版次注意事項


7.5 Chapter 5. Controlling Database Access

|Following the section titled "Index Privileges," add the |following section:

|7.5.1 Sequence Privileges

| | |

|The creator of a sequence automatically receives the USAGE privilege. The |USAGE privilege is needed to use NEXTVAL and PREVVAL expressions for the sequence. |To allow other users to use the NEXTVAL and PREVVAL expressions, sequence |privileges must be granted to PUBLIC. This allows all users to use the expressions |with the specified sequence.

|Following the section titled "Monitoring Access to Data Using |the Audit Facility," add the following section:

|7.5.2 Data Encryption

| |

|One part of your security plan may involve encrypting your data. To do |this, you can use encryption and decryption built-in functions: ENCRYPT, |DECRYPT_BIN, DECRYPT_CHAR, and GETHINT. For more information on these |functions, including their syntax, refer to the SQL Reference section of |the Release Notes. |

|The ENCRYPT function encrypts data using a password-based encryption method. |These functions also allow you to encapsulate a password hint. The password |hint is embedded in the encrypted data. Once encrypted, the only way to decrypt |the data is by using the correct password. Developers that choose to use these |functions should plan for the management of forgotten passwords and unusable |data.

|The result of the ENCRYPT functions is the same data type as the first |argument.

|Only VARCHARs can be encrypted.

|The declared length of the result is one of the following: |

|

|The DECRYPT_BIN and DECRYPT_CHAR functions decrypt data using password-based |decryption.

|The result of the DECRYPT_BIN and DECRYPT_CHAR functions is the same |data type as the first argument.

|The declared length of the result is the length of the original data. |

|The GETHINT function returns an encapsulated password hint. A password |hint is a phrase that will help data owners remember passwords. For example, |the word "Ocean" can be used as a hint to remember the password "Pacific".

|The password that is used to encrypt the data is determined in one of two |ways: |

|Valid lengths for passwords are between 6 and 127 inclusive. Valid lengths |for hints are between 0 and 32 inclusive.

|When the ENCRYPTION PASSWORD special register is set from the client, the |password is encrypted at the client, sent to the database server, and then |decrypted. To ensure that the password is not left readable, it is also re-encrypted |at the database server. DECRYPT_BIN and DECRYPT_CHAR functions must |decrypt the special register before use. The value found in the ENCRYPTION |PASSWORD is also not left readable. Gateway security is not supported.


[ 頁面頂端 | 前一頁 | 下一頁 | 目錄 | 索引 ]