GB/T 20273-2006 in English

《GB/T 20273-2006信息安全技术 数据库管理系统安全技术要求》由TC260（全国网络安全标准化技术委员会）归口，主管部门为国家标准化管理委员会。
本标准规定了各个安全等级的数据库管理系统所需要的安全技术要求。本标准适用于按等级化要求进行的安全数据库管理系统的设计和实现。

1 Scope

This standard specifies the security techniques requirement required for database management system of each security grade according to the classification of five security protection grades in GB 17859-1999 and the role of database management system in information system.
This standard is applicable to the design and realization of security database management system according to the requirements of hierarchization and the test and management of the security of database management system may refer to this standard.

2 Normative References

The following standards contain provisions which, through reference in this standard, constitute provisions of this standard. For dated reference, subsequent amendments to (excluding correction to), or revisions of, any of these publications do not apply. However, the parties to agreements based on this standard are encouraged to investigate the possibility of applying the most recent editions of the standards. For undated references, the latest edition of the normative document referred to applies.
GB 17859-1999 Classified Criteria for Security Protection of Computer Information System
GB/T 20271-2006 Information Security Technology - Common Security Techniques Requirement for Information System

3 Terms, Definitions and Abbreviations

3.1 Terms and Definitions
For the purposes of this standard, the terms and definitions defined in GB 17859-1999 and GB/T 20271-2006 and those listed below apply.
3.1.1
Security of database management system
Characterization of the confidentiality, integrity and availability of the stored, transported and processed information in database management system.
3.1.2
Security technology of database management system
All security technologies required for realizing the security of all kinds of database management systems.
3.1.3
Security subsystem of database management system
A generic term for security protection devices in database management, including hardware, firmware, software and combined entity responsible for executing security policy. It establishes a basic security protection environment of database management system and provides additional user service required by security database management system.
Note: SSODB (security subsystem of database management system) is TCB of database management system according to the definition of TCB (trusted computing base) in GB 17859-1999.
3.1.4
SSODB security policy
A group of rules to manage, protect and distribute SSODB resource. One SSODB may have one or more security policies.
3.1.5
Security function policy
Security policy adopted to realize the function required for SSODB security element.

Foreword I
Introduction I
1 Scope
2 Normative References
3 Terms, Definitions and Abbreviations
3.1 Terms and Definitions
3.2 Abbreviations
4 Basic Requirements for Security Function of Database Management System
4.1 Identity Authentication
4.1.1 User Identification
4.1.2 User Authentication
4.2 Discretionary Access Control
4.2.1 Access Operation
4.2.2 Access Rule
4.2.3 Authorization Propagation Restriction
4.3 Label
4.3.1 Subject Label
4.3.2 Object Label
4.4 Mandatory Access Control
4.4.1 Security Policy of Access Control
4.4.2 Granularity and Characteristic of Access Control
4.5 Data Flow Control
4.6 Security Audit
4.7 User Data Integrity
4.7.1 Body Integrity and Reference Integrity
4.7.2 User Defined Integrity
4.7.3 Integrity of Data Manipulation
4.8 User Data Confidentiality
4.8.1 Stored Data Confidentiality
4.8.2 Transported Data Confidentiality
4.8.3 Object Reuse
4.9 Trusted Path
4.10 Inference Control
5 Graded Requirements for Security Technology of Database Management System
5.1 Grade 1: the User's Discretionary Protection Grade
5.1.1 Security Function
5.1.2 SSODB Self-security Protection
5.1.3 SSODB Design and Realization
5.1.4 SSODB Security Management
5.2 Grade 2: System Audit Protection Grade
5.2.1 Security Function
5.2.2 SSODB Self-security Protection
5.2.3 SSODB Design and Realization
5.2.4 SSODB Security Management
5.3 Grade 3: Security Label Protection Grade
5.3.1 Security function
5.3.2 SSODB Self-security Protection
5.3.3 SSODB Design and Realization
5.3.4 SSODB Security Management
5.4 Grade 4: Structured Protection Grade
5.4.1 Security Function
5.4.2 SSODB Self-security Protection
5.4.3 SSODB Design and Realization
5.4.4 SSODB Security Management Requirements
5.5 Grade 5: Access Verification Protection Grade
5.5.1 Security Function
5.5.2 SSODB Self-security Protection
5.5.3 SSODB Design and Realization
5.5.4 SSODB Security Management
Appendix A (Informative) Explanation of Standard Concept
A.1 Composition and Interrelationship
A.2 Special Requirements for Security of Database Management System
A.3 User Management of Database Management System
A.4 Security of Database Management System
A.5 Classification of Security Protection Grade of Database Management System
A.6 About the Subject and Object of Database Management System
A.7 About SSODB, SSF, SSP, SFP and their Interrelationship
A.8 About Inference Control
A.9 About Encryption Technology and Database Encryption
Bibliography