ISO/IEC 9579:2000 情報技術  —  セキュリティが強化されたSQLのリモートデータベースアクセス | ページ 2

Foreword

ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work.

International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, 3.

In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1. Draft International Standards adopted by the joint technical committee are circulated to national bodies for voting. Publication as an International Standard requires approval by at least 75 % of the national bodies casting a vote.

Attention is drawn to the possibility that some of the elements of this International Standard may be the subject of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights.

International Standard ISO/IEC 9579 was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 32, Data management and interchange.

This second edition cancels and replaces the first edition (ISO 9579:1999), which has been technically revised.

Annexes A to E and G form a normative part of this International Standard. Annexes F, H and I are for information only.

Introduction

Remote Database Access for SQL (RDA/SQL) International Standard is a member of a set of International Standards produced to facilitate the interworking of computer systems. This International Standard conforms to the model defined in ISO/IEC 10032, Information technology — Reference Modelof Data Management.

Remote Database Access for SQL can be used to provide remote data access to a database management system conforming to ISO/IEC 9075 (Database Language SQL).

The goal of Remote Database Access for SQL is to allow, with a minimum of technical agreement outside this International Standard, the interconnection of applications and database systems:

• from different manufacturers,
• under different managements,
• of different levels of complexity,
• exploiting different technologies.

An application may itself be a database system and therefore this International Standard can be used to support multi-database system interworking.

1 Scope

This International Standard, Remote Database Access for SQL (RDA), defines a model for the remote interaction of an SQL-client and one or more SQL-servers through communication media, and defines the encoding of messages, the semantics of messages and associated facilities for mediating the interaction between one SQL-client and one SQL-server.

This International Standard also defines a mapping of the RDA Protocol to the specific communication infrastructures TCP/IP and Transport Layer Security (TLS).

This International Standard relies upon the facilities provided by ISO/IEC 9075 (SQL) and ISO/IEC 9075-3 (SQL/CLI).

This International Standard also:

• identifies potential security vulnerabilities in remote database access using RDA,
• defines RDA facilities which protect against the potential vulnerabilities.

Normative annexes provide:

• a Conformance Proforma,
• an optional language independent Application Programming Interface defined in the notational conventions of ISO/IEC 9075-3 (SQL/CLI) for invoking RDA Operations,
• an optional mapping of ISO/IEC 9075-3 (SQL/CLI) functions to RDA Operations,
• definitions of optional SQL-servers, the RDA Location Server and the RDA Support Server, to facilitate interoperation and data distribution in a heterogeneous environment,
• a set of security profiles that identify which RDA facilities and other security facilities are required for different levels of protection against potential vulnerabilities.

Informative annexes provide:

• an analysis of security service requirements,
• an ASN.1 specification for the RDA Protocol,
• an ASN.1 specification for the encoding of multiple rows.

This International Standard does not constrain:

• conforming RDA-client environments to be implemented using any particular processor decomposition,
• conforming RDA-server environments to be implemented using any particular processor decomposition.

This International Standard refers to but does not define:

• protocols and security mechanisms for communication confidentiality, integrity and authentication of communicating peers,
• digital signature and authentication mechanisms supported by protocol elements of RDA.

This International Standard does not define:

• algorithms for query decomposition or for the combining of results in a distributed database environment,
• mechanisms for recovery in the event that transaction co-ordination fails,
• mechanisms for storage integrity and confidentiality using cryptography,
• mechanisms to counter Denial of Service attacks.

2 Normative References

The following standards contain provisions which, through reference in this text, constitute provisions of this International Standard. At the time of publication, the editions indicated were valid. All standards are subject to revision, and parties to agreements based on this International Standard are encouraged to investigate the possibility of applying the most recent editions of the standards indicated below. Members of IEC and ISO maintain registers of currently valid International Standards.

2.1 International Standards

2.2 Internet Engineering Task Force

2.3 Institute of Electrical and Electronics Engineers