Family Room Cafe

Introduction In the world of linked data which is known as Semantic Web (SW), Security of the data becomes challenge, where datasets are linked together. Masses of people, companies, universities and governments use the Internet. Therefore, significant and sensitive data becomes target of cyber-attacks. Several studies have discussed the security of the SW at different layers. Only a limited number of researchers have however studied the SPARQL injection attacks [2][3][5]. They have all applied their tests using Java and placed RDF data and the ontology on the Jena framework server. Their work did not (1) use a PHP as development language, (2) use Sesame as RDF data store and the SPARQL engine, (3) conduct risk assessment of the security framework, (4) list all possible solutions or provide any algorithm for mitigation and test the system after mitigation. Our research considers all of these limitations. Other research efforts [1] [4] have just touched on the SPARQL vulnerabilities and possible solutions. We performed SPARQL/SPARUL injection attacks on the linked data in the boundary of a particular application and outside it. We found that there is no such tool in PHP to mitigate these attacks comparing with Java language. As a result, we provide a filter algorithm to prevent such attacks and provide recommendations for PHP developers toward secure SW applications using PHP. II. Healthcare Semantic Web System Implementation Our Healthcare Semantic Web System (HCSWS) is a Semantic Web test application that is partly developed with the intention to apply SPARQL/SPARUL injection attacks to examine and assess their impacts on the CIA of the healthcare data with regards developing this SW application in a particular data server and by using particular language. The HCSWS designed and implemented using PHP 5.5.12, the data implemented using RDF turtle and stored in Sesame 2.8.6 store server. For the RDF data query, SPARQL 1.1 is used. EasyRDF library is used for communicating PHP with SPARQL engine.

ATTACK EXPERIMENTAL DESIGN We implemented different malicious programs to test the security of the HCSWS under SPARQL, Blind SPARQL and SPARUL attacks. In addition, we targeted various healthcare data, as being valuable on the HCSWS in order to assess the risk of the attacks and to check their effect on the CIA of the HCSWS. we consider the following scenario: a nurse exploits her authority for accessing some data to access something she is not supposed to have access to. In other words, the nurse act as an attacker and more formally, the threat agent here is a malicious nurse. Definition 1: Injection attack is a threat on a vulnerable user input by adding malicious code after a required input. This code follows SPARQL Syntax to be combined with the actual query that asks for user input.

RUNNING THE EXPERIMENTS To run the experimental attacks on the HCSWS, we use the designed malicious codes to the target input. Our designed malicious codes of the SPARQL/ Blind SPARQL inject the search input and our designed malicious codes of SPARUL inject the update input. Therefore, the HCSWS will versus the attack. Fig. 2 demonstrates the HCSWS under the SPARQL/Blind SPARQL attack.

COUNTERMEASURES AND RISK MITIGATION The reason of the attack successful that it was unprotected from these injections. We applied different types of safeguards and discussed some recommendations when it is not applicable. To summarize, there are different ways to prevent injection attacks. These ways may protect against and prevent security breaches. Suggested solutions include: – Provide a SPARQL ParametrizedString tool for PHP developers. – Validate the user input using filtering algorithm. – Have a standard for code writing. Meanwhile, some helpful ways that contribute to attack prevention: – Assign permission and access control for each user in the system. – Protect sensitive ontologies by using hash functions. – Use unpredictable variables names.

DISCUSSION We evaluated security robustness using ParametrizedString countermeasure and applying a filter algorithm for attack prevention. The importance of a tool for patching any types of injections is thus significant as that may encourage developers to move towards semantic web technology. We conclude that mitigating vulnerability should be a responsibility of everyone in this space whether a web developer, security specialist, researcher or ontologist.