RU2285948C1 - Method for providing safe user access to oracle databases - Google Patents

Abstract

FIELD: computer science, possible use for engineering means of safe user access to ORACLE databases.

SUBSTANCE: in accordance to method, digital certificates of user are recorded to memory of smart card, on user request for access to databases digital certificate of server is transferred to user terminal and request for reading certificate of user, server certificate authenticity and integrity are checked, in case of positive result one of digital certificates of user is read, electronic digital signature is formed on terminal of user for current digital certificate of user, smart card password is requested, aforementioned digital certificate is transferred to server with electronic digital signature, authenticity and integrity of user digital certificate is checked on server, in case of positive check result electronic digital signature is checked by means of open key, taken from digital certificate, in case of positive result of electronic digital signature check, permission for accessing ORACLE databases is generated.

EFFECT: increased access protection level.

Description

The present invention relates to computer technology and can be used to create means of providing safe user access to ORACLE databases.

Databases are currently the primary means of storing a wide variety of information. Data is stored in a database (DB) along with service information that allows you to organize this data according to certain rules. For example, service information may indicate a certain level of data access that prohibits users who do not have the appropriate authority (unauthorized users) from accessing this data. Databases are typically stored in non-volatile memory devices.

In order for users to access the database, a database management system (DBMS) is used. It is usually implemented on the basis of a computer, such as a personal computer. A DBMS is a set of programs stored in the computer’s memory that allows you to operate with data from the database (which for this computer can be an external device). In a DBMS, the so-called DBMS kernel is allocated, i.e. that part of it, which is constantly stored in a certain area of the main memory of the computer and carries out control functions of the entire DBMS.

When using a DBMS, one of the main tasks is to provide access to data in the database served by this DBMS. In general, access is understood as the procedure for establishing communication with the database and the areas located in it for writing or reading data. In this case, it is necessary to provide for the possibility for an authorized user to freely receive the data for which he has access, and to prohibit an unauthorized user to receive data that is closed to him.

Currently, various data access systems are known.

From international application WO 97/05551 (IPC G 06 F 13/14, 1997), a method is known for providing access to data in a database management system in which the processor of the system stores a set of command primitives that are called for execution only after the corresponding input commands will be checked for correctness and authenticity. These checks are not enough to ensure reliable protection of the database from access to it by unauthorized (unauthorized) persons.

In another method for providing access to data in a database management system known from Japanese Patent Application Laid-Open No. 05-094389 (IPC G 06 F 13/00, 1993), database users are assigned passwords and access rights that are entered in the corresponding table stored in the permanent memory of the system. When contacting a user, the password entered by him is compared with the table one and the corresponding access right of this user to this or that information in the database is determined. This check, however, is not enough to reliably protect data from unauthorized persons accessing it.

Closest to the claimed one is a method of providing access to data in a database management system (DBMS), described in UK application N 2242295, IPC G 06 F 12/14, 1991, which consists in storing the signal assigned to each user in the database the individual identifier and the admission rank signal to the database, generate a user request signal containing the individual user identifier signal and description signals of the requested data, transmit the generated request signal to the core of the system database, read the signal of the rank of admission to the database by an individual identifier signal, read from the database into the core of the database management system according to the signals of descriptions of the requested data contained in the user request signal, the signals corresponding to the signals of the labels of this data characterizing the signals of the access level to partitions , subsections of the database, to the data, as well as to the actions that the user can perform on them, compare the signals of the access level with the signal of the rank of admission to the database s, if the signal of rank tolerance to the database is not lower than the signal level of access to the database partition containing the requested data, permit the issuance of the data signal over the communications channel from the database. Although this method is more reliable than the above, nevertheless, the reliability provided by it to prevent access to the database, in particular to the ORACLE databases, is low by unauthorized persons. This is due to both the small number of checks on the user’s rights to receive data and to perform any actions on them, and the fact that after the positive completion of all checks, the data is issued to the user in full according to his request. In addition, if the signal of the rank of admission to the database does not match the signal of the access level to the requested data, the user is notified about this, thereby indirectly receiving information about at least the existence of data inaccessible to him.

Therefore, the technical task is to create a way to ensure safe user access to ORACLE databases, which would not only be free from the above disadvantages inherent in existing methods of access to databases, but would also increase the level of access protection.

To solve the problem and achieve such a technical result, a method is proposed for ensuring safe user access to ORACLE databases, which consists in writing digital user certificates to the smart card memory, the private keys being written to the protected memory area of the specified card, at the user's request to access the indicated databases from the server side, a digital server certificate and a request to read the user certificate are transmitted to the user terminal they check the server certificate for authenticity and integrity, if the verification result is positive, they read one of the user’s digital certificates from the smart card’s memory, form an electronic digital signature for this user’s digital certificate on the user's terminal with his private key, and to authorize access to the closed the key is asked for the password for the smart card from the user, the specified digital certificate is transmitted from the user’s terminal to the server with an electronic digital signature, Verify the authenticity and integrity of the transmitted digital user certificate on a server having a database of digital certificates of registered users, if the verification result is positive, the electronic digital signature is checked on the server using the public key extracted from the specified digital certificate, and the electronic digital signature is verified on the server form permission for the user to access ORACLE databases.

ORACLE DBMS has built-in capabilities for using digital certificates (a certificate is a sequence that uniquely associates an object identifier with its public key (s) of electronic digital signature and (or) encryption) of X.509 for user authentication (X.509 authentication method is described in book A. Menezes, P. van Oorschot, S. Vanstone. Handbook of Applied Cryptography. CRC Press, NY, 1996, p. 510, 511). For this, digital certificates can be located either in a password-protected file, pkcs # 12 format, or in the built-in certificate store of the Windows 2000 / XP operating system. In both cases, digital certificates along with private keys are managed by the Windows operating system, which, on the one hand, does not provide for the mobility of using digital certificates, and on the other hand, does not provide reliable protection for private keys. The invention allows the use of digital certificates installed on smart cards, while the private keys are located in the protected memory of the smart card and cannot be exported.

To use the invention, an ORACLE user must be configured to use SSL authentication. The following parameters are specified in the sqlnet.ora configuration file: WALLET LOCATION = (SOURCE = (METHOD = MCS)).

This means that to authenticate the user using X.509 digital certificates, the ORACLE user will access the built-in digital certificate store of the Windows operating system. At the same time, for each certificate found, the ORACLE user checks the name of the corresponding cryptographic provider. If the name of the cryptographic provider for the digital certificate matches "Microsoft Enhanced CSP" and the digital certificate does not have the "Smart Cart Logon (1.3.6.1.4.1.311.20.2.2)" extended property, then the ORACLE user starts using this certificate for authentication.

Digital certificates installed on smart cards in the Windows operating system are also presented in the built-in certificate store of the operating system. However, since these certificates are associated with another cryptographic provider, the ORACLE user does not use them to authenticate users.

In order to be able to use the digital certificates installed on smart cards for authentication in ORACLE, it is necessary to intercept ORACLE user’s calls to the functions that determine the name of the corresponding cryptographic provider and for digital certificates installed on smart cards, dynamically change its name to the name "Microsoft Enhanced CSP ".

When a user requests access to these databases from the server side, a digital server certificate (cryptographic provider) and a request to read the user certificate are transmitted to the user terminal.

The server certificate is checked for authenticity and integrity; if the verification result is positive, one of the user's digital certificates is read from the smart card memory.

An electronic digital signature for this user’s digital certificate is generated on the user’s terminal using his private key, and for this, to authorize access to the private key, they ask the user for a smart card password. Known methods for forming EDS are described, for example, in the book Romanets Yu.V., Timofeev P.A., Shangin V.F. Information security in computer systems and networks. / Ed. V.F.Shangina. - M.: Radio and Communications, 1999, pp. 162-171.

The specified digital certificate with electronic digital signature is transmitted from the user terminal to the server. Known methods for transmitting sequences over communication channels with errors are described, for example, in the book by A. Zyuko, D. Klovsky, M. Nazarov, L. Fink. Theory of signal transmission. M .: Radio and communications, 1986, p. 11.

Verify on the server that has a database of digital certificates of registered users, the authenticity and integrity of the transmitted digital user certificate. Known methods for verifying a certificate and extracting an EDS public key from it are described, for example, in the book A.Menezes, P.van Oorschot, S. Vanstone. Handbook of Applied Cryptography. CRC Press, N.Y., 1996, p. 560. If the verification result is positive, the electronic digital signature is checked on the server using the public key extracted from the specified digital certificate. Known methods for checking EDS are described, for example, in the book Romanets Yu.V., Timofeev P.A., Shangin V.F. Information security in computer systems and networks. / Ed. V.F.Shangina. - M.: Radio and Communications, 1999, pp. 162-171.

With a positive result of the verification of the electronic digital signature on the server, a permission is formed for the user to access the ORACLE databases.

The implementation of the method is based on system-wide principles of logical and physical implementation of hardware and software, protocols and interfaces, as well as the construction of telecommunication networks.

Claims (1)

The way to ensure safe user access to ORACLE databases, which consists in writing digital user certificates to the smart card memory, the private keys being written to the protected memory area of the specified card, when the user requests access to the specified databases from the server side to the user terminal, a digital server certificate and a request to read the user certificate, check the server certificate for authenticity and integrity, if the result is positive, check and they read one of the user’s digital certificates from the smart card’s memory, form an electronic digital signature for the given user’s digital certificate on the user’s terminal using his private key, and, for authorization of access to the private key, they ask the user for a smart card password, transmit from the user terminal to the server, the specified digital certificate with electronic digital signature is checked on a server having a database of digital certificates of registered users In case of a positive verification result, they verify the electronic digital signature on the server using the public key extracted from the specified digital certificate; if the electronic digital signature verification result is positive on the server, they create a permission for the user to access ORACLE databases .