EAGER-TC: Limiting Effect of RAM-Scraping Attacks in DBMSs

点击翻译按钮获取中文摘要

This proposal explores effective solutions to RAM scraping attacks in the context of data management workloads. Recent studies identify RAM scraping attacks, wherein an adversary installs malware to stealmemory resident data, as one of the major causes of data thefts inenterprise information systems. Proposed research explores new vulnerabilities introduced by RAM scraping and developspractical solutions that offer the right blend of security against suchattacks while keeping performance degradation (due to cost/overhead ofsecurity scheme) within acceptable limits. The research team will explore realistic attack scenarios, model adversarial capabilities and constraints for typical DBMSs (e.g., small duration repeated attacks, effects of buffering and data lifetime, presence of concurrent queries, bandwidth limits, etc.), design criteria of a risk-aware query optimization that can accountfor a variety of disclosure risks emanating from RAM-scraping malwares;and develop optimization techniques that simultaneously optimize performance and reduce disclosure risks. Proposed research also explores the threat ofRAM-scraping attacks for the emerging cloud-based data processing frameworks like MapReduce.Intellectual Merit: The proposed research represents the first attempttowards a new direction of research , viz. mitigating impact of RAMscraping attacks in the context of DBMS workloads, that has not beenaddressed by the database research community at large. The proposedapproach of redesigning a query optimizer to explore tradeoffs betweenperformance and disclosure risks represents a significant innovation inquery processing and memory management in the database management area.Furthermore, exploration of RAM scraping attacks in MapReduce stylecloud-based data processing frameworks represents new innovation in cloudsecurity.Broader Impact: The results of this EAGER grant will help launch a new lineof research within database security community ? viz., risk aware databasemanagement that balances data exposure risks from RAM scraping attacks withperformance degradation in a variety of adversarial settings. The proposedresearch could also make a significant impact on the DBMS vendors and dataservice providers in the emerging cloud computing framework.For further information see the project web site at the URL:http://www.ics.uci.edu/~projects/privacygroup/projects.html