OracleLabelSecurityAdministrator’sGuide11gRelease2(11.2)资源-CSDN文库

oracle

需积分: 5 43 浏览量 2023-06-18 10:29:22 上传评论收藏 4.5MB PDF 举报

资源推荐

资源详情

资源评论

Oracle® Label Security

Administrator’s Guide

11g Release 2 (11.2)

E10745-04

August 2013

Oracle Label Security Administrator's Guide, 11g Release 2 (11.2)

E10745-04

Primary Author: Sumit Jeloka

Contributor: Peter Wahl, Paul Needham, Vikram Pesati, Srividya Tata, Chi Ching Chui, Digvijay

Sirmukaddam, Hozefa Palitanawala, Pat Huey, Manoj Kamani, Kamal Tbeileh, Lakshmi Kethana

This software and related documentation are provided under a license agreement containing restrictions on

use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your

license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license,

transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse

engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is

prohibited.

The information contained herein is subject to change without notice and is not warranted to be error-free. If

you find any errors, please report them to us in writing.

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it

on behalf of the U.S. Government, the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software,

any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users

are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and

agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and

adaptation of the programs, including any operating system, integrated software, any programs installed on

the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to

the programs. No other rights are granted to the U.S. Government.

This software or hardware is developed for general use in a variety of information management

applications. It is not developed or intended for use in any inherently dangerous applications, including

applications that may create a risk of personal injury. If you use this software or hardware in dangerous

applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other

measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages

caused by use of this software or hardware in dangerous applications.

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of

their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks

are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD,

Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced

Micro Devices. UNIX is a registered trademark of The Open Group.

This software or hardware and documentation may provide access to or information on content, products,

and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly

disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle

Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your

access to or use of third-party content, products, or services.

iii

Contents

Preface............................................................................................................................................................... xix

Audience..................................................................................................................................................... xix

Documentation Accessibility................................................................................................................... xix

Related Documentation............................................................................................................................ xx

Conventions ............................................................................................................................................... xx

Part I

1 Introduction to Oracle Label Security

Computer Security and Data Access Controls.................................................................................... 1-2

Oracle Label Security and Security Standards............................................................................... 1-3

Security Policies.................................................................................................................................. 1-3

Access Control.................................................................................................................................... 1-3

Discretionary Access Control.................................................................................................... 1-3

Oracle Label Security.................................................................................................................. 1-3

How Oracle Label Security Works with Discretionary Access Control ............................. 1-4

Oracle Label Security Architecture....................................................................................................... 1-4

Features of Oracle Label Security ......................................................................................................... 1-5

Overview of Oracle Label Security Policy Functionality ............................................................. 1-5

Oracle Enterprise Edition: VPD Technology.................................................................................. 1-6

Oracle Label Security: An Out-of-the-Box VPD ............................................................................ 1-7

Label Policy Features......................................................................................................................... 1-7

Data Labels................................................................................................................................... 1-8

Label Authorizations.................................................................................................................. 1-8

Policy Privileges.......................................................................................................................... 1-9

Policy Enforcement Options...................................................................................................... 1-9

Summary: Four Aspects of Label-Based Row Access............................................................ 1-9

Oracle Label Security Integration with Oracle Internet Directory................................................. 1-9

2 Understanding Data Labels and User Labels

Introduction to Label-Based Security................................................................................................... 2-1

Label Components................................................................................................................................... 2-2

Label Component Definitions and Valid Characters.................................................................... 2-2

Levels................................................................................................................................................... 2-3

Compartments.................................................................................................................................... 2-4

Groups ................................................................................................................................................. 2-6

Industry Examples of Levels, Compartments, and Groups ........................................................ 2-7

Label Syntax and Type ............................................................................................................................ 2-8

How Data Labels and User Labels Work Together............................................................................ 2-9

Administering Labels........................................................................................................................... 2-11

3 Understanding Access Controls and Privileges

Introducing Access Mediation............................................................................................................... 3-1

Understanding Session Label and Row Label.................................................................................... 3-2

The Session Label............................................................................................................................... 3-2

The Row Label.................................................................................................................................... 3-3

Session Label Example ...................................................................................................................... 3-3

Understanding User Authorizations .................................................................................................... 3-4

Authorizations Set by the Administrator ....................................................................................... 3-4

Authorized Levels....................................................................................................................... 3-4

Authorized Compartments ....................................................................................................... 3-5

Authorized Groups..................................................................................................................... 3-6

Computed Session Labels................................................................................................................. 3-7

Evaluating Labels for Access Mediation ............................................................................................. 3-7

Introducing Read/Write Access...................................................................................................... 3-7

Difference Between Read and Write Operations ................................................................... 3-8

Propagation of Read/Write Authorizations on Groups....................................................... 3-8

The Oracle Label Security Algorithm for Read Access ................................................................ 3-9

The Oracle Label Security Algorithm for Write Access............................................................. 3-10

Using Oracle Label Security Privileges ........................................................................................... 3-12

Privileges Defined by Oracle Label Security Policies ........................................................... 3-12

Special Access Privileges ........................................................................................................... 3-12

READ......................................................................................................................................... 3-13

FULL .......................................................................................................................................... 3-13

COMPACCESS......................................................................................................................... 3-13

PROFILE_ACCESS .................................................................................................................. 3-14

Special Row Label Privileges ................................................................................................... 3-15

WRITEUP.................................................................................................................................. 3-15

WRITEDOWN.......................................................................................................................... 3-15

WRITEACROSS........................................................................................................................ 3-15

System Privileges, Object Privileges, and Policy Privileges ..................................................... 3-15

Access Mediation and Views......................................................................................................... 3-16

Access Mediation and Program Unit Execution......................................................................... 3-16

Access Mediation and Policy Enforcement Options.................................................................. 3-17

Working with Multiple Oracle Label Security Policies................................................................. 3-18

Multiple Oracle Label Security Policies in a Single Database .................................................. 3-18

Multiple Oracle Label Security Policies in a Distributed Environment.................................. 3-18

Part II Using Oracle Label Security Functionality

4 Getting Started with Oracle Label Security

Installing OLS and Enabling the LBACSYS User ............................................................................. 4-1

Creating an OLS Policy........................................................................................................................... 4-3

Step 1: Creating the Policy................................................................................................................ 4-4

Step 2: Creating Label Components for the Policy........................................................................ 4-5

Step 3: Creating Data Labels for the Policy.................................................................................... 4-5

Step 4: Authorizing Users for the Policy......................................................................................... 4-6

Step 5: Applying the Policy to a Database Table........................................................................... 4-8

Step 6: Adding Policy Labels to Table Rows.................................................................................. 4-9

Creating a Sample OLS Policy............................................................................................................ 4-10

Step 1: Creating Users for the Oracle Label Security Example................................................. 4-11

Step 2: Creating the ACCESS_LOCATIONS Policy................................................................... 4-12

Step 3: Defining the ACCESS_LOCATIONS Policy-Level Components................................ 4-13

Step 4: Creating the ACCESS_LOCATIONS Policy Data Labels............................................. 4-13

Step 5: Creating the ACCESS_LOCATIONS Policy User Authorizations.............................. 4-14

Step 6: Applying the ACCESS_LOCATIONS Policy to the HR.LOCATIONS Table ........... 4-16

Step 7: Adding Policy Labels to Table Data................................................................................ 4-16

Step 8: Testing the ACCESS_LOCATIONS Policy..................................................................... 4-18

Step 9: Removing the Components for This Example (Optional)............................................ 4-18

5 Working with Labeled Data

The Policy Label Column and Label Tags........................................................................................... 5-1

The Policy Label Column.................................................................................................................. 5-1

Hiding the Policy Label Column.............................................................................................. 5-2

Example 1: Numeric Column Data Type (NUMBER)........................................................... 5-2

Example 2: Numeric Column Data Type with Hidden Column......................................... 5-2

Label Tags ........................................................................................................................................... 5-3

Manually Defining Label Tags to Order Labels..................................................................... 5-3

Manually Defining Label Tags to Manipulate Data .............................................................. 5-4

Automatically Generated Label Tags....................................................................................... 5-4

Assigning Labels to Data Rows............................................................................................................. 5-5

Presenting the Label ................................................................................................................................ 5-5

Converting a Character String to a Label Tag, with CHAR_TO_LABEL.................................. 5-5

Converting a Label Tag to a Character String, with LABEL_TO_CHAR.................................. 5-5

LABEL_TO_CHAR Examples .................................................................................................. 5-6

Retrieving All Columns from a Table When the Policy Label Column Is Hidden........... 5-7

Filtering Data Using Labels.................................................................................................................... 5-7

Using Numeric Label Tags in WHERE Clauses............................................................................ 5-7

Ordering Labeled Data Rows........................................................................................................... 5-8

Ordering by Character Representation of Label............................................................................ 5-8

Determining Upper and Lower Bounds of Labels........................................................................ 5-9

Finding Least Upper Bound with LEAST_UBOUND........................................................... 5-9

Finding Greatest Lower Bound with GREATEST_LBOUND.............................................. 5-9

Merging Labels with the MERGE_LABEL Function ................................................................. 5-10

Inserting Labeled Data......................................................................................................................... 5-11

Inserting Labels Using CHAR_TO_LABEL ................................................................................ 5-12

剩余293页未读，继续阅读

评论收藏

内容反馈

weixin_40191861_zj

粉丝: 63
资源: 1万+

Oracle Label Security Administrator’s Guide 11g Release 2 (11.2)

最新资源

Oracle Label Security Administrator’s Guide 11g Release 2 (11.2)

Oracle Database Administrator’s Reference 11g Release 2 (11.2) f

Oracle Applications System Administrator's Guide - Security

Oracle Database 2 Day + Security Guide 11g Release 2 (11.2) -124

Oracle Database Advanced Security Administrator’s Guide 11g Rele

Oracle® Database Advanced Application Developer's Guide 11g Release 2 (11.2)

Oracle RAC Administration and Deployment Guide 11g Release 2 (11.2)

Oracle Database Administrator's Guide 11g Release 2 (11.2)-1082

Oracle Label Security Administrator’s Guide Release 2 (9.2)

Oracle Database Administrator's Guide 11g Release 2 (11.2)

Oracle Database Security Guide 11g Release 2 (11.2)-444

Oracle Workflow Administrator’s Guide Release 2.6.4

Oracle Linux Administrator's Guide for Release 7.pdf

Oracle Solaris 9 -Administrator’s Guide to Security Sun ONE Appl

Oracle Database Vault Administrator’s Guide 11g Release 2 (11.2)

Oracle Data Mining Administrator's Guide 11g Release 2 (11.2)-86

Oracle Database Installation Guide 11g Release 2 (11.2) for Linux

Oracle® Database Installation Guide 11g Release 2 (11.2) for Linux E47689-08.pdf

Oracle OLAP User's Guide 11g Release 2 (11.2)-182

Oracle Advanced Security Administrator’s Guide Release 8.1.7

Oracle Database Enterprise User Security Administrator’s Guide 1

Oracle Streams Replication Administrator’s Guide 11g Release 2 (

Oracle Database Net Services Administrator's Guide 11g Release 2

Oracle Advanced Security Administrator’s Guide

Oracle Spatial Developer's Guide 11g Release 2 (11.2)-924

Oracle Multimedia User's Guide 11g Release 2 (11.2)-240.pdf

Oracle 11G R2 for WINDOWS(x64) 安装教程

Oracle Spatial GeoRaster Developer's Guide 11g Release 2 (11.2)

Oracle® Call Interface Programmer's Guide 11g Release 2 (11.2)

最新资源