US 2019/0104152 A1 · BLIND INJECTION ATTACK MITIGATION

Abstract

Blind injection attacks can compromise computer systems and their data. These attacks can appear in SQL, XML, LDAP, OS commands, or other contexts. Blind injection attacks may be used to obtain information from a data source based on whether a response is returned within a certain time frame. By introducing intentional delay servicing of commands , however, the efficacy of blind injection attacks can be reduced. SQL query statements or other commands can be analyzed to determine if a conditional delay exists, and randomization effects can be used (sometimes based on length of the conditional delay) to make it difficult for an attacker to use blind injection. These techniques may broadly apply to any data source, and include databases exposed to the public via the internet (e.g. via a web server URL). Blind SQL injection, blind XML injection, and other blind injection attacks can be mitigated using techniques described herein.

Claims20

Dependent claims

A method relating to mitigating blind SQL injection attacks, comprising:

receiving, at a computer system running a structured query language (SQL) database service, a first SQL query from a user;
executing the first SQL query against an SQL database;
prior to providing results of the executing, intentionally delaying the providing of the results by a non-deterministic amount of time;
and
subsequent to the intentional delay, the computer system providing the results of the first SQL query to the user.

2 more elements

Dependencies are inferred from the claim text.

Blind injection attack mitigation

Life of this patent

Blind injection attack mitigation

Life of this patent

Abstract

Claims20