The DBMS_TSDP_PROTECT package provides an interface to configure transparent sensitive data protection (TSDP) policies in conjunction with the DBMS_TSDP_MANAGE package. DBMS_TSDP_PROTECT is available with the Enterprise Edition only.
See Also:
Oracle Database Security GuideThis chapter contains the following topics:
Overview
Security Model
Constants
Use the DBMS_TSDP_PROTECT package to create transparent sensitive data protection policies, configure protection by associating the policies with sensitive types, and to enable and disable the configured protection. Sensitive types can be added using the DBMS_TSDP_MANAGE package.
All procedures are executed with invoker's rights. Typically, a security administrator should have the EXECUTE privilege for this package.
The DBMS_TSDP_PROTECT package uses the constants shown in Table 171-1, "DBMS_TDSP_PROTECT Constants - Compression Types":
Table 171-2 DBMS_TSDP_PROTECT Package Subprograms
| Subprogram | Description |
|---|---|
|
Creates a TSDP policy |
|
|
Alters a TDSP policy |
|
|
Associates or disassociates a TSDP policy with a sensitive column type |
|
|
Disables protection for columns |
|
|
Disables protection based on the source of truth for the sensitive columns |
|
|
Disables protection for a sensitive column type |
|
|
Removes a TDSP policy |
|
|
Enables protection for columns |
|
|
Enables protection based on the source of truth for the sensitive columns |
|
|
Enables protection for a sensitive column type |
This procedure creates a TDSP policy.
DBMS_TSDP_PROTECT.ADD_POLICY ( policy_name IN VARCHAR2, security_feature IN PLS_INTEGER, policy_enable_options IN FEATURE_OPTIONS, policy_apply_condition IN POLICY_CONDITION DEFAULT TSDP$null_condition);
Table 171-3 ADD_POLICY Procedure Parameters
| Parameter | Description |
|---|---|
|
|
Name of the policy being created. The maximum length for this identifier is |
|
|
Oracle security feature with which the policy is associated. Allowed values:
|
|
|
Initialized with the parameter-value pairs corresponding to the security feature |
|
|
Initialized with the property-value pairs that must be satisfied in order to apply the corresponding Example:
|
To create the TDSP policy, you must include the procedure in an anonymous block that defines the type of security feature that will use the policy and conditions to test when the policy is enabled. For more information, see Oracle Database Security Guide.
Create a policy PARTIAL_MASK_POLICY:
DECLARE
redact_feature_options DBMS_TSDP_PROTECT.FEATURE_OPTIONS;
policy_conditions DBMS_TSDP_PROTECT.POLICY_CONDITIONS;
BEGIN
redact_feature_options ('expression') :=
'SYS_CONTEXT(''USERENV'',''SESSION_USER'') =''APPUSER''';
redact_feature_options ('function_type') := 'DBMS_REDACT.PARTIAL';
redact_feature_options ('function_parameters') := 'STR, VVVVVVVVV,VVVVVVVVV, *, 1, 6';
policy_conditions(DBMS_TSDP_PROTECT.DATATYPE) := 'VARCHAR2';
DBMS_TSDP_PROTECT.ADD_POLICY
('PARTIAL_MASK_POLICY', DBMS_TSDP_PROTECT.REDACT, redact_feature_options, policy_conditions);
END;
This procedure alters an existing TDSP policy
DBMS_TSDP_PROTECT.ALTER_POLICY ( policy_name IN VARCHAR2, policy_enable_options IN FEATURE_OPTIONS, policy_apply_condition IN POLICY_CONDITION default TSDP$null_condition);
Table 171-4 ALTER_POLICY Procedure Parameters
| Parameter | Description |
|---|---|
|
|
Name of the policy to alter |
|
|
Initialized with the parameter-value pairs corresponding to the security feature |
|
|
Initialized with the property-value pairs that must be satisfied in order to apply the corresponding Example:
|
If the policy_apply_condition matches an existing condition for the policy, then the corresponding enable options are updated with policy_enable_options.
If the policy_apply_condition does not match any existing condition for the policy, the combination of policy_enable_options and policy_apply_condition is added to the policy.
Add a new combination of policy_apply_condition and policy_enable_options to an existing policy PARTIAL_MASK_POLICY:
DECLARE
redact_feature_options DBMS_TSDP_PROTECT.FEATURE_OPTIONS;
policy_conditions DBMS_TSDP_PROTECT.POLICY_CONDITIONS;
BEGIN
redact_feature_options ('expression') :=
'SYS_CONTEXT(''USERENV'',''SESSION_USER'')=''APPUSER''';
redact_feature_options ('function_type') := 'DBMS_REDACT.PARTIAL';
redact_feature_options ('function_parameters') := 'STR, VVVVVVVVV,VVVVVVVVV, *,
1, 6';
policy_conditions (DBMS_TSDP_PROTECT.DATATYPE) := 'VARCHAR2';
DBMS_TSDP_PROTECT.ALTER_POLICY ('PARTIAL_MASK_POLICY', redact_feature_options, policy_conditions);
END;
This procedure associates or disassociates a TSDP policy with a sensitive column type.
DBMS_TSDP_PROTECT.ASSOCIATE_POLICY ( policy_name IN VARCHAR2, sensitive_type IN VARCHAR2, associate IN BOOLEAN DEFAULT TRUE);
This procedure disables protection for columns.
DBMS_TSDP_PROTECT.DISABLE_PROTECTION_COLUMN ( schema_name IN VARCHAR2 DEFAULT '%', table_name IN VARCHAR2 DEFAULT '%', column_name IN VARCHAR2 DEFAULT '%', policy_name IN VARCHAR2 DEFAULT NULL);
This procedure disables protection based on the source of truth for the sensitive columns.
This procedure removes a TDSP policy or one of its condition-enable_options combinations.
DBMS_TSDP_PROTECT.DROP_POLICY ( policy_name IN VARCHAR2, policy_apply_condition IN POLICY_CONDITION default TSDP$null_condition); DBMS_TSDP_PROTECT.DROP_POLICY ( policy_name IN VARCHAR2);
The combination of policy_condition and policy_enable_options can be dropped from a TSDP policy by giving the policy_apply_condition parameter. The default condition-default options combination can also be dropped (if it exists for the policy) by passing an empty associative array of type DBMS_TSDP_PROTECT.POLICY_CONDITION.
If the condition-enable_options combination that is being dropped is the last condition-enable_options combination for the policy, the policy itself is dropped.
A policy can be completely dropped by using the overloaded of the procedure that takes only policy_name.
A policy or one of its conditions can be dropped only if the policy is not associated with any sensitive column type. This also means that a policy that is being dropped is not enabled on any column (object).
Dropping the condition-enable_options combination based on a specific condition:
DECLARE
policy_conditions DBMS_TSDP_PROTECT.POLICY_CONDITIONS;
BEGIN
policy_conditions (DBMS_TSDP_PROTECT.DATATYPE) := 'VARCHAR2';
DBMS_TSDP_PROTECT.DROP_POLICY ('PARTIAL_MASK_POLICY', policy_conditions);
END;
The default condition-enable_options combination can be dropped by passing an empty associative array of type DBMS_TSDP_PROTECT.POLICY_CONDITIONS for the policy_apply_condition parameter:
DECLARE
policy_conditions DBMS_TSDP_PROTECT.POLICY_CONDITIONS;
BEGIN
DBMS_TSDP_PROTECT.DROP_POLICY ('redact_partial_cc', policy_conditions);
END;
Dropping a TSDP policy:
BEGIN DBMS_TSDP_PROTECT.DROP_POLICY( policy_name => 'PARTIAL_MASK_POLICY'); END;
This procedure enables protection for columns.
DBMS_TSDP_PROTECT.ENABLE_PROTECTION_COLUMN ( schema_name IN VARCHAR2 DEFAULT '%', table_name IN VARCHAR2 DEFAULT '%', column_name IN VARCHAR2 DEFAULT '%', policy_name IN VARCHAR2 DEFAULT NULL);
Only a TSDP Policy that is associated with the sensitive column type of the sensitive column can be enabled using this Procedure.
LIKE condition is used for schema_name, table_name and column_name. AND semantics is followed.
This procedure enables protection based on the source of truth for the sensitive columns.