GB/T 20273-2019Information security technology—Security technical requirements for database management system (English PDF)

3.1 Terms and Definitions

Terms and definitions defined in GB/T 25069-2010, GB/T 18336.1-2015 and GB/T 28821-2012 are applicable to this document.

3.2 Abbreviations

The following abbreviations are applicable to this document.

ACID. Atomicity, Consistency, Isolation and Durability

CM. Configuration Management

DBMS. Database Management System

EAL. Evaluation Assurance Level

IT. Information Technology

JDBC. Java DataBase Connectivity

LBAC. Label Based Access Control

ODBC. Open Database Connectivity

PP. Protection Profile

RDBMS. Relational DataBase Management System

SFP. Security Function Policy

SFR. Security Functional Requirements

SQL. Structured Query Language

4.1 An Overview of Evaluation Target

In this Standard, target of evaluation (TOE) refers to management software and database object that it manages included in the database management system (DBMS).

4.2 Security Features of Evaluation Target

DBMS provides multiple security control measures to guarantee its management data asset security. TOE security features may be directly provided by DBMS itself, or, indirectly supported by the information technology (IT) environment of DBMS operation.

4.3 Evaluation Target Deployment Mode

If any internal and external entity of DBMS needs to obtain data assets of TOE management, firstly, it shall satisfy corresponding security policies of TOE and the operating environment.

5.1 Data Assets

Data assets that need to be protected by DBMS include:

5.2 Threats

5.2.1 Overview

TOE is confronted with security threats, such as: excessive or legitimate abuse of privileges; exploited software vulnerabilities and potential application security attacks (such as: SQL injection, denial of service and elevation of privileges, etc.). Table 1 provides different threats confronting evaluation assurance level (EAL) of DBMS: EAL2, EAL3 and EAL4.

5.2.9 Masqueraded authorized user (T.MASQUERADE)

Malicious user or process might masquerade as authorized administrator or authorized user to access database dictionary, system security configuration parameters or data assets protected by DBMS.

5.2.10 Flawed test (T.POOR_TEST)

Development or testing personnel's unthorough test of TOE (including database security options and supporting environment), which leads to undetected TOE weaknesses (logic errors). Malicious user might take advantage of these unknown loopholes to attack TOE.

5.2.11 Residual data usage (T.RESIDUAL_DATA)

Malicious user or process might utilize flaws in the processing of database instance shared cache or residual data on the disk; take advantage of residual data that is not deleted during the execution of database instance, so as to obtain sensitive information or abuse the security functions of TOE.

5.3 Organization Security Policy

5.4 Hypotheses

5.4.1 Overview

In accordance with the security objectives of DBMS, continuously identify more hypotheses. ST author extends evaluation assurance level (EAL) of DBMS: EAL2, EAL3 and EAL4 listed in Table 3.

5.4.2 Directory server protection (A.DIR_PROTECTION)

Directory server (for example, LDAP) that TOE adopts can defend against unauthorized access to TSF data that is stored in the directory, including […]

6.1 TOE Security Objectives

6.1.1 Overview

The security objectives defined in this Standard may be explicitly traced back to TOE-related threats or organization security policies. Table 4 provides TOE security objectives of evaluation assurance level (EAL) of DBMS: EAL2, EAL3 and EAL4.

6.1.4 Administrator guidance (O.ADMIN_GUIDANCE)

6.1.7 Audit data protection (O.AUDIT_PROTECTION)

TOE shall have the capability of securely storing audit data and protecting audit events being stored.

6.1.8 Available database service (O.AVAIL)

TOE shall provide data recovery mechanism for affairs, database instance and storage medium failures; provide the capability of self-maintenance of database storage structure in DBMS updates; guarantee the restorability of TOE management data assets.

6.1.9 Configuration identification (O.CONFIG)

TOE shall identify product component configuration and evaluation configuration items of its documents, so as to provide methods of correcting and tracing them when DBMS is re-distributed and correction errors are corrected.

6.2 Environment Security Objectives

6.2.4 Operating environment management (OE.CONFIG)

6.2.5 Directory access control protection (OE.DIR_CONTROL)

DBMS operating environment that supports directory service (for example, LDAP server) shall provide mechanisms like user identification, identity authentication and access control, so as to prevent illegal user from accessing TSF data stored under the directory service.

6.2.6 IT domain separation (OE.DOMAIN_SEPARATION)

TOE operating environment under distributed deployment shall provide TOE operation nodes with one separable security execution domain. Communication among different DBMS nodes shall be conducted through a secure mode.

6.2.7 Administrator Integrity (OE.NO_HARM)

Organization that adopts TOE shall guarantee that authorized administrator is trustworthy, well-trained, and can comply with organization security policy and relevant database administrator guidance.

6.2.8 Exclusive for database server (OE.NO_GENERAL_PURPOSE)

Apart from providing necessary service components for TOE operation, management and support, database server shall not have computation or storage functional components (for example, compiler, editor or application program) that are irrelevant with database instance operation.

7.1 Extension Component Definition

7.2 Requirements of Security Function

7.2.1 Overview

Table 7 lists TOE security functional components of evaluation assurance level (EAL) of DBMS: EAL2, EAL3 and EAL4. In the description of security functional component elements, in square brackets [], bold font signifies already completed operations; bold italics signifies assignment and options that still need to be determined by ST author in the security objectives.

7.2.2.4 Restriction of audit review (FAU_SAR.2)

FAU_SAR.2.1 authorizes specific permission of reading and accessing audit data to authorized administrator. Apart from this, TSF shall prohibit all the authorized users from reading or accessing audit record.

7.2.2.5 Optional audit review (FAU_SAR.3)

FAU_SAR.3.1 TSF shall provide the capability of [searching and sequencing] reviewed audit data in accordance with [searching and classification conditions of the value in audit data field].

7.2.3 Cryptographic support (Type-FCS)

7.2.5 Identification and authentication (Type-FIA)

7.2.5.1 Authentication failure processing (FIA_AFL.1)

FIA_AFL.1.1 TSF shall detect [assignment: log in DBMS user] command policy [option: [number of authentication attempts, command expiration, number of command reuses, [assignment: range of acceptable value]] that does not satisfy authorized administrator's definition; process unsuccessful authentication attempts related with [option: authorized user authentication, authorized administrator authentication, [assignment: list of other authentication events]].

7.2.5.2 User attribute definition (FIA_ATD.1)

FIA_ATD.1.1 TSF shall maintain the following security attributes that belong to each database user:

7.2.6 Security management (Type-FMT)

7.2.7 TSF protection (Type-FPT)

7.2.8 Resource utilization (Type-FRU)

7.2.9 TOE access (Type-FTA)

7.3 Requirements of Security Assurance

8.1 Fundamental Principle of Security Objectives

8.1.1 Overview

Each threat, organization security policy and hypothesis shall at least have one or more than one corresponding security objective, so as to guarantee that the solution to security issue is complete. Undoubtedly, there is no security objective that has no corresponding threat, […]

8.1.2 Security objectives corresponding with threats

Table 10 suggests that TOE security objectives can cope with all the possible threats.

8.1.4 Security objectives corresponding with hypotheses

Table 13 suggests hypotheses that TOE and its operation security objectives can cope with.

8.2 Fundamental Principle of Security Requirements

8.2.2 Security functional components

Table 14 demonstrates that each security functional component requirement of TOE at least solves one security objective of TOE.

8.3 Component Dependency

When PP/ST author is selecting security functional components and security assurance components in accordance with GB/T 18336, the mutual dependency among the selected components shall be satisfied. […]