Scooter & Sidecar: a domain-specific approach to writing secure database migrations
Scooter & Sidecar: a domain-specific approach to writing secure database migrations
复制标题
DOI：
10.1145/3453483.3454072
复制
发表时间：
2021-06
期刊：
影响因子：
--
通讯作者：
John Renner;Alex Sanchez-Stern;Fraser Brown;Sorin Lerner;D. Stefan
中科院分区：
文献类型：
--
作者：
John Renner;Alex Sanchez-Stern;Fraser Brown;Sorin Lerner;D. Stefan
Web应用程序通常处理大量敏感的用户数据。现代安全Web框架通过以下方式来保护这些数据：（1）使用声明性语言来指定数据库模式的安全策略，以及（2）在运行时自动执行这些策略。不幸的是，这些框架不能处理非常常见的情况，即模式或策略需要随着时间的推移而演变，并且模式和策略的更新需要以仔细协调的方式执行。架构或策略迁移过程中的错误可能会无意中泄漏敏感数据或引入权限升级错误。在这项工作中，我们提出了一个特定于域的语言（滑板车）表达模式和策略迁移，和相关的SMT为基础的验证（Sidecar），以确保迁移是安全的应用程序的发展。我们描述了滑板车和Sidecar的设计，并表明我们的框架可以用来表达现实的模式，政策和迁移，而不放弃运行时或验证性能。
Web applications often handle large amounts of sensitive user data. Modern secure web frameworks protect this data by (1) using declarative languages to specify security policies alongside database schemas and (2) automatically enforcing these policies at runtime. Unfortunately, these frameworks do not handle the very common situation in which the schemas or the policies need to evolve over time---and updates to schemas and policies need to be performed in a carefully coordinated way. Mistakes during schema or policy migrations can unintentionally leak sensitive data or introduce privilege escalation bugs. In this work, we present a domain-specific language (Scooter) for expressing schema and policy migrations, and an associated SMT-based verifier (Sidecar) which ensures that migrations are secure as the application evolves. We describe the design of Scooter and Sidecar and show that our framework can be used to express realistic schemas, policies, and migrations, without giving up on runtime or verification performance.