Search for: database-security
0.006 seconds

    Processing Queries with Mathematical Expressions on Encrypted Outsourced Databases

    , M.Sc. Thesis Sharif University of Technology Naseri Boroujeni, Saeed (Author) ; Jalil, Rasool (Supervisor)
    The ever-increasing volume of data and the lack of computational and storage facilities have caused a managerial challenge to organizations. The existence of these challenges on the one hand and the increase of storage services on the other hand have compelled the organizations to delegate their storage and management of data to the server providers of cloud storage services. The outsourcing of data to servers obviates the need for purchasing exorbitant storage equipment and recruiting professional workforce in the organization. Since the organization’s data will be kept outside the organization’s ambience in case of using such services in form of outsourcing, and the data will not be under... 

    A Method for Searching on Encrypted Data

    , M.Sc. Thesis Sharif University of Technology Mansoori, Fatemeh (Author) ; Jalili, Rasool (Supervisor)
    Using database encryption to protect data in some situations where access control is not soleley enough is inevitable. Database encryption provides an additional layer of protecton to conventional access control techniques. It prevents unauthorized users, including intruders breaking into a network, from viewing the sensitive data. As a result data remains protected even in the event that database is successfully attacked or stolen. However, encryption and decryption of data result in database performance degradation. In the situation where all the information is stored in encrypted form, one cannot make the selection on the database content any more. Data should be decrypted first, so an... 

    Database Schema Extraction Prevention Through DBMS Error Handling

    , M.Sc. Thesis Sharif University of Technology Naghdi, Sepideh (Author) ; Amini, Morteza (Supervisor)
    Nowadays large volume of sensitive data of organizations are stored in the databases. Thus, databases are attractive to the attackers to execute different types of attacks with different purposes. The useful information that attackers try to achieve in the preliminary steps of the attacks against the databases, is the database structure or schema. One of the popular approach to extract the schema of a database is to analyze the returned error messages from its DBMS. Hence, a solution to prevent schema disclosure via the error messages is customizing and modifying them. To achieve this goal, in this thesis, we propose a framework to handle and customize the error messages automatically and... 

    The knowledge map of energy security

    , Article Energy Reports ; Volume 7 , 2021 , Pages 3570-3589 ; 23524847 (ISSN) Nasr Esfahani, A ; Bagheri Moghaddam, N ; Maleki, A ; Nazemi, A ; Sharif University of Technology
    Elsevier Ltd  2021
    Much efforts have been made in the area of energy security in recent years, but due to its wide scope, it is necessary to review relevant knowledge activities and to analyze the state of knowledge of the field of energy security measurement. The purpose of this article is to present a comprehensive map of knowledge in the field of energy security. For this reason, many documents and articles have been collected during the period 2002–2019 using 7 large and reputable scientific databases as well as 53 different journals, 90% white Q1 quality. There is employed meta-synthesis, scientometrics and network analysis. In the initial survey stage where 1290 articles were found, after analyzing the... 

    Towards more secure constructions of adjustable join schemes

    , Article IEEE Transactions on Dependable and Secure Computing ; Volume 19, Issue 2 , 2022 , Pages 1078-1089 ; 15455971 (ISSN) Khazaei, S ; Rafiee, M ; Sharif University of Technology
    Institute of Electrical and Electronics Engineers Inc  2022
    An adjustable join (AdjoinAdjoin) scheme [4] is a symmetric-key primitive that enables a user to securely outsource his database to a server, and later to issue join queries for a pair of columns. When queries are extended to a list of columns, the 3Partition3Partition security of Adjoin schemes [8] does not capture the expected security. To address this deficiency, we introduce the syntax and security notion of multi-adjustable join (M-AdjoinM-Adjoin) schemes. We propose a new security notion for this purpose, which we refer to as M3PartitionM3Partition. The 3Partition3Partition security of AdjoinAdjoin extends to the M3PartitionM3Partition security of M-AdjoinM-Adjoin in a straightforward... 

    A Method for Querying on Encrypted XML Data

    , M.Sc. Thesis Sharif University of Technology Karimi, Maryam (Author) ; Jalili, Rasool (Supervisor)
    When organizations prefer to outsource their data, security protection of data will be more important. Using cryptography in addition to access control techniques is a natural way for saving confidentiality of data against untrusted server. However, encryption and decryption of data result in database performance degradation. In such a situation all the information stored in encrypted form, one cannot make the selection on the database content any more. Data should be decrypted first, so an unwilling tradeoff between the security and performance is normally forced. The appropriate approaches to increase the performance are methods to deal directly with the encrypted data without firstly... 

    Encryption Aware Query Processing for Data Outsourcing

    , Ph.D. Dissertation Sharif University of Technology Ghareh Chamani, Javad (Author) ; Jalili, Rasool (Supervisor)
    Data outsourcing provides cost-saving and availability guarantees. However, privacy and confidentiality issues, disappoint owners from outsourcing their data. Although solutions such as CryptDB and SDB tried to provide secure and practical systems, their enforced limitations, made them useless in practice. Inability in search on encrypted data, is one of the most important existing challenges in such systems. Furthermore, the overhead of mechanisms such as FHEs, removes them from considering for any practical system. Indeed, special purpose encryptions would be the only usable mechanisms for such purposes. However, their limited functionality does not support some important required... 

    Preventing database schema extraction by error message handling

    , Article Information Systems ; Volume 56 , 2016 , Pages 135-156 ; 03064379 (ISSN) Naghdi, S ; Amini, M ; Sharif University of Technology
    Elsevier Ltd 
    Nowadays, a large volume of an organization's sensitive data is stored in databases making them attractive to attackers. The useful information attackers try to obtain in the preliminary steps, is the database structure or schema. One of the popular approaches to infer and extract the schema of a database is to analyze the returned error messages from its DBMS. In this paper, we propose a framework to handle and modify the error messages automatically in order to prevent schema revealing. To this aim, after identifying and introducing an appropriate set of categories of error messages, each error message that is returned from a DBMS is placed in a proper category. According to the policy... 

    Improving SQL Injection Detection Techniques

    , M.Sc. Thesis Sharif University of Technology Dolatnezhad, Somayeh (Author) ; Amini, Morteza (Supervisor)
    SQL injection is one of the most important security threats in web applications with backend SQLbased database. An attacker can abuse an application’s vulnerability to change the queries sent from the application to the database. Many techniques and frameworks have been proposed for detecting and preventing SQL injection. But most of them cannot detect all types of SQL injection such as second-order attacks. In this thesis, we propose a new method to detect and prevent all types of this attack. The proposed method is a kind of anomaly-based intrusion detection methods and could be considered as a proxy between the application server and the database server. The proposed method, can detect... 

    AS5: A secure searchable secret sharing scheme for privacy preserving database outsourcing

    , Article Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), Pisa ; Volume 7731 LNCS , 2013 , Pages 201-216 ; 03029743 (ISSN) ; 9783642358890 (ISBN) Hadavi, M. A ; Damiani, E ; Jalili, R ; Cimato, S ; Ganjei, Z ; Sharif University of Technology
    Researchers have been studying security challenges of database outsourcing for almost a decade. Privacy of outsourced data is one of the main challenges when the "Database As a Service" model is adopted in the service oriented trend of the cloud computing paradigm. This is due to the insecurity of the network environment or even the untrustworthiness of the service providers. This paper proposes a method to preserve privacy of outsourced data based on Shamir's secret sharing scheme. We split attribute values into several parts and distribute them among untrusted servers. The problem of using secret sharing in data outsourcing scenario is how to search efficiently within the randomly...