Information Leakage Analysis of Database Query Languages

In this work, we extend language-based information-flow security analysis to the case of database applications embedding query languages. The analysis is performed by (i) computing an overapproximation of variables’ dependences, in the form of propositional formula, occurred up to each program point, (ii) checking the satisfiability on assigning truth values to variables, (iii) analyzing the application over a numerical abstract domain, and finally, (iv) enhancing the analysis using the reduced product of the propositional formulae domain and the numerical abstract domain.