SQLIA detection and prevention approach for RFID systems

While SQL injection attacks have been plaguing web application systems for years, the possibility of them affecting RFID systems was only identified very recently. However, very little work exists to mitigate this serious security threat to RFID-enabled enterprise systems. At the same time, the drop in RFID tag prices coupled with the increase in storage capacity of the tags have motivated users to store more and more data on the tags for ease of access. This in turn has increased the ability that attackers have of leveraging the tags to try and mount SQLIA based malware attacks on RFID systems thereby increasing the potential threat that RFID-enabled systems pose to the enterprise systems. In this paper, we propose a detection and prevention method from RFID tag-born SQLIA attacks. We have tested all possible types of dynamic queries that may be generated in RFID systems with all possible types of attacks that can be mounted on those systems. We present an analysis and evaluation of the proposed approach to demonstrate its effectiveness in mitigating SQLIA attack.

► We describe how attackers leverage RFID tags to mount SQLIA attacks on RFID systems.
► We describe a new programming language-neutral policy framework for ensuring that the structural properties of the system entities are preserved.
► A new algorithm for runtime discovery of the SQL injection attack and prevention is discussed.
► We present an evaluation of the proposed algorithm to quantify its effectiveness in mitigating RFID tag-born SQLIA attacks.