Home
Security
You can secure your Informix® database server and the data that is stored in your Informix databases. You can encrypt data, secure connections, control user privileges and access, and audit data security.
Security in HCL Informix®
The Informix® Security Guide documents methods for keeping your data secure by preventing unauthorized viewing and altering of data or database objects, including how to use the secure-auditing facility of the database server.
Securing data
Label-Based Access Control
You can use label-based access control (LBAC), an implementation of multi-level security (MLS), to control who has read access and who has write access to individual rows and columns of data.
Security label components
Security label components are security objects for defining security policies. The elements of these components are used to define security labels, which control access to protected tables.
ARRAY component
Security label component type ARRAY represents a ranked group of elements.

Security
You can secure your Informix® database server and the data that is stored in your Informix databases. You can encrypt data, secure connections, control user privileges and access, and audit data security.
- Security in HCL Informix®
  The Informix® Security Guide documents methods for keeping your data secure by preventing unauthorized viewing and altering of data or database objects, including how to use the secure-auditing facility of the database server.
  - Securing data
    - HCL Informix® directory security
      utilities and product directories are secure by default.
    - Network data encryption
      Use network encryption to encrypt data transmitted between server and client, and between server and other server.
    - Column-level encryption
      You can use column-level encryption to store sensitive data in an encrypted format. After encrypting sensitive data, such as credit card numbers, only users who can provide a secret password can decrypt the data.
    - Connection security
      You can administer the security of the connections to the database server by using authentication and authorization processes.
    - Discretionary access control
      Discretionary access control verifies whether the user who is attempting to perform an operation has been granted the required privileges to perform that operation.
    - Label-Based Access Control
      You can use label-based access control (LBAC), an implementation of multi-level security (MLS), to control who has read access and who has write access to individual rows and columns of data.
      - Configuring Label-Based Access Control
        The general procedure involves a few SQL-based tasks that define precise but flexible database security objects.
      - How security labels control access
        Security labels rely on security label components to store information about the classification of data and about which users have access authority.
      - DBSECADM role in LBAC
        The database security administrator role (DBSECADM) is required to create and maintain label-based access control security objects.
      - Security label components
        Security label components are security objects for defining security policies. The elements of these components are used to define security labels, which control access to protected tables.
        ARRAY component
        Security label component type ARRAY represents a ranked group of elements.
        SET component
        Security label component type SET is used to represent a group of unordered elements.
        TREE component
        Security label component type TREE contains a group of elements that represent a family of parent-child relationships.
        Creating security label components
        The CREATE SECURITY LABEL COMPONENT statement defines this database security object.
        Altering security label components
        The ALTER SECURITY LABEL COMPONENT statement adds one or more new elements to an existing component.
      - Security policies
        Security policies are database objects that you create and use to protect tables from unauthorized access.
      - Security labels
        Security labels are objects applied to rows and columns in order to protect these data, and granted to users to give them access to protected data.
      - Protecting Rows and Columns
        Protect rows and columns by associating them with security objects by including clauses in the CREATE TABLE and ALTER TABLE statements.
      - Exemptions
        Exemptions modify security credentials of users by disabling one or more of the IDSLBACRULES for a component type in a security policy.
      - Maintaining a label-based access-control implementation
        Optimizing database performance can require adjusting the values of configuration parameters for security policies and user credentials.
      - HCL Informix® Security Considerations
        The wide range of Informix® capabilities requires certain precautions and planning to ensure protected tables can be accessed appropriately.
      - LBAC and other HCL Informix® features
        Informix® has non-security functionality that operates seamlessly with label-based access control.
  - Auditing data security

Security label component type: ARRAY

Security label component type ARRAY represents a ranked group of elements.

The elements in an ARRAY component represent an ordered scale of relative values; the first element listed has the highest value and the last has the lowest.

The maximum number of elements in an ARRAY type of security label component is 64. An ARRAY component of a security label has the value of only one of its elements when it is compared after the IDSLBACRULES.

Example: If the fictional company JK Enterprises defines security label component level as a ranking of the company's four different privacy levels, as in the following statement:

CREATE SECURITY LABEL COMPONENT level
   ARRAY [ 'Top Secret', 'Secret', 'Confidential', 'Unclassified' ];

Then Relationship of elements in an ARRAY example illustrates the order of the elements:

The elements are listed in order of decreasing value. Top Secret is first, then Secret, then Confidential, then Unclassified. — Figure 1. Relationship of elements in an ARRAY example

When an ARRAY component in the user label is compared to an ARRAY component of a data label:

For Read Access: The IDSLBACREADARRAY rule lets the user component dominate when its value is greater than or equal to the value of the component in the data security label. The user can read data only at or below the level of the value in the array component of the user label.
For Write Access: The IDSLBACWRITEARRAY rule lets the user component dominate when its value is equal to the value of the component in the data label. The user can write data only at the level of the value in the array component of the user label.