Slabosti kriptografske zaštite u bazi podataka MariaDB

undergraduate thesis

• Title (english): Weaknesses of cryptographic protection in MariaDB database engine
• Author: Marijo Cvitanović
• Mentor: Stjepan Groš (mentor)
• Committee member: Stjepan Groš (predsjednik povjerenstva)
• Committee member: Ivona Brajdić (član povjerenstva)
• Committee member: Karlo Slovenec (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2020-09-02, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing

Abstract

U ovom radu je opisana upotreba MariaDB sustava za upravljanje bazom podataka te slabosti koje se u tom sustavu pojavljuju. Upotreba sustava je prikazana nizom primjera u obliku ispisa koje je moguće isprobati i implementirati. Opisan je AES način kriptiranja podataka i posebno ECB način šifriranja, njegove slabosti i propusti, jer se kao takav koristi u MariaDB. Osim njega prikazano je i kako uspostaviti zaštitu pomoću InnoDB Storage Engine-a. Definiran je model prijetnje napadača na bazi podataka i prikazano je što napadač može saznati uz pomoć javno dostupnih informacija uz primjere. Osim informacija koje može saznati, prikazano je i na koji način napadač može ugroziti bazu podataka. Dodatno je definiran model napadača na aplikaciji. Opisane su SQL-injekcije i kako se obraniti od njih, aplikacijski i unutar same baze podataka.

Abstract (english)

MariaDB is DBMS (Database Management System) that is described in this paper, its functionality and weaknesses. System usage is shown with examples that can be implemented. Furthermore, AES (Advanced Encryption Standard) algorithm for data encryption is described, mainly ECB (Electronic Codebook) mode. There are few modes for AES algorithm, but since ECB is used in MariaDB the emphasis is on it. Additionally, InnoDB storage engine is described. It is shown how to protect your data on hard disk using InnoDB. Moreover, threat modeling is described. In this paper two threat models are defined. First one is threat model of attacker on database. It is shown what attacker can do to compromise database. Second one is threat model of attacker on application. SQL-injection is described and it is shown how to protect against SQL-injection since it is the most common application based attack on database.

• Keywords: slabost; šifriranje; baza podataka; MariaDB
• Keywords (english): weakness; encipher; database; MariaDB
• Language: croatian
• URN:NBN: urn:nbn:hr:168:649800
• Study programme: Title: Computing; Study programme type: university; Study level: undergraduate; Academic / professional title: sveučilišni/a prvostupnik/ prvostupnica (baccalaureus/baccalaurea) inženjer/inženjerka računarstva (sveučilišni/a prvostupnik/ prvostupnica (baccalaureus/baccalaurea) inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2023-01-14 20:12:30