As onew816a
0 likes254 views
The document summarizes new security features in Oracle Advanced Security for Oracle8i Release 8.1.6, including enhancements to encryption, authentication, authorization, and single sign-on. It provides stronger encryption algorithms, secures additional protocols like IIOP and JDBC, and adds support for SSL-based single sign-on and integration with directory services and PKI solutions like Entrust for centralized user management across databases.
As onew816a
- 1. Oracle Advanced Security New Features Oracle8i Release 8.1.6 Features Overview November 1999 INTRODUCTION Oracle Advanced Security is part of Oracle8i Release 8.1.6, the first maintenance release of the Oracle8i database, which includes feature enhancements, bug fixes, and performance improvements. The release also includes several new, critical security features that are noteworthy. The Oracle8i Release 8.1.6 version of Oracle Advanced Security provides enhancements in the areas of encryption, authentication and authorization, as well as single sign-on and enterprise user management. ORACLE ADVANCED SECURITY ENHANCEMENTS Oracle Advanced Security provides new forms of network encryption, to ensure the security of all protocols accessing the Oracle8i database, as well as enhanced integration with directory services for authorization and enhanced single sign-on. Oracle Advanced Security also has enhanced configuration and management tools to simplify security management. NETWORK SECURITY ENHANCEMENTS The Oracle8i Release 8.1.6 version of Oracle Advanced Security enhances Oracle’s support for the Secure Sockets Layer (SSL) standard and now secures connections to the RDBMS via additional protocols. SSL encryption for Internet Intra-ORB Protocol (IIOP) communications is now available, enabling secure Enterprise JavaBean (EJB) connections to the RDBMS. In addition, a
- 2. Java implementation of the Oracle Advanced Security encryption libraries is now available to secure Thin Java Database Connectivity (JDBC) client connections to the Oracle RDBMS. Oracle Advanced Security Thin JDBC support provides DES and RC4 encryption, with anonymous Diffie-Hellman key exchange, and MD5 integrity checking, in 100% Java, as the Thin JDBC driver is designed for use with downloadable applets used over the Internet. Secure Thin JDBC support allows developers to build applets that transmit data over a secure communication channel, secures connections from middle tier servers with Java Server Pages (JSP) to the Oracle RDBMS, and secures connections from Oracle8i databases to older versions of Oracle Advanced Security-enabled databases. Oracle Advanced Security thus secures all protocols into the Oracle8i database, whether IIOP, Thick JDBC, Thin JDBC, or Net8. Encryption Changes Oracle Advanced Security has also completed the operational testing phase of Federal Information Processing Standard (FIPS) 140-1 Level 2 certification, a United States government standard that validates the security of cryptographic products. Completion of the FIPS-140 certification, which is expected in Q4 1999, is required by numerous security-aware organizations, among them the United States federal government and many financial markets. Due to export controls placed on encryption technology, Oracle Advanced Security is available in a domestic version and an export version. Recent modifications to U.S. government export laws allow Oracle Corporation to ship both 40-bit and 56-bit encryption algorithms in the Export Edition of Oracle Advanced Security, supplying stronger encryption to organizations around the world. Additionally, international banks, subsidiaries of U.S. corporations, and e-commerce vendors can obtain a special license to obtain the domestic version with 128-bit and Triple-DES encryption.
- 3. SINGLE SIGN-ON Single sign-on enhances ease of use and simplifies user administration. Oracle Advanced Security already supports many forms of single sign-on for database users, among them Kerberos, CyberSafe, SESAME, and the Distributed Computing Environment (DCE). Oracle8i Release 8.1.6 adds support for SSL-based single sign-on. PKI Credential Management Oracle Wallet Manager provides secure management of PKI-based (Public Key Infrastructure) user credentials. Oracle Wallet Manager creates a private and public key pair for a user, and issues a PKCS#10 certificate signing request which can be fulfilled by a Certificate Authority (CA). After the CA issues an X.509 certificate, the user can load the certificate into his wallet. Oracle Wallet Manager also manages trusted certificates, the root certificates that the user trusts, and is pre-configured with root certificates from PKI vendors such as VeriSign and GTE. Wallets are protected using password-based, strong encryption. In most cases, a user never needs to access a wallet once it has been configured, but can easily access his wallet using Oracle Enterprise Login Assistant, an easy-to-use login tool that hides the complexity of a private key and certificate from users. Users can then connect to multiple databases over SSL, without providing additional passwords. This provides the benefit of strong, certificate-based authentication as well as single sign-on. SSL for single sign-on now can be used alone, in the absence of a directory server for X.509v3 certificate-based authentication, or in conjunction with enterprise user management, which is described below. ENTERPRISE USER MANAGEMENT Enterprises today face tremendous challenges in managing information about users, keeping user information current, and securing access to all the information in an enterprise. Each user may have multiple accounts on different databases, requiring her to remember passwords for each of
- 4. these accounts. Not only do users have too many passwords, but there are also too many accounts for administrators to manage. Furthermore, the lack of centralization is a security risk, as old or unused accounts and privileges can be misused. To address these challenges, Oracle8i Release 8.1.6 introduces enterprise user management. Using Oracle Enterprise Security Manager, a tool accessible through Oracle Enterprise Manager, enterprise users and their authorizations are managed in Oracle Internet Directory, an LDAP-based (Lightweight Directory Access Protocol) directory service. Enterprise users can be assigned enterprise roles (which are containers of database-specific global roles), that determine their access privileges in databases. For example, the enterprise role CLERK could contain the global role HRCLERK on the Human Resources database, and the global role ANALYST on the Payroll database. An enterprise role can be granted or revoked to one or more enterprise users. For example, an administrator could grant the enterprise role CLERK to a number of enterprise users who hold the same job. This information about users and roles is protected in the directory through Access Control Lists (ACLs), ensuring that only a privileged administrator can manage users, and grant and revoke roles. USER/SCHEMA SEPARATION In general, users do not need their own accounts - or their own schemas - in a database, they merely need to access an application schema. For example, users Joe, Pam and Steve are all users of the Payroll application, and they need access to the Payroll schema on the Finance database. None of them needs to create his or her own objects in the database; in fact, they need only access Payroll objects. Oracle8i Release 8.1.6 allows the separation of users from schemas, so that many enterprise users can access a single, shared application schema. Instead of creating a user account (that is, a user schema) in each database a user needs to access, administrators only need to create an enterprise user in the directory, and “point” the user at a shared schema which many other enterprise users can also access. For example, if Joe, Pam and Steve all access the Sales database, you need only
- 5. create a single schema, e.g. ‘sales_application,’ which all three users can access, rather than create an account for each user on the Sales database. Now you can truly create an enterprise user once, in the directory, who nonetheless can access multiple databases using only the privileges she needs to perform her job, thus lowering the cost of managing users in an enterprise. Directory Integration An Oracle Advanced Security license provides the use of Oracle Internet Directory, Oracle’s LDAP version 3-compliant directory server, to store and manage users and their authorizations. Oracle Advanced Security thus supports “off-the-shelf” enterprise user management with Oracle Internet Directory, which is fully integrated with Oracle8i. Additionally, Oracle plans to certify integration with other LDAP directories, including Novell Directory Service (NDS) and Microsoft’s Active Directory for Windows 2000, to operate with Oracle8i. ENTRUST INTEGRATION Entrust Technologies, Inc. is a market-leading provider of Public Key Infrastructure solutions, through their Entrust/PKI software. Entrust/PKI includes many products, such as Entrust Profile, which secures users’ PKI credentials, and Entrust Authority, Entrust’s certificate authority product. Oracle is making specific product modifications to Oracle Advanced Security to enable customers of both Oracle and Entrust to incorporate Entrust-based single sign-on into their Oracle applications. By integrating with Entrust/PKI, Oracle enhances its ability to provide X.509-based single sign-on to large customers who require the extensive key management, certificate revocation, and other features which Entrust provides. Oracle will implement support for Entrust/PKI in Oracle8i Release 8.1.6 version of Oracle Advanced Security, enabling customers to use Entrust Profile, Entrust’s “wallet” mechanism, for storage of certificate and private keys, and for secure credential management. Instead of accessing
- 6. user credentials (private key and certificate) from an Oracle wallet, Oracle Advanced Security accesses a user’s Entrust Profile for authentication and single sign-on. Entrust integration will require both Oracle8i Release 8.1.6 with Oracle Advanced Security and Entrust Authority 5. Production use of this feature will be available shortly after general availability of Oracle Advanced Security in Oracle8i Release 8.1.6.
- 7. ORACLE ADVANCED SECURITY NEW FEATURES ORACLE8I RELEASE 8.1.6 Network Security · Single sign-on over SSL · SSL for IIOP · Thin JDBC security · Stronger encryption available internationally · FIPS-140 Level 2 certification (in-process) User Management · Enterprise user management with LDAP directories · Schema-independent users · Oracle Enterprise Security Manager Single Sign-On · Single sign-on over SSL · Oracle Enterprise Login Assistant · Oracle Wallet Manager · Entrust/PKI integration
- 8. Oracle Corporation World Headquarters 500 Oracle Parkway Redwood Shores, CA 94065 U.S.A. Worldwide Inquiries: +1.650.506.7000 Fax +1.650.506.7200 http://www.oracle.com/ Copyright © Oracle Corporation 1999 All Rights Reserved This document is provided for informational purposes only, and the information herein is subject to change without notice. Please report any errors herein to Oracle Corporation. Oracle Corporation does not provide any warranties covering and specifically disclaims any liability in connection with this document. Oracle is a registered trademark, and Oracle8i, Oracle8i Enterprise Edition, Oracle8i Personal Edition, Oracle8i Lite, Net8, and PL/SQL are trademarks of Oracle Corporation. All other company and product names mentioned are used for identification purposes only and may be trademarks of their respective owners.