9 Integrating Oracle Database Vault with Other Oracle Products

9.4.1 How Oracle Database Vault Is Integrated with Oracle Label Security

When you integrate Oracle Database Vault with Oracle Label Security, it means that you can assign an Oracle Label Security label to an Oracle Database Vault factor identity.

In Oracle Label Security, you can restrict access to records in database tables or PL/SQL programs. For example, Mary may be able to see data protected by the HIGHLY SENSITIVE label, an Oracle Label Security label on the EMPLOYEE table that includes records that should have access limited to certain managers. Another label can be PUBLIC, which allows more open access to this data.

In Oracle Database Vault, you can create a factor called Network, for the network on which the database session originates, with the following identities:

• Intranet: Used for when an employee is working on site within the intranet for your company.

• Remote: Used for when the employee is working at home from a VPN connection.

You then assign a maximum session label to both. For example:

• Assign the Intranet identity to the HIGHLY SENSITIVE Oracle Label Security label.

• Assign the Remote identity to the PUBLIC label.

This means that when Mary is working at home using her VPN connection, she has access only to the limited table data protected under the PUBLIC identity. But when she is in the office, she has access to the HIGHLY SENSITIVE data, because she is using the Intranet identity. "Example of Integrating Oracle Database Vault with Oracle Label Security" provides an example of how to accomplish this type of integration.

You can audit the integration with Oracle Label Security by using the Label Security Integration Audit Report. See "Label Security Integration Audit Report" for more information.

You can use the Oracle Database Vault APIs to integrate Oracle Database Vault with Oracle Label Security. See Appendix E, "Oracle Database Vault DVSYS.DBMS_MACADM Package" for more information.

For more information about Oracle Label Security labels, levels, and policies, see Oracle Label Security Administrator's Guide.

You can run reports on the Oracle Database Vault and Oracle Label Security integration. See "Related Reports" for more information.

9.4.2 Requirements for Using Oracle Database Vault with Oracle Label Security

You must have the following requirements in place before you use Oracle Database Vault with Oracle Label Security:

• Oracle Label Security is licensed separately. Make sure you have purchased a license to use it.

• Before you install Oracle Database Vault, you must have already installed Oracle Label Security.

• Ensure that you have the appropriate Oracle Label Security policies defined. For more information, see Oracle Label Security Administrator's Guide.

9.4.3 Using an Oracle Database Vault Factor with an Oracle Label Security Policy

Oracle Database Vault controls the maximum security clearance for a database session by merging the maximum allowable data for each label in a database session by merging the labels of Oracle Database Vault factors that are associated to an Oracle Label Security policy. In brief, a label acts as an identifier for the access privileges of a database table row. A policy is a name associated with the labels, rules, and authorizations that govern access to table rows. See Oracle Label Security Administrator's Guide for more information about row labels and policies.

Use the following steps to define factors that contribute to the maximum allowable data label of an Oracle Label Security policy:

1. Log in to Oracle Database Vault Administrator using a database account that has been granted the DV_OWNER role.

   At a minimum, you must have the DV_ADMIN role. "Starting Oracle Database Vault Administrator" explains how to log in.

2. Make the user LBACSYS account an owner of the realm that contains the schema to which a label security policy has been applied.

   This enables the LBACSYS account to have access to all the protected data in the realm, so that it can properly classify the data.

   The LBACSYS account is created in Oracle Label Security using the Oracle Universal Installer custom installation option. Before you can create an Oracle Label Security policy for use with Oracle Database Vault, you must make LBACSYS an owner for the realm you plan to use. See "Defining Realm Authorization" for more information.

3. In the Administration page, under Database Vault Feature Administration, click Label Security Integration.

4. In the Label Security Policies page:

   • To register a new label security policy, click Create.

   • To edit an existing label security policy, select it from the list and then click Edit.

5. Enter the following settings and then click OK:

   • General

   • Label Security Policy Factors

General

Under General, enter the following settings:

• Label Security Policy: From the list, select the Oracle Label Security policy that you want to use.

• Algorithm: Optionally change the label-merging algorithm for cases when Oracle Label Security has merged two labels. In most cases, you may want to select LII - Minimum Level/Intersection/Intersection. This setting is the most commonly used method that Oracle Label Security administrators use when they want to merge two labels. This setting provides optimum flexibility when your applications need to determine the resulting label that is required when combining two data sets that have different labels. It is also necessary for situations in which you need to perform queries using joins on rows with different data labels.

  For more information on these label-merging algorithms, see Oracle Label Security Administrator's Guide. If you want to use the DVSYS.DBMS_MACADM package to specify a merge algorithm, see Table E-62, "Merge Algorithm Codes" for a full listing of possible merge algorithms.

• Label for Initialization Errors: Optionally enter a label for initialization errors. The label specified for initialization errors is set when a configuration error or run-time error occurs during session initialization. You can use this setting to assign the session a data label that prevents access or updates to any data the policy protects until the issue is resolved.

Label Security Policy Factors

To select a factor to associate with an Oracle Label Security policy:

1. In the Available Factors list under Label Security Policy Factors, select the factor that you want to associate with the Oracle Label Security policy.

2. Click Move to move the factor to the Selected Factors list.

   Note:

   You can select multiple factors by holding down the Ctrl key as you click each factor that you want to select.

After you associate a factor with an Oracle Label Security policy, you can label the factor identities using the labels for the policy. "Adding an Identity to a Factor" provides detailed information.

9.4.4 Example of Integrating Oracle Database Vault with Oracle Label Security

You can use Oracle Database Vault factors in conjunction with Oracle Label Security and Oracle Virtual Private Database (VPD) technology to restrict access to sensitive data. You can restrict this data so that it is only exposed to a database session when the correct combination of factors exists, defined by the security administrator, for any given database session.

To demonstrate how you can integrate Oracle Database Vault with Oracle Label Security, assume that you must create the following access controls for your company:

• Allow access to sensitive accounting data to database sessions that originate from the corporate Intranet

• Prevent access to this data to database sessions that originate over the corporate VPN network

To do so, you can create a factor named Network, whose identity values are Intranet and Remote. These values are resolved based on values of a second factor, Client_IP, which stores the IP address of the computer making the connection. Because of the interdependency of the two factors, the Network factor is considered a parent factor and the Client_IP factor is its child factor. You establish this interdependency by creating an identity map. Then finally, you associate an Oracle Label Security label with the Intranet and Remote identities in Network.

To accomplish this, follow these steps:

• Step 1: Create the Network Factor

• Step 2: Create Identity Maps for the Network Intranet and Remote Identities

• Step 3: Associate the Network Factor with an Oracle Label Security Policy

• Step 4: Test the Configuration

SQL> SELECT dvf.f$network FROM dual 
-----------------------------------------------
Remote

SQL> SELECT COUNT(*) FROM HR.EMPLOYEES;
----------------------------------------------------------------------------
350
 
SQL> SELECT DVF.F$NETWORK FROM DUAL;
 
F$NETWORK
----------------------------------------------------------------------------
Intranet

SQL> SELECT COUNT(*) FROM HR.EMPLOYEES;
 
COUNT(*)
----------------------------------------------------------------------------
200
 
SQL> SELECT DVF.F$NETWORK FROM DUAL;

F$NETWORK
----------------------------------------------------------------------------
Remote

9.4.5 Related Reports

Table 9-2 lists Oracle Database Vault reports that are useful for analyzing the Oracle Database Vault and Oracle Label Security integration. See Chapter 11, "Oracle Database Vault Reports" for information about how to run these reports.