A Prospective Analysis of Security Vulnerabilities within Link Traversal-Based Query Processing (Extended Version)

TL;DR

This paper analyzes security vulnerabilities in Link Traversal-based Query Processing (LTQP), identifying ten threats and proposing mitigations to enhance security in decentralized data querying environments.

Contribution

It provides the first comprehensive security threat analysis for LTQP, offering mitigation strategies and recommendations for developers and data publishers.

Findings

Identified 10 security threats in LTQP.

Proposed mitigation strategies for each threat.

Provided concrete recommendations for secure LTQP deployment.

Abstract

The societal and economical consequences surrounding Big Data-driven platforms have increased the call for decentralized solutions. However, retrieving and querying data in more decentralized environments requires fundamentally different approaches, whose properties are not yet well understood. Link Traversal-based Query Processing (LTQP) is a technique for querying over decentralized data networks, in which a client-side query engine discovers data by traversing links between documents. Since decentralized environments are potentially unsafe due to their non-centrally controlled nature, there is a need for client-side LTQP query engines to be resistant against security threats aimed at the query engine's host machine or the query initiator's personal data. As such, we have performed an analysis of potential security vulnerabilities of LTQP. This article provides an overview of security threats in related domains, which are used as inspiration for the identification of 10 LTQP security threats. Each threat is explained, together with an example, and one or more avenues for mitigations are proposed. We conclude with several concrete recommendations for LTQP query engine developers and data publishers as a first step to mitigate some of these issues. With this work, we start filling the unknowns for enabling querying over decentralized environments. Aside from future work on security, wider research is needed to uncover missing building blocks for enabling true decentralization.