channel Detection Method

technical field

The invention relates to the analysis technology of the covert channel, in particular to the identification and detection method of the covert channel of the database.

Background technique

For systems with high confidentiality requirements (such as financial systems or military systems), the confidentiality of data is usually multi-level (such as top secret, secret, secret, public). A multi-level secure database management system that implements mandatory access controls fulfills this need. In this system, each subject and data object is assigned a different security level, and it is stipulated that a subject with a low security level cannot access the data of a subject with a high security level. However, subjects with high security level and subjects with low security level can agree on a coding method, and use covert channels to transmit information illegally, thereby threatening the confidentiality of the system. Security assessment standards both at home and abroad require high-level security database products to analyze covert channels. For example, the "Information Security Technology Database Management System Security Evaluation Criteria" (GB/T 20009-2005) clearly stipulates that database products of level 4 and above must conduct covert channel analysis.

Covert channel identification is the core technology of covert channel analysis and the premise of channel measurement and processing. The covert channel identification method identifies potential covert channels as thoroughly as possible by analyzing the source code of the system or formalizing the top-level specification. On this basis, it constructs a reasonable usage scenario for it and confirms whether it is really used. At present, the existing identification methods include syntax information flow analysis method, semantic information flow analysis method, shared resource matrix method, non-interference analysis method and so on. The above analysis method has the following limitations. First, it is expensive to thoroughly analyze the formalized top-level specification or source code. Formal top-level specifications are often not easy to obtain, and the analysis of the source code is a lot of work, which will generate a lot of pseudo-illegal flows, and there is a lack of automated tools. Therefore, it takes a long time. For example, using syntax information flow analysis to analyze the covert channel of the Secure Xenix system takes two people and two years. Secondly, the covert channel identification method can only identify the covert channels brought by the system design, and some covert channels use the defects in the system implementation, which can be reflected when the system is running. Again, the identification method cannot be used universally in the actual system. Re-identification is required for different systems.

Contents of the invention

The technical problem to be solved by the present invention is: a method for quickly detecting the database covert channel is proposed, and the database covert channel caused by the system implementation defect can be found.

The present invention comprises the steps:

1) Create a database covert channel scenario

The database covert channel includes database shared resources, a high-security-level subject capable of modifying shared resources, and a low-security-level subject capable of observing changes in shared resources, and the security label of the high-security-level subject dominates the security label of the low-security-level subject; the database A database for implementing mandatory access control. Create the following database covert channel scenario.

Send signal 0: The high security level subject creates an object and authorizes the access permission of the object to the low security level subject;

Send signal 1: The high security level subject deletes the above object;

Received signal 0: The subject with a low security level accesses the object of a subject with a high security level, and observes that the system cannot perform security checks;

Received signal 1: The low-security-level subject accesses the object of the high-security-level subject, and observes that the object does not exist.

2) Perform database covert channel detection configuration

(1) Configure the database type to be detected;

(2) configure the connection information of the database to be detected;

(3) Log in to the detected database as a system administrator, create two subjects, and grant these two subjects the authority to access the detected database and the authority to create objects in the database, and then log in to the detected database as a label administrator In the database, create two security labels, one of which dominates the other security label, and assign these two security labels to the two newly created subjects respectively.

3) Log in to the database to be detected as a subject with a high security level and a subject with a low security level respectively.

4) The high security level subject creates an object and authorizes the access authority of the object to the low security level subject, sends a signal 0, the low security level subject accesses the object, and receives the signal 0 when it observes that the system cannot perform security check; The security-level subject deletes the object and sends signal 1, and the low-security-level subject accesses the object, and receives signal 1 when it observes that the object does not exist.

5) If the subject with high security level in step 4) can successfully send signal 0 and signal 1, and at the same time, the subject with low security level can successfully receive signal 0 and signal 1, then there is a database covert channel that can be realized by this scenario, otherwise there is no such scenario that can be used Implemented database covert channel.

The object described in the present invention may be a table.

Compared with the prior art, the present invention has the following advantages:

1. The implementation cost is small. The database covert channel detection method based on the present invention does not require the database management system to be detected to provide formalized top-level specifications or source codes, and only needs to run the database management system to perform detection. Those who conduct covert channel detection do not need to have relevant professional knowledge, and do not need to conduct formal analysis on the database management system. They only need to run the detection system to view the detection results conveniently.

2. Covert channels caused by implementation defects can be discovered. The implementation of the database system sometimes does not conform to the formal top-level specification. Using the formal specification to analyze the covert channel will fail to find the covert channel caused by the implementation defect. Based on the database covert channel detection method of the present invention, it is necessary to run the database management system in real time, and the receiving component can observe the real operation results returned by the database management system by inputting SQL commands, so that covert channels caused by implementation defects can be found.

3. It is versatile. The database covert channel scenario established based on the database covert channel detection method of the present invention utilizes common shared resources in the database system, including tables, views, and primary key constraints. Therefore, the method is general.

Description of drawings

Figure 1 Database covert channel detection system structure diagram

Figure 2 Flowchart of database-specific covert channel detection

Detailed ways

As shown in Figure 1, the database covert channel detection system includes a database covert channel scene library, a configuration component, a sending component and a receiving component.

The database covert channel scenario library contains multiple database covert channel scenarios, and each database covert channel scenario includes a sending component execution statement and a receiving component execution statement. The execution statement of the sending component includes the initialization environment of the high-security-level subject, the high-security-level subject sends signal 0, and the high-security-level subject sends signal 1. The execution statement of the receiving component includes the initialization environment of the low security level subject, the reception signal 0 of the low security level subject, the reception signal 1 of the low security level subject, and the restoration environment of the low security level subject.

The role of the configuration component is to configure the database covert channel detection. 1) Configure the database type to be detected and the database covert channel scenario to be detected. 2) Configure the connection information of the database to be detected, including database name, IP address and port number. 3) Create a high security level subject and a low security level subject. Log in to the detected database as a system administrator, create two subjects, and grant these two subjects the authority to access the detected database and the authority to create objects in the database, then log in to the detected database as a label administrator, create Two security labels, one of which dominates the other security label, are assigned to the two newly created principals respectively.

The sending component finds the corresponding database covert channel scene in the covert channel scene library according to the database type to be detected and the database covert channel type. Find the sending component execution statement from the database covert channel scenario. The receiving component finds the corresponding database covert channel scene in the covert channel scene library according to the type of the database to be detected and the type of the covert channel of the database. Find the receiving component execution statement from the covert channel scenario.

The sending component logs in to the detected database as a subject with a high security level, and sends signal 0 and signal 1 by modifying the shared resources of the database. The receiving component logs into the detected database as a subject with a low security level, and receives signal 0 and signal 1 by observing changes in shared resources.

The detection process of the sending component and receiving component is shown in Figure 2:

A method for detecting a specific type of database covert channel, the steps comprising:

1) Sending component and receiving component initialize the environment

2) Send component sends signal 0

3) The receiving component receives signal 0

4) The receiving component restores the environment

5) The sending component sends signal 1

6) The receiving component receives signal 1

7) If steps 1), 2), 3), 4), 5), and 6) are all executed successfully, then execute step 8), otherwise jump to step 9)

8) The output has a database covert channel implemented with XX scene

9) The output does not exist the database covert channel realized with XX scene

The experimental environment is to perform database covert channel detection on the domestic security database BeyonDB. Run the BeyondDB database and enable the mandatory access function. Make sure that no other principal accesses the BeyondDB database while performing covert channel detection.

The complete steps for covert channel detection on the BeyondDB database are given below.

Step 1. Create a database covert channel scenario

Create the following database covert channel scenario 1:

Send signal 0: the high security level subject creates a table and authorizes the access permission of the table to the low security level subject;

Send signal 1: the high security level subject deletes the above table;

Received signal 0: A subject with a low security level accesses the table of a subject with a high security level, and observes that the system cannot perform security checks;

Receive signal 1: The low-security-level subject accesses the table of the high-security-level subject, and observes that the table does not exist;

Create the following database covert channel scenario 2:

Initialization environment: the low security level subject creates a table and authorizes the access permission of the table to the high security level subject

Send signal 0: the high security level subject inserts a record with primary key 1 into the above table;

Send signal 1: The high security level subject deletes the above records;

Receive signal 0: The low security level subject inserts a record with primary key 1 into the above table, and observes that the insert operation fails;

Receive signal 1: The low security level subject inserts a record with primary key 1 into the above table, and observes that the insert operation is successful;

Create the following database covert channel scenario 3:

Initialization environment: the low security level subject creates a table and authorizes the access permission of the table to the high security level subject

Send signal 0: the high security level principal creates a view on the above table;

Send signal 1: the high security level subject deletes the above view;

Receiving signal 0: The low security level subject restricts deletion of the table, and observes that the deletion operation fails;

Receive signal 1: The subject with low security level restricts deletion of the table, and observes that the deletion operation is successful; Step 2, perform database covert channel detection configuration

(1) Configure the database type to be detected as BeyondDB and the database covert channel scenario to be detected, including database covert channel scenario 1, database covert channel scenario 2, and database covert channel scenario 3.

(2) Configure the connection information of the database to be tested, the IP address is localhost, the port is II7, and the database name is demodb.

(3) Log in to the detected database as a system administrator, create two subjects Alice and Bob, and grant these two subjects the authority to access demodb and the authority to create objects in the database, and then log in to the detected database as a label administrator Detect the database, create two security labels High and Low, where the security label High dominates the security label Low, assign the security label High to the subject Alice, and assign the security label Low to the subject Bob, at this time Alice is a subject with a high security level, and Bob is Low security level subjects.

Step 3: Log in to the database to be detected with the identity of high security level subject Alice and the identity of low security level subject Bob;

Step 4, according to the database covert channel scenario 1, as shown in Figure 2

(1) Alice creates a table Table1 and authorizes the access authority of the table to Bob, and sends signal 0,

The corresponding SQL statement is: create table Table1(id int);

Grant all on Table1 to Bob;

(2) Bob visits Table1, observes that the system cannot perform security checks, and receives a signal of 0;

The corresponding SQL statement is: select*from Alice.Table1

(3) Alice deletes table Table1, sends signal 1,

The corresponding SQL statement is: drop table Table1

(4) Bob visits the table Table1, observes that the table does not exist, and receives signal 1;

The corresponding SQL statement is: select*from Alice.Table1

In step 5, step 4), Alice successfully sends signal 0 and signal 1, while Bob successfully receives signal 0 and signal 1, and there is a database covert channel constructed using scenario 1 in BeyonDB.

Step 6, according to database covert channel scenario 2,

(1) Bob creates a table Table2 and authorizes the access authority of the table to Alice, and initializes the environment

The corresponding SQL statement is: Create Table Table2(id int primary key);

        Grant all on Table2 to Alice

(2) Alice inserts a record whose primary key is 1 into the table Table2,

The corresponding SQL statement is: Insert into Table2values(1)

(3) Bob inserts a record whose primary key is 1 into the table Table2, observes that the insert operation fails, and receives a signal of 0;

The corresponding SQL statement is: Insert into Table2values(1)

(4) Alice deletes the record whose primary key is 1 in Table2, sends signal 1, and the corresponding SQL statement is: Delete from Table2where id=1

(5) Bob inserts a record whose primary key is 1 into the table Table2, observes that the insertion operation is successful, and receives a signal of 0;

The corresponding SQL statement is: Insert into Table2values(1)

In step 7, step 6), Alice successfully sends signal 0 and signal 1, and Bob successfully receives signal 0 and signal 1, and there is a database covert channel constructed using scenario 2 in BeyonDB.

Step 7, according to database covert channel scenario 3,

(1) Bob creates a table Table3 and authorizes the access authority of the table to Alice, and initializes the environment

The corresponding SQL statement is: Create Table Table2(id int primary key);

        Grant all on Table2 to Alice

(2) Alice creates a view View1 on Table3, and the SQL statement corresponding to sending signal 0 is: create view View1 as select*from Table2

(3) Bob restricts the deletion of table Table3, and observes that the deletion operation fails and receives a signal of 0; the corresponding SQL statement is: drop table Table3restrict

(4) Alice deletes the view View1 on the table Table3, sends signal 1, and the corresponding SQL statement is: drop view Viewl

(5) Bob restricts the deletion of table Table3, and observes that the deletion operation fails and does not receive signal 1;

The corresponding SQL statement is: drop table Table3 restrict

In step 8, in step 7), Bob did not successfully receive signal 1, and there is no database covert channel constructed using scenario 3 in BeyonDB.

Claims (2)

1. a database private communication channel detection method is characterized in that, comprises the steps:

1) sets up database private communication channel scene

The low level security main body that the database private communication channel comprises the database shared resource, can revise the high safe level main body of shared resource and can observe shared resource change, the safety label of the safety label domination low level security main body of said high safe level main body; Said database is for realizing forcing the database of access control; Set up following database private communication channel scene:

Send signal 0: high safe level main body is created an object and is licensed to the low level security main body to the access rights of this object;

Send signal 1: high safe level main body is deleted above-mentioned object;

Receive signal 0: the object of the high safe level main body of low level security principal access, the system of observing can't carry out safety inspection;

Receive signal 1: the object of the high safe level main body of low level security principal access observes object and does not exist;

2) carry out the database private communication channel and detect configuration

(1) configuration type of database to be detected;

(2) link information in configuration data to be tested storehouse;

(3) with system manager's identity login detected data storehouse; Create two main bodys; And compose the authority of giving the authority in these two principal access detected data storehouses and in this database, creating object, with tag control person's identity login detected data storehouse, create two safety labels then; One of them another safety label of safety label domination is composed two main bodys to new establishment to these two safety labels respectively;

3) login database to be detected with the identity of high safe level main body and the identity of low level security main body respectively;

4) high safe level main body is created an object and is licensed to the low level security main body to the access rights of this object, sends signal 0, and this object of low level security principal access when the system of observing can't carry out safety inspection, receives signal 0; This object of high safe level main body deletion sends signal 1, and low level security principal access object when observing object when not existing, receives signal 1;

5) if high safe level main body can successfully be sent signal 0 and signal 1 in the step 4); The low level security main body can successfully receive signal 0 and signal 1 simultaneously; The database private communication channel that then exists available this scene to realize, otherwise the database private communication channel that does not exist available this scene to realize.

2. database private communication channel detection method as claimed in claim 1 is characterized in that: said object is table.

Images