Identification And Authorization On Network Database Security

The thesis introduce the base of network database security, which includes modern cryptology and database security, and introduce principle of fingerprint characteristic in identity identification. The thesis emphasize further research on both identity identification and authorization access based on role access control. A new identity identification protocol and a new method of access authorization are presented. Identity identification protocol, which is union of confidential information and fingerprint characteristic, is a kind of new identity identification protocol used to request sensitive information to database . Extending the protocol can achieve the security of communication data. Mapping table of user and role is established through their relevance, and authorizing table of role and table is obtained in terms of map relevance among role, database, database table. By the role's flag number, certification server dynamically applies different secure identification technique to give identification to users, and gives authorization decision according to result of identification. The method realizes authorization through program, and is not dependent on concrete database. New method of log records is achieved by integrating log records of application server into log records of database. Private key in client is stored in the file encrypted by salt and password algorithm, and the method of private key storage is both secure and convenient. At last, the foregoing function modules are applied to the Security Database Manage System, and the design and realization of these modules are introduced in detail in the system. The system can enhance security of database which has C2 class security, and it does not depend on any specific database. It can be combined with security function of specific database, and can provide functions such as identity identification, role authorization, log records and communication encryption. The protocol and the project, which the thesis present, can safeguard security of network database fully and freely.