A deep discussion on label security is available with the whitepaper: http://download.microsoft.com/download/8/8/0/880F282A-AA4E-4351-83C0-DFFA3B56A19E/SQL_Server_RLS-CLS_White_paper.docx
A security label is a piece of information that describes the sensitivity of a data item (an object). It is a string containing markings from one or more categories. Users (subjects) have permissions described with the same markings. Essentially, each subject has a label of its own. To determine access to a particular object, the subject’s label is compared against the label on the object.
The Label Security Toolkit contains tools and design guidance for implementing label-based row and cell level security with SQL Server 2005 and later.
• Using the Label Security Toolkit
• Database Developer’s Reference
• RLS/CLS Framework Design Whitepaper
• Readme files for each sample
To quickly get oriented with the toolkit and the Label Policy Designer, start with Using the Label Security Toolkit. The document introduces label-based access control, walks through the use of the Label Policy Designer, and explains how to configure your application data model to support row/cell level security.
The Database Developer’s Reference contains more detailed reference information on the database objects used to implement row and cell level security, as well as other in-depth topics.
The Framework Design Whitepaper is a backgrounder which explains the design on which the Label Security Toolkit is based. You do not need to read this to use the toolkit, but if you want to understand the internals, this is the place to look. This document will be available soon.
The tool can also be used for basic maintenance/administration of an existing label policy, including adding/removing valid markings and removing the label policy from a database.
A security label is a piece of information that describes the sensitivity of a data item (an object). It is a string containing markings from one or more categories. Users (subjects) have permissions described with the same markings. Essentially, each subject has a label of its own. To determine access to a particular object, the subject’s label is compared against the label on the object.
The Label Security Toolkit contains tools and design guidance for implementing label-based row and cell level security with SQL Server 2005 and later.
Documentation
The following documentation is provided with the Label Security Toolkit.• Using the Label Security Toolkit
• Database Developer’s Reference
• RLS/CLS Framework Design Whitepaper
• Readme files for each sample
To quickly get oriented with the toolkit and the Label Policy Designer, start with Using the Label Security Toolkit. The document introduces label-based access control, walks through the use of the Label Policy Designer, and explains how to configure your application data model to support row/cell level security.
The Database Developer’s Reference contains more detailed reference information on the database objects used to implement row and cell level security, as well as other in-depth topics.
The Framework Design Whitepaper is a backgrounder which explains the design on which the Label Security Toolkit is based. You do not need to read this to use the toolkit, but if you want to understand the internals, this is the place to look. This document will be available soon.
Label Policy Designer Tool
Use the Label Policy Designer Tool to implement the row/cell level security framework. It allows you to design a specific taxonomy of markings, and set the rules used to validate and compare labels. Based on this logical definition, the tool will create the framework in a target database (or generate a deployment script).The tool can also be used for basic maintenance/administration of an existing label policy, including adding/removing valid markings and removing the label policy from a database.
Samples
Included with the toolkit are several samples demonstrating implementation of RLS/CLS databases. These are an important companion to the documentation for understanding the details of using row- or cell-level security. These examples include:- Applying label policies to a target database
- Creating application tables and views
- Using updateable views to handle write operations
- Writing instead-of triggers to handle write operations
- Writing custom code against a database with row/cell level security
