A Small Dummy Disrupting Database Reconstruction in a Cache Side-Channel Attack

This paper demonstrates the feasibility of a database reconstruction attack on open-source database engines and presents a defense method against it. We launch a Flush+Reload attack on SQLite, which returns approximate, noisy volumes returned by range queries for a private database. Given the volumes, our database reconstruction uses two al-gorithms, a Modified Clique-Finding algorithm and Match-Extension algorithm, to recover the database. Experiments show that an attacker can reconstruct the victim’s database with a size of 10,000 and a range of 12 with an error rate of up to 0.07% at most. To mitigate the attack, a small dummy data is added to the result volumes of range queries, which makes the approximation more confused. Experimental results show that by adding about 1% of dummy data, an attack success rate (in terms of the number of reconstructed volumes in the database) is reduced to 60% from 100% and an error rate increases to 15% from 0.07%. It is also observed that by adding about 2%of dummy data, the reconstruction is completely failed.

@article{Han2023,
  title     = {A Small Dummy Disrupting Database Reconstruction in a Cache Side-Channel Attack},
  journal   = {International Journal of Advanced Computer Science and Applications},
  volume    = {14},
  number    = {10},
  year      = {2023},
  publisher = {The Science and Information Organization},
  author    = {Hyeonwoo Han and Eun-Kyu Lee and Junghee Jo},
  doi       = {10.14569/IJACSA.2023.01410111},
  url       = {https://doi.org/10.14569/IJACSA.2023.01410111}
}