Re: Complex security requirement: user + computer

In article <01bc9098$2f1cb310$6f4684c6@pc-pmarks>, Paul Marks <sessec01.pmarks@eds.com> writes >My customer wishes to restrict access to data based not only upon which >user is logged in, but which client computer is logged into by the user. > >For example, a user logged into a workstation deemed to be "in an unsecure >area" may not access any financial data (may only access certain Views). >Application-level security cannot be used since this must also apply to >third-party applications such as reporting tools. Simply restricting access >to the reporting tool itself is not a solution, since the tool may be >needed to access other, non-restricted data. > >Has anyone ever done or heard of anything like this before? > >--- >sessec0.pmarks@eds.com > > Secure Ingres will do this. It works by adding a security label on to every row of every table deemed to contain sensitive data. When a process tries to access the data, its own security label is compared with that of the data to see if access is allowed. Failures occur silently, in that the user never even knows that the data is there. The label of the process can be determined by just such criteria as you mention, eg the lowest of the user's label, the application label and the terminal's label. But beware, when I last used secure Ingres - about 6 months ago - it did not support connections from OpenRoad, only Windows4GL version 2. Regards, Pat McGibbon pat@megadata.demon.co.uk **Automatic return address corrupted to discourage junk email.**