Proceedings of the third ACM SIGPLAN workshop on Programming languages and analysis for security
Proceedings of the third ACM SIGPLAN workshop on Programming languages and analysis for security
复制标题
第三届 ACM SIGPLAN 编程语言和安全分析研讨会论文集
DOI：
10.1145/1375696.1375706
复制
发表时间：
2008
期刊：
影响因子：
--
通讯作者：
Morten Dahl
中科院分区：
文献类型：
--
作者：
J. Cheney;Morten Dahl
许多科学学科，如生物学和天文学，现在正在系统地收集大量原始数据，并将其集中存储在关系数据库中，供其社区共享使用。在许多情况下，这样的系统接受使用Web表单提交的任意SQL查询。典型的数据库管理系统不提供对实施资源访问控制策略的支持，以防止合法用户意外提交或攻击者故意提交的昂贵或无意义的查询。相反，这样的系统通常使用超时来停止在合理的时间段内没有终止的查询。这种方法可以限制滥用，但不能防止它，而且，它不提供有用的反馈，合法用户的查询超过了时间limit.In本文中，我们研究了一种基于语言的技术，用于绑定的时间和空间资源使用的数据库查询。我们引入了一个简单的核心数据库查询语言的成本语义，定义了一个基于类型的分析估计上界的渐近运行时间的查询，并证明其合理性。我们还讨论了一个原型实现，我们已经用来分析提交给SDSS SkyServer天文数据库的典型SQL查询。
Many scientific disciplines, such as biology and astronomy, are now collecting large amounts of raw data systematically and storing it centrally in relational databases for shared use by their communities. In many cases such systems accept arbitrary SQL queries submitted using a Web form. Typical database management systems do not provide support for enforcing resource access control policies to guard against expensive or pointless queries submitted accidentally by legitimate users or intentionally by attackers. Instead, such systems typically employ timeouts to halt queries that do not terminate within a reasonable period of time. This approach can limit misuse but cannot prevent it; moreover, it does not provide useful feedback for legitimate users whose queries exceed the time limit.In this paper, we study a language-based technique for bounding the time and space resource usage of database queries. We introduce a cost semantics for a simple core database query language, define a type-based analysis for estimating an upper bound on the asymptotic running time of a query, and prove its soundness. We also discuss a prototype implementation which we have used to analyze typical SQL queries submitted to the SDSS SkyServer astronomical database.