You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@teaclave.apache.org by "bobozi-cmd (via GitHub)" <gi...@apache.org> on 2023/10/19 06:24:31 UTC
[I] Can Teaclave resist Multi-query Attack? [incubator-teaclave]
bobozi-cmd opened a new issue, #721:
URL: https://github.com/apache/incubator-teaclave/issues/721
<!--
We're glad to anwser any questions related to Teaclave.
To help people quickly understand the issue, please also
include some background and context of the question.
We have documented many useful information on the homepage,
please check them out first: https://teaclave.apache.org/docs/.
-->
Hi!
I am interested in the way to resist Multi-query Attack.
The multi-query attack method includes two attack ways:
(1) One way to obtain the other party’s information is to tamper with the input content for each query, while keeping the query itself unchanged. For example, the attacker can obtain all the information of the other party’s join key through multiple join queries and tampering with the content of his join key each time.
(2) Another way is to infer the other party’s private data by rewriting the query each time and comparing the results of multiple queries. For example, the attacker can use the where condition to limit the input of the aggregation function. The first time the query obtains the aggregation result of N pieces of data, the second time by changing the where condition, the aggregation result of N-1 pieces of data can be obtained, and then the attacker can obtain the original information of 1 piece of data by comparing results.
Cam Teaclave help user resist this attack automatically?
Thanks!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@teaclave.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@teaclave.apache.org
For additional commands, e-mail: notifications-help@teaclave.apache.org
Re: [I] Can Teaclave resist Multi-query Attack? [incubator-teaclave]
Posted by "henrysun007 (via GitHub)" <gi...@apache.org>.
henrysun007 commented on issue #721:
URL: https://github.com/apache/incubator-teaclave/issues/721#issuecomment-1778861764
Since you can `SELECT` the table, why not use `SELECT money FROM table WHERE id=1` to get the money of user 1 directly?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@teaclave.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@teaclave.apache.org
For additional commands, e-mail: notifications-help@teaclave.apache.org
Re: [I] Can Teaclave resist Multi-query Attack? [incubator-teaclave]
Posted by "hiroki-chen (via GitHub)" <gi...@apache.org>.
hiroki-chen commented on issue #721:
URL: https://github.com/apache/incubator-teaclave/issues/721#issuecomment-1837540316
I wonder _why_ Teaclave needs to support such attacks because it seems to me that these threats are orthogonal to Teaclave's design goals. The attacks themselves, essentially, fall into the category of side-channel and statistical inferences that can be found in the DB research area.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@teaclave.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@teaclave.apache.org
For additional commands, e-mail: notifications-help@teaclave.apache.org
Re: [I] Can Teaclave resist Multi-query Attack? [incubator-teaclave]
Posted by "bobozi-cmd (via GitHub)" <gi...@apache.org>.
bobozi-cmd commented on issue #721:
URL: https://github.com/apache/incubator-teaclave/issues/721#issuecomment-1778388638
A simple case is:
SELECT SUM(money) FROM table;
SELECT SUM(money) FROM table WHERE id<>1;
than I can compute the money of user 1
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@teaclave.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@teaclave.apache.org
For additional commands, e-mail: notifications-help@teaclave.apache.org
Re: [I] Can Teaclave resist Multi-query Attack? [incubator-teaclave]
Posted by "bobozi-cmd (via GitHub)" <gi...@apache.org>.
bobozi-cmd closed issue #721: Can Teaclave resist Multi-query Attack?
URL: https://github.com/apache/incubator-teaclave/issues/721
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@teaclave.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@teaclave.apache.org
For additional commands, e-mail: notifications-help@teaclave.apache.org
Re: [I] Can Teaclave resist Multi-query Attack? [incubator-teaclave]
Posted by "bobozi-cmd (via GitHub)" <gi...@apache.org>.
bobozi-cmd commented on issue #721:
URL: https://github.com/apache/incubator-teaclave/issues/721#issuecomment-1778900615
One condition is that attacker cannot select plaintext from table， but can select result of some operations like SUM, AVG etc. For protection someone‘s data, DB will filter result after SQL to avoid data source only one row. Attacker may not know any data in DB, but can use == to guess existed id and use SUM(n) and SUM(n-1) to compute target data.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@teaclave.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@teaclave.apache.org
For additional commands, e-mail: notifications-help@teaclave.apache.org
Re: [I] Can Teaclave resist Multi-query Attack? [incubator-teaclave]
Posted by "henrysun007 (via GitHub)" <gi...@apache.org>.
henrysun007 commented on issue #721:
URL: https://github.com/apache/incubator-teaclave/issues/721#issuecomment-1776736407
The short answer is no but it could be implemented.
I would answer the question more accurately and in detail if you could give more description about the motivation and threat model. It seems not necessary to resist the attack.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@teaclave.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@teaclave.apache.org
For additional commands, e-mail: notifications-help@teaclave.apache.org
Re: [I] Can Teaclave resist Multi-query Attack? [incubator-teaclave]
Posted by "bobozi-cmd (via GitHub)" <gi...@apache.org>.
bobozi-cmd commented on issue #721:
URL: https://github.com/apache/incubator-teaclave/issues/721#issuecomment-1837730938
> these threats are orthogonal to Teaclave's design goals
yes, I realize this now, and thanks for your suggestion :)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@teaclave.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@teaclave.apache.org
For additional commands, e-mail: notifications-help@teaclave.apache.org