12_使用良好的访问控制new

《12_使用良好的访问控制new》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、4623-6ch12.f.qc1/28/0012:29PMPage3271212CHAPTERUsingFine-GrainedAccess✦ ✦ ✦ ✦ControlInThisChapterUsingapplicationsecurityUnderstandingAnexcitingnewOracle8ifeatureistheabilitytoimplementapplicationsecurityrow-levelsecuritywithinthedatabase.Oraclereferstocontextsthisasfine-grainedaccesscontrol.Ita

2、ddressesaproblemthathasplaguedapplicationdevelopersandsecurityadministratorsWritingsecurityeversinceclient/servercomputingcameintovogue.Thepoliciesproblemisthatanimpedancemismatchhasexistedbetweenthetypicalrelationaldatabase’simplementationofsecurityUsingpre-8iattheobjectlevel,andtheapplicationd

3、eveloper’sneedforalternativessecuritytobeimplementedattherowlevel.Foralongtimenow,wehavebeenabletodefineaccessrightstoobjects✦ ✦ ✦ ✦suchastablesorviewsatthedatabaselevel,butrow-levelsecurityhasalmostalwaysbeenforceddownintotheapplication.Oracle8ichangesallthisbyimplementingfeaturesthatsupportfin

4、e-grainedaccesscontrolatthe

5、databaselevel.UsingApplicationSecurityApplicationsecurityislooselydefinedastheenforcementoflimitsonwhataparticularusercandousingagivenapplication.Takeapayrollapplication,forexample.Anypayrollapplicationiscapableofaddingnewemployeestothepayroll,changingpayrates,andsofo

6、rth.Eventhoughallthesefeaturesareavailable,youcertainlydon’twantalluserstoavailthemselvesofthem.Instead,youhavealimitednumberofuserswhoareallowedtoseeandchangesensitivedatasuchasanemployee’spayrate.Youmighthavealargerpoolofuserswith“lookonly”access.Youmayhavefurtherrestrictions;forinstance,amana

7、gerisallowedtoseeonlyhisorherownemployees.Alloftheserestrictionsaretypicallyenforcedthroughsometypeofrow-levelsecurity.4623-6ch12.f.qc1/28/0012:29PMPage328328PartIII✦NutsandBoltsImplementingsecurityintheapplicationHistorically,implementingdetailedsecuritypoliciesatthedatabaselevelhasbeendifficul

8、t.Sometimesyoucandoitusingacombinationofviewsandstoredprocedures,buttheamountofhumanoverheadneededtomanageallthatishigh.Third-partydevelopmenttools,suchasVisualBasicandPowerbuilder,aredesignedaroundusingtablesandviews,making