CN107644175A - A kind of method for preventing SQL injection - Google Patents

Abstract

The invention discloses a kind of method for preventing SQL injection, including：1, Application Agent and agency service consult generation encryption key；2, Application Agent is encrypted using encryption key to the keyword of SQL statement, and being spliced into SQL statement with user's input sends to agency service；3, the SQL statement that agency service is encrypted to keyword is decrypted, and the SQL statement after SQL statement to encryption and decryption performs morphological analysis and syntactic analysis generative grammar tree simultaneously, if syntax trees that both generate differ, then it is assumed that SQL injection risk be present；If both are identical, then it is assumed that in the absence of SQL injection, the SQL statement after decryption are sent into database and performed.The present invention can be detected accurately using normal SQL statement and SQL statement syntax tree this characteristic that changes after injecting to SQL injection.

Description

A way to prevent SQL injection

technical field

The invention relates to the technical field of information security, in particular to a method for preventing SQL injection.

Background technique

SQL (Structured Query Language) is a structured query language for databases, and the SQL syntax is mostly based on the ANSI standard SQL92. A SQL statement can execute a query request or perform an addition, deletion, and modification operation on the database. A large number of websites in the Web 2.0 era are based on SQL for data access and storage, and there are a large number of codes that do not perform sufficient security checks on user input on the application side. These SQL statements without security checks may contain user data. Malicious input, Server variable injection, and malicious content injected by Cookie, such as certain malicious strings of SQL, etc. These user inputs are spliced into legal SQL statements on the user side and executed on the server, resulting in leakage of sensitive data in the database and loss of database data. This will lead to huge security risks for websites, databases and data. Therefore, defense against SQL injection has become an extremely important security task for service providers.

SQL injection is usually divided into: (1) Use comment characters (--##) to truncate normal query statements or bypass SQL verification; (2) Tautology attacks: Inject statements in SQL where conditions to make the conditions constant, Bypassing verification to extract data; (3) Illegal logical error query to obtain database information and prepare for the next attack; (4) Union query attack, using the SQL keyword Union to bypass database verification and steal data; (5) ) Incidental query attack is to execute any SQL statement in a normal SQL statement when multiple statements are allowed to be executed in the database, so as to achieve the purpose of attack; ) inference means that after the database administrator securely weaves, the query with illegal logic error cannot obtain enough information, but use the inference method to construct the query request, and infer the parameters that can be injected according to the response content returned by the database; (8) The code replacement attack replaces the code with the injected text to avoid detection; (9) the second-order injection first legally stores the code used in the attack into the database, and then legally reads the attack field in the database to launch the attack.

The detection methods of SQL injection usually include whitelist and blacklist technology, that is, only the SQL statements in the whitelist will be executed, and the SQL/IP/keywords on the blacklist cannot be executed; feature detection technology believes that the injected SQL statement is usually With certain characteristics, such as user input containing comments, multiple statements or keywords containing SQL, etc., SQL injection checks are performed based on accumulated security features. It is obvious that the above methods have certain limitations: the result of feature-based detection depends on whether the feature set of injection attacks is comprehensive and accurate; the whitelist or blacklist technology strictly restricts the SQL statements that users can use to be within the specified SQL statement In collections, flexibility is limited.

Contents of the invention

The purpose of the present invention is to overcome the deficiencies in the prior art, provide a method for preventing SQL injection, and realize efficient detection of SQL injection.

For solving the above-mentioned technical problems, the present invention provides a kind of method for preventing SQL injection, it is characterized in that, comprises the following steps:

Step S1, the application agent negotiates with the agent service to generate an encryption key;

Step S2, the application program agent uses the encryption key to encrypt the keyword of the SQL statement, and splices the SQL statement with the user input and sends it to the proxy service;

In step S3, the agent service decrypts the keyword-encrypted SQL statement, and simultaneously performs lexical analysis and syntax analysis on the encrypted SQL statement and the decrypted SQL statement to generate a syntax tree. If the syntax trees generated by the two are different, it is considered There is a risk of SQL injection; if the two are the same, it is considered that there is no SQL injection, and the decrypted SQL statement is sent to the database for execution;

Step S4, the database executes the SQL statement and returns the execution result, and the agent service forwards the result to the application agent after receiving the result returned by the database.

Further, in step S1, the encryption key negotiation may be implemented by using an asymmetric encryption algorithm or using a random number sequence generated by the same randomization seed as an encryption and decryption key.

Further, in step S2, a symmetric encryption algorithm is used to encrypt the keyword of the SQL statement, including DES algorithm, 3DES algorithm, TDEA algorithm, Blowfish algorithm, RC5 algorithm or IDEA algorithm.

Further, in step S3, the specific detection procedure of the proxy service for SQL injection is as follows:

₁ ) After the SQL proxy server receives the encrypted SQL statement S1, the statement is decrypted to generate S2 _;

_{2 )} Carry out lexical analysis and grammatical analysis respectively to S1 and S2, generate corresponding abstract syntax tree T1 and _{T2 ;}

3) If the syntax tree T ₂ fails to be generated, it means that the SQL may cause syntax errors after decryption due to injection, and it can be directly judged as SQL injection; if the syntax tree T ₂ is generated successfully, then compare whether the syntax trees T ₁ and T ₂ are completely consistent , if inconsistent, it is determined that there is SQL injection;

4) If there is SQL injection, an error message is returned to the application agent.

Further, lexical analysis and grammar analysis use ANTLR4.

Compared with the prior art, the beneficial effect achieved by the present invention is: in the present invention, even if the content input by the user contains the content of SQL injection, since all keywords have been encrypted and transformed, the encrypted key can be identified on the proxy service. keyword, and can correctly perform grammatical analysis and generate results; when grammatical analysis is performed on the SQL statement after keyword decryption, if there is SQL injection, the syntax tree will inevitably be different. The present invention utilizes the normal SQL statement and the injected This feature can accurately detect SQL injection if the syntax tree of the SQL statement changes.

Description of drawings

Fig. 1 is the framework schematic diagram of the method of the present invention;

Fig. 2 is a flow chart of the method for detecting SQL injection in the present invention.

detailed description

The present invention will be further described below in conjunction with the accompanying drawings. The following examples are only used to illustrate the technical solution of the present invention more clearly, but not to limit the protection scope of the present invention.

As shown in Figure 1, a kind of method for preventing SQL injection of the present invention comprises the following steps:

Step S1, the application agent negotiates with the agent service to generate an encryption key.

The application architecture can be B/S or C/S architecture, and the application side can be the web background or the client. The application agent refers to the agent running on the application side, and the application side interacts with the outside world through the application agent.

The proxy service refers to a SQL proxy server, which is used to receive the SQL request of the application program, and realize the interaction between the application program and the database as a proxy.

The running application agent first needs to use RSA to negotiate and distribute the secret key with the proxy server to ensure that the same secret key is obtained by both parties, and encrypted and transmitted to the application program as the encryption key for the SQL statement keyword in this session.

Encryption key negotiation can be realized by asymmetric encryption algorithm, and the random number sequence generated by the same randomization seed can also be used as the encryption and decryption key.

In step S2, the application agent uses the encryption key to encrypt the keyword of the SQL statement, and splices it with the user input to form an encrypted SQL statement and sends it to the proxy service.

The application agent sends a request to the SQL agent service through the JDBC interface driver or directly calls the SQL command. The application agent uses the encryption key obtained in the previous step to encrypt and transform the keywords of the SQL command, splicing it with the user input into an encrypted SQL statement and transmitting it to the SQL proxy server.

In consideration of performance issues, symmetric encryption algorithms are selected for encryption in the embodiment of the present invention, including DES algorithm, 3DES algorithm, TDEA algorithm, Blowfish algorithm, RC5 algorithm, IDEA algorithm and other symmetric encryption algorithms or custom encryption algorithms.

Step S3, the proxy service decrypts the encrypted SQL statement, and performs lexical analysis and syntax analysis on the encrypted SQL statement and the decrypted SQL statement at the same time, and determines whether there is SQL injection according to the comparison result of the two, if the results are not the same, Then it is considered that there is a risk of SQL injection, and an error is returned directly. If the results are the same, it is considered that there is no SQL injection, and the decrypted SQL statement is sent to the database for execution.

The method of determination is that the SQL proxy service performs lexical and grammatical analysis on the encrypted SQL statement and the decrypted SQL statement at the same time, and by comparing the results of the two analysis, it is determined whether there is a potential SQL injection risk. If the comparison results are the same, it is considered There is no injection hazard in SQL, otherwise it is considered risky.

The SQL injection includes the use of annotations, tautology attacks, Union query attacks, incidental query attacks, and the like. After the above-mentioned attack method injects the attack content into the normal SQL statement, the SQL syntax analysis result will change compared with the non-injected SQL statement. Through comparison, the above-mentioned attack behavior can be detected.

As shown in Figure 2, the specific detection procedure for SQL injection by the SQL proxy service in this step is as follows:

₁ ) After the SQL proxy server receives the encrypted SQL statement S1, the statement is decrypted to generate S2 _;

2) Use existing technologies such as ANTLR4 to perform lexical analysis and grammatical analysis on S ₁ and S ₂ respectively, and generate corresponding abstract syntax trees T ₁ and T ₂ , wherein the difference between the lexical and grammatical analysis of S ₁ and S ₂ is , the keywords of S ₂ are unencrypted, and the keywords of S ₁ are converted after encryption;

3) If the syntax tree T ₂ fails to be generated, it means that the SQL may cause syntax errors after decryption due to injection, so it can be directly judged as SQL injection; if the syntax tree T ₂ is generated successfully, then compare whether the syntax trees T ₁ and T ₂ are completely consistent , if they are not consistent, it is only possible that the syntax tree of the content of the decrypted statement injection has changed due to SQL injection, which eventually leads to semantic differences, so it is determined that there is SQL injection;

4) According to the judgment result, if there is SQL injection, an error message is returned to the application program; if there is no SQL injection, the decrypted SQL statement is sent to the database for execution.

Perform lexical and grammatical analysis on keyword-encrypted SQL to obtain the SQL syntax tree expected by the application, and perform grammatical analysis on the decrypted SQL to obtain the syntax tree expressed by the concatenated SQL statement. If the syntax trees are the same, it means that the SQL syntax tree expected to be expressed is the same as the syntax tree actually expressed, so it can be deduced that the semantics expressed by the application are the same as the semantics expressed by SQL, and there is no SQL injection, otherwise it is considered that there is SQL injection.

Step S4, the database executes the SQL statement and returns the execution result, and the agent service forwards the result to the application agent after receiving the result returned by the database.

The proxy service can support multiple sessions at the same time. When the application program proxy connects to the proxy service, the proxy service establishes a connection with the application program, keeps the session, and stores the necessary information of the application program. The connection is always maintained while the agent checks the SQL statement and sends the SQL statement to the database. After the agent obtains the data returned by the database, it forwards the result to the application agent through the existing connection, and then transmits it to the application.

The above is only a preferred embodiment of the present invention, it should be pointed out that for those of ordinary skill in the art, without departing from the technical principle of the present invention, some improvements and modifications can also be made, these improvements and modifications It should also be regarded as the protection scope of the present invention.

Claims (6)

1. a kind of method for preventing SQL injection, it is characterized in that, comprise the following steps：

Step S1, Application Agent and agency service consult generation encryption key；

Step S2, Application Agent are encrypted using encryption key to the keyword of SQL statement, and SQL is spliced into user's input Sentence is sent to agency service；

Step S3, the SQL statement that agency service is encrypted to keyword are decrypted, and after SQL statement to encryption and decryption SQL statement performs morphological analysis and syntactic analysis generative grammar tree simultaneously, if both syntax trees of generation differ, then it is assumed that deposit In SQL injection risk；If both are identical, then it is assumed that in the absence of SQL injection, the SQL statement after decryption are sent into database and held OK；

Step S4, database perform this SQL statement and return to the result of execution, and agency service is receiving database returning result Afterwards, it is transmitted to Application Agent.

2. a kind of method for preventing SQL injection according to claim 1, it is characterized in that, in step S1, encryption key is consulted Rivest, shamir, adelman can be used to realize or be randomized the random number sequence of seed generation as encryption by the use of identical and decrypt secret Key.

3. a kind of method for preventing SQL injection according to claim 1, it is characterized in that, in step S2, to SQL statement Keyword encryption uses symmetric encipherment algorithm.

4. a kind of method for preventing SQL injection according to claim 1, it is characterized in that, symmetric encipherment algorithm is calculated for DES Method, 3DES algorithms, TDEA algorithms, Blowfish algorithms, RC5 algorithms or IDEA algorithms.

5. a kind of method for preventing SQL injection according to claim 1, it is characterized in that, in step S3, agency service pair It is as follows that SQL injection specifically detects journey：

1) SQL proxy servers receive the SQL statement S of encryption₁Afterwards, generation S the sentence is decrypted₂；

2) to S₁And S₂Morphology parsing and syntax parsing are carried out respectively, generate corresponding abstract syntax tree T₁And T₂；

If 3) generative grammar tree T₂Failure, then illustrate that SQL may be because that injection causes syntax error after decryption, then can directly sentence It is set to SQL injection；If generative grammar tree T₂Succeed, then contrastive grammar tree T₁And T₂It is whether completely the same, if inconsistent, judge SQL injection to be present；

4) if there is SQL injection, then error message is returned to Application Agent.

6. a kind of method for preventing SQL injection according to claim 5, it is characterized in that, morphology parsing and syntax parsing are adopted Use ANTLR4.