Safe Database Design when Using ORM
This paper is concerned with the current problem of developing secure software using the ORM approach, specifically the problem of designing a secure database. To solve this problem, a tool for automated identication of potential threats is proposed. The authors discuss the ORM application aspects and note that when using the ORM approach, the database design task boils down to that of singling out classes as per the object-oriented programming principles, relationships between them and the main methods. The impossibility of anti-patterns appearing at the class design stage is substantiated. In order to implement such an analyzer, it is necessary to select database formalization tools and a mathematical apparatus to identify potential threats. The article suggests a way to formalize databases by means of the ALCQI description logic and using regular expressions to look for situations affecting database vulnerability. The authors examine descriptive logic semantics and logic composite concepts. By specifying the syntax and semantics of descriptive logic, one can formalize any class diagram. Thus, if an anti-pattern is expressed as some regular expression in the ALCQI descriptive logic language, the search for a pattern can be reduced to checking a text string for containing a regular expression.