DB2 UDB for z/OS Version 8 Performance Topics - IBM Redbooks

Multilevel security with row-level granularity
In this combination, DB2 grants are used for authorization at the DB2 object level (database,
table, and so forth). Multilevel security is implemented only at the row level within DB2.
External security is used only by multilevel security itself issuing the RACROUTE. This is the
configuration on which we focus for the remainder of this section.
Multilevel security at the object level with external access control
In this combination, external access control, such as the RACF access control module, is
used for authorization at the DB2 object level. In addition, you can now define a proper
hierarchy of security labels for DB2 objects. For example, a database can be defined with a
higher security label than its table spaces. The RACF access control module has been
enhanced to use security labels to perform access checking on DB2 objects as part of
multilevel security.
Multilevel security with row level granularity with external access control
This option combines both options mentioned above. It uses multilevel security to control the
access to the DB2 objects, as well as multilevel security (SECLABELs) to control access at
the row level within DB2.
In the following sections we describe some of the concepts of multilevel security. Multilevel
security is complex and describing the details of it is beyond the scope of this publication. For
more information, refer to the z/OS Security Server publications. An introduction can be found
in z/OS Planning for Multilevel Security and Common Criteria, SA22-7509.
Security label: SECLABEL
A security label (SECLABEL) is defined for each object which defines the sensitivity of that
object. This security label indicates the hierarchical level or classification of the information
(such as top secret, confidential or general-use), as well as indicates to which
non-hierarchical category the information belongs within that level (such as group ABC or
group XYZ).
In RACF you must define two profiles in the RACF SECDATA resource class; one to define
the security levels (SECLEVEL profiles) and the other to define the security categories
(CATEGORY profile) for the system.
Security level: SECLEVEL
The hierarchical security level (SECLEVEL) defines the degree of sensitivity of the data. In
the following example, security level, “L0” is defined to be a security level 10. The security
administrator can define up to 254 security levels.
RDEFINE SECDATA SECLEVEL UACC(READ)
RALTER SECDATA SECLEVEL ADDMEM(L0/10 L1/30 L2/50 L3/70 L4/90)
Security category: CATEGORY
The non-hierarchical CATEGORY profile further qualifies the access capability. The security
administrator can define zero or more categories that correspond to some grouping
arrangement in the installation. The CATEGORY profile contains a member for each
non-hierarchical category in the system. For example, C1 through C5 are security categories.
RDEFINE SECDATA CATEGORY UACC(READ)
RALTER SECDATA CATEGORY ADDMEM(C1 C2 C3 C4 C5)
Defining Security labels
After defining the SECLEVEL and CATEGORY profiles, the security administrator defines a
profile in the SECLABEL resource class for each security label. The SECLABEL is a name of
192 DB2 UDB for z/OS Version 8 Performance Topics