基于指令集随机化的SQL注入防御技术研究  

Research on Preventing SQL Injection Attacks Based on ISR

作　　者：李原[1] 蒋华伟[1] 

机构地区：[1]河南工业大学信息科学与工程学院,郑州450001

出　　处：《计算机与数字工程》2009年第1期96-99,共4页Computer & Digital Engineering

基　　金：河南省教育厅科技攻关项目(编号:2008A520005)资助

摘　　要：WEB应用程序广泛受到SQL注入攻击的威胁,SQL攻击易于实施且危害严重。分析了现有的各种防范技术,在此基础上提出了一种基于指令集随机化技术的SQL注入防范原型系统。该系统首先对SQL关键字经过特殊的随机化处理,然后与用户输入组装成完整的SQL语句,再使用随机化的SQL语法分析程序对语句是否存在注入进行判定。系统的实现不依赖于现有WEB应用程序和服务器平台。实验表明,此系统具有较好的防范SQL注入的效果和较低的运行开销。SQL injection poses a major thread to web application security. The paper analyzes the existing solutions to prevent it and the problem of those solutions. Then it presents a method of countering SQL injection attacks with ISR （Instruction Set Randomization）. Based on the method, a prototype system of prevention SQL injection attacks is intro- duced. First, SQL keywords are randomized. Then, the user input is picked up and embedded into randomized SQL sen- tences. Finally, these randomized SQL sentences are checked with especial syntax analysis. The experiment shows that the mechanism imposes negligible performance overhead and can be easily retrofitted to existing systems.

关 键 词：SQL注入 指令集随机化 应用层安全 网络攻击 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]