Part No. A96578-01 Oracle Label Security Administr

OracleLabelSecurityAdministrator’sGuideRelease2(9.2)March2002PartNo.A96578-01OracleLabelSecurityAdministrator’sGuide,Release2(9.2)PartNo.A96578-01Copyright©2000,2002OracleCorporation.Allrightsreserved.Author:JeffLevingerContributingAuthor:RitaMoranContributors:PaulNeedham,RaeBurns,GaryMurphy,PatrickSack,VikramPesati,ShiuWong,RamprasadSripada,KrishnamurthyRaghuraman,DouglasKemp,SrvidyaTataGraphicDesigner:ValarieMooreThePrograms(whichincludeboththesoftwareanddocumentation)containproprietaryinformationofOracleCorporation;theyareprovidedunderalicenseagreementcontainingrestrictionsonuseanddisclosureandarealsoprotectedbycopyright,patentandotherintellectualandindustrialpropertylaws.Reverseengineering,disassemblyordecompilationofthePrograms,excepttotheextentrequiredtoobtaininteroperabilitywithotherindependentlycreatedsoftwareorasspecifiedbylaw,isprohibited.Theinformationcontainedinthisdocumentissubjecttochangewithoutnotice.Ifyoufindanyproblemsinthedocumentation,pleasereportthemtousinwriting.OracleCorporationdoesnotwarrantthatthisdocumentiserror-free.ExceptasmaybeexpresslypermittedinyourlicenseagreementforthesePrograms,nopartoftheseProgramsmaybereproducedortransmittedinanyformorbyanymeans,electronicormechanical,foranypurpose,withouttheexpresswrittenpermissionofOracleCorporation.IftheProgramsaredeliveredtotheU.S.GovernmentoranyonelicensingorusingtheprogramsonbehalfoftheU.S.Government,thefollowingnoticeisapplicable:RestrictedRightsNoticeProgramsdeliveredsubjecttotheDODFARSupplementarecommercialcomputersoftwareanduse,duplication,anddisclosureofthePrograms,includingdocumentation,shallbesubjecttothelicensingrestrictionssetforthintheapplicableOraclelicenseagreement.Otherwise,ProgramsdeliveredsubjecttotheFederalAcquisitionRegulationsarerestrictedcomputersoftwareanduse,duplication,anddisclosureoftheProgramsshallbesubjecttotherestrictionsinFAR52.227-19,CommercialComputerSoftware-RestrictedRights(June,1987).OracleCorporation,500OracleParkway,RedwoodCity,CA94065.TheProgramsarenotintendedforuseinanynuclear,aviation,masstransit,medical,orotherinherentlydangerousapplications.Itshallbethelicensee'sresponsibilitytotakeallappropriatefail-safe,backup,redundancy,andothermeasurestoensurethesafeuseofsuchapplicationsiftheProgramsareusedforsuchpurposes,andOracleCorporationdisclaimsliabilityforanydamagescausedbysuchuseofthePrograms.Oracleisaregisteredtrademark,andOracle8i,Oracle9i,OracleStore,PL/SQL,andSQL*PlusaretrademarksorregisteredtrademarksofOracleCorporation.Othernamesmaybetrademarksoftheirrespectiveowners.iiiContentsSendUsYourComments................................................................................................................xviiPreface..........................................................................................................................................................xixAudience................................................................................................................................................xxOrganization..........................................................................................................................................xxRelatedDocumentation.....................................................................................................................xxiiConventions........................................................................................................................................xxiiiDocumentationAccessibility...........................................................................................................xxvi1IntroductiontoOracleLabelSecurityComputerSecurityandDataAccessControls..............................................................................1-2IntroductiontoComputerSecurity............................................................................................1-2OracleLabelSecurityandSecurityStandards.........................................................................1-3SecurityPolicies............................................................................................................................1-3AccessControl...............................................................................................................................1-4DiscretionaryAccessControl..............................................................................................1-4Label-BasedAccessControl.................................................................................................1-5HowLabel-BasedAccessControlWorkswithDiscretionaryAccessControl.............1-5OracleLabelSecurityArchitecture.................................................................................................1-6Oracle9iEnterpriseEdition:VirtualPrivateDatabaseTechnology......................................1-6OracleLabelSecurity:AnOut-of-the-BoxVPDPolicy...........................................................1-7FeaturesofOracleLabelSecurity..............................................................