Oracle Advanced Security provides the following security features:

• Data Encryption

  Sensitive information communicated over enterprise networks and the Internet can be protected by using encryption algorithms, which transform information into a form that can be deciphered only with a decryption key. Some of the supported encryption algorithms are RC4, DES, 3DES, and AES.

  To ensure data integrity during transmission, Oracle Advanced Security generates a cryptographically secure message digest. Starting from Oracle Database 12c Release 1 (12.1), the SHA-2 list of hashing algorithms are also supported and Oracle Advanced Security uses the following hashing algorithms to generate the secure message digest and includes it with each message sent across a network.

  This protects the communicated data from attacks, such as data modification, deleted packets, and replay attacks.

  The following code snippet shows how to calculate the checksum using any of the algorithms mentioned previously:

  prop.setProperty(OracleConnection.CONNECTION_PROPERTY_THIN_NET_CHECKSUM_TYPES, "( SHA1)");
  prop.setProperty(OracleConnection.CONNECTION_PROPERTY_THIN_NET_CHECKSUM_LEVEL, "REQUIRED");
  

• Strong Authentication

  To ensure network security in distributed environments, it is necessary to authenticate the user and check his credentials. Password authentication is the most common means of authentication. Oracle Database enables strong authentication with Oracle authentication adapters, which support various third-party authentication services, including SSL with digital certificates. Oracle Database supports the following industry-standard authentication methods:

  • Kerberos

  • Remote Authentication Dial-In User Service (RADIUS)

  • Secure Sockets Layer (SSL)

You can use Oracle Database and Oracle Advanced Security data encryption and integrity features in your Java database applications, depending on related settings in the server. When using the JDBC OCI driver, set parameters as you would in any Oracle client situation. When using the Thin driver, set parameters through a Java properties object.

Encryption is enabled or disabled based on a combination of the client-side encryption-level setting and the server-side encryption-level setting. Similarly, integrity is enabled or disabled based on a combination of the client-side integrity-level setting and the server-side integrity-level setting.

Encryption and integrity support the same setting levels, REJECTED, ACCEPTED, REQUESTED, and REQUIRED. Table 9-1 shows how these possible settings on the client-side and server-side combine to either enable or disable the feature. By default, remote OS authentication (through TCP) is disabled in the database for security reasons.

Table 9-1 shows, for example, that if encryption is requested by the client, but rejected by the server, it is disabled. The same is true for integrity. As another example, if encryption is accepted by the client and requested by the server, it is enabled. The same is also true for integrity.

Oracle Database 19c provides support for the Secure Sockets Layer (SSL) protocol. SSL is a widely used industry standard protocol that provides secure communication over a network. SSL provides authentication, data encryption, and data integrity. It provides a secure enhancement to the standard TCP/IP protocol, which is used for Internet communication.

SSL uses digital certificates that comply with the X.509v3 standard for authentication and a public and private key pair for encryption. SSL also uses secret key cryptography and digital signatures to ensure privacy and integrity of data. When a network connection over SSL is initiated, the client and server perform an SSL handshake that includes the following steps:

• Client and server negotiate about the cipher suites to use. This includes deciding on the encryption algorithms to be used for data transfer.

• Server sends its certificate to the client, and the client verifies that the certificate was signed by a trusted certification authority (CA). This step verifies the identity of the server.

• If client authentication is required, the client sends its own certificate to the server, and the server verifies that the certificate was signed by a trusted CA.

• Client and server exchange key information using public key cryptography. Based on this information, each generates a session key. All subsequent communications between the client and the server is encrypted and decrypted by using this set of session keys and the negotiated cipher suite.

To establish an SSL connection with a JDBC client, Thin or OCI, Oracle database server sends its certificate, which is stored in its wallet. The client may or may not need a certificate or wallet depending on the server configuration.

The Oracle JDBC Thin driver uses the JSSE framework to create an SSL connection. It uses the default provider (SunJSSE) to create an SSL context. However you can provide your own provider.

You do not need a certificate for the client, unless the SSL_CLIENT_AUTHENTICATION parameter is set on the server.

Kerberos is a network authentication protocol that provides the tools of authentication and strong cryptography over the network. Kerberos helps you secure your information systems across your entire enterprise by using secret-key cryptography. The Kerberos protocol uses strong cryptography so that a client or a server can prove its identity to its server or client across an insecure network connection. After a client and server have used Kerberos to prove their identity, they can also encrypt all of their communications to assure privacy and data integrity as they go about their business.

The Kerberos architecture is centered around a trusted authentication service called the key distribution center, or KDC. Users and services in a Kerberos environment are referred to as principals; each principal shares a secret, such as a password, with the KDC. A principal can be a user such as HR or a database server instance.

Starting from 12c Release 1, Oracle Database also supports cross-realm authentication for Kerberos. If you add the referred realm appropriately in the domain_realms section of the kerberos configuration file, then being in one particular realm, you can access the services of another realm.

http://web.mit.edu/kerberos/dist/index.html

1. Right-click the My Computer icon on your desktop.
2. Select Properties. The System Properties dialog box is displayed.
3. Select the Advanced tab.
4. Click Environment Variables. The Environment Variables dialog box is displayed.
5. Click New to add a new user variable. The New User Variable dialog box is displayed.
6. Enter KRB5CCNAME in the Variable name field.
7. Enter FILE:C:\Documents and Settings\<user_name>\krb5cc in the Variable value field.
8. Click OK to close the New User Variable dialog box.
9. Click OK to close the Environment Variables dialog box.
10. Click OK to close the System Properties dialog box.

1. Use the following command to connect to the database:

   SQL> connect system
   Enter password: password
   

2. Use the following commands to create a user CLIENT@US.ORACLE.COM that is identified externally:

   SQL> create user "CLIENT@US.ORACLE.COM" identified externally;
   SQL> grant create session to "CLIENT@US.ORACLE.COM";
   

3. Use the following commands to connect to the database as sysdba and dismount it:

   SQL> connect / as sysdba
   SQL> shutdown immediate;
   
   

4. Add the following line to $T_WORK/t_init1.ora file:

   OS_AUTHENT_PREFIX=""
   

5. Use the following command to restart the database:

   SQL> startup pfile=t_init1.ora
   

6. Modify the sqlnet.ora file to include the following lines:

   names.directory_path = (tnsnames)
   #Kerberos
   sqlnet.authentication_services = (beq,kerberos5)
   sqlnet.authentication_kerberos5_service = dbji
   sqlnet.kerberos5_conf = /home/Jdbc/Security/kerberos/krb5.conf
   sqlnet.kerberos5_keytab = /home/Jdbc/Security/kerberos/dbji.oracleserver
   sqlnet.kerberos5_conf_mit = true
   sqlnet.kerberos_cc_name = /tmp/krb5cc_5088
   # logging (optional):
   trace_level_server=16 
   trace_directory_server=/scratch/sqlnet/
   

7. Use the following commands to verify that you can connect through SQL*Plus:

   > kinit client
   > klist
        Ticket cache: FILE:/tmp/krb5cc_5088
        Default principal: client@US.ORACLE.COM
       
        Valid starting     Expires            Service principal
        06/22/06 07:13:29  06/22/06 17:13:29  krbtgt/US.ORACLE.COM@US.ORACLE.COM
       
       
        Kerberos 4 ticket cache: /tmp/tkt5088
        klist: You have no tickets cached
   > sqlplus '/@(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=oracleserver.mydomain.com)(PORT=5221))
   (CONNECT_DATA=(SERVICE_NAME=orcl)))'
   

Oracle Database 11g Release 1 introduced support for Remote Authentication Dial-In User Service (RADIUS). RADIUS is a client/server security protocol that is most widely known for enabling remote authentication and access. Oracle Advanced Security uses this standard in a client/server network environment to enable use of any authentication method that supports the RADIUS protocol. RADIUS can be used with a variety of authentication mechanisms, including token cards and smart cards.

1. Use the following command to connect to the database:

   SQL> connect system
   Enter password: password
   

2. Use the following commands to create a new user aso from within a database:

   SQL> create user aso identified externally;
   SQL> grant create session to aso;
   

3. Use the following commands to connect to the database as sysdba and dismount it:

   SQL> connect / as sysdba
   SQL> shutdown immediate;
   

4. Add the following lines to the t_init1.ora file:

   os_authent_prefix = ""
   

   Note:

   Once the test is over, you need to revert the preceding changes made to the t_init1.ora file.

5. Use the following command to restart the database:

   SQL> startup pfile=?/work/t_init1.ora
   

6. Modify the sqlnet.ora file so that it contains only these lines:

   sqlnet.authentication_services = ( beq, radius)
   sqlnet.radius_authentication = <RADUIUS_SERVER_HOST_NAME>
   sqlnet.radius_authentication_port = 1812
   sqlnet.radius_authentication_timeout = 120
   sqlnet.radius_secret=/home/Jdbc/Security/radius/radius_key
   # logging (optional):
   trace_level_server=16
   trace_directory_server=/scratch/sqlnet/
   

7. Use the following command to verify that you can connect through SQL*Plus:

   >sqlplus 'aso/1234@(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=oracleserver.mydomain.com)(PORT=5221))
   (CONNECT_DATA=(SERVICE_NAME=orcl)))'