Oracle Network Products Getting Started Release 2.3.4 for Windows Platforms

Library

Product

Contents

Index

Supported Oracle Network Products

• Oracle Network Products

 

• Oracle Network Products Compatibility

 

• 16-Bit Support on Windows NT and Windows 95

 

• Oracle Protocol Adapters

 

• SQL*Net Configuration Tools

 

• Oracle Names

 

• NDS Native Naming Adapter

 

• SQL*Net Authentication Adapters

 

• Advanced Networking Option

 

Oracle Network Products

Oracle Network Products Compatibility

SQL*Net and Net8 Coexistence and Migration

Supported Vendors

16-Bit Support on Windows NT and Windows 95

Oracle Protocol Adapters

• TCP/IP Protocol Adapter
• SPX Protocol Adapter
• DECnet Protocol Adapter
• Named Pipes Protocol Adapter
• NetBIOS Protocol Adapter
• LU6.2 Protocol Adapter
• Bequeath Protocol Adapter

TCP/IP Protocol Adapter

TCP/IP is a combination of two network protocols that facilitate transferring data across a network:

Protocol	Description
Transmission Control Protocol (TCP)	TCP is a connection-oriented protocol for establishing reliable, sequenced data transfer. TCP ensures that data reaches its destination.
Internet Protocol (IP)	IP assembles and addresses data packets for transmission to their network destinations.

   

Additional Information: See your operating system documentation.

 

SPX Protocol Adapter

SPX/IPX is a combination of two network protocols that carry data packets between clients and their servers:

Protocol	Description
Sequenced Packet Exchange (SPX)	SPX is a connection-oriented protocol for establishing a reliable, peer-to-peer connection between the source and destination of a network request. SPX guarantees delivery, sequencing of packets, and correction of errors encountered.
Internetwork Packet Exchange (IPX)	IPX is a connectionless protocol. Connectionless protocols do not establish connections between the source and destination of network requests. Data packets are addressed and sent, but the sender has no guarantee that data is successfully delivered or correctly sequenced.

  SPX and IPX are specifically designed for personal computer (PC) local area network (LAN) environments. They are communications protocols suitable for memory-constrained PC workstations. SPX/IPX supports all major PC operating systems.

Additional Information: See the Novell manual that came with your SPX/IPX software.

 

DECnet Protocol Adapter

DECnet is a collection of software and hardware communications products that lets various computer system users communicate in a network. Its peer-to-peer network environment lets any computer or node running DECnet communicate with all other nodes in the network without depending on a central controlling node. Each node is equally responsive to user requests, letting network users access applications. DECnet extends operating system use by creating an environment where client and server software is shared and accessed by other DECnet network users.

Many third party vendors on other operating systems and hardware platforms implement the DECnet protocol. DECnet capabilities include:

• file transfer
• remote login
• process-to-process communications
• datalink configuration support over Ethernet, X.25, Asynchronous, and DDCMP

Named Pipes Protocol Adapter

The Named Pipes Protocol Adapter is a high-level interface providing interprocess communications between clients and servers (distributed applications). One process (the server side of the application) creates the pipe, and the other process (the client side) opens it by name. What one side writes, the other can read, and vice versa. Named Pipes is specifically designed for PC-LAN environments.

NetBIOS Protocol Adapter

The Oracle NetBIOS Protocol Adapter for Windows lets an Oracle application on a Windows client machine communicate with remote Oracle7 databases using NetBIOS.

Communication is over an IBM LAN Support Program or Microsoft Network Basic Extended User Interface (NetBEUI).

NetBEUI is part of the transport layer protocol, not the NetBIOS programming interface.

NetBEUI is fast, with a low overhead (number of extra bytes) per frame of data transmitted. The protocol, however, cannot be routed. Thus, NetBEUI is most appropriate in single subnet (continuous) networks.

NetBEUI provides compatibility with existing LAN Manager, LAN Server, and MS-Net installations. NetBEUI is provided with Windows NT to maintain connectivity to existing LAN Manager and MS-Net based networks.

LU6.2 Protocol Adapter

Program-to-program communication protocols provide services for programs on one computer to initiate processes on another computer, thus establishing a dialog. Peer-to-peer communication is independent of the following:

• computer operating system
• programming language
• hardware interface environment

An SNA network with the LU6.2 and Physical Unit Type 2.1 (PU2.1) protocols provides APPC. The LU6.2 protocol defines a session between two application programs; LU6.2 is a product-independent LU-type.

The LU6.2 Protocol Adapter lets an Oracle application on a PC communicate with an Oracle7 database. This communication is over an SNA network with the Oracle7 database on a host system that supports APPC.

In addition to these server platforms, LU6.2 is available on operating systems that are client-only platforms.

Bequeath Protocol Adapter

The Bequeath Protocol Adapter:

• does not use a listener (therefore, no listener configuration is required)
• is used for local connections where an Oracle client application (such as SQL*Plus) communicates with an Oracle server running on the same machine
• is supported on Windows NT for both 16- and 32-bit applications. It works on Windows 95 for connections to a Personal Oracle7 database for both 16- and 32-bit applications.
• is installed by default with SQL*Net Server and SQL*Net Add-On (for Personal Oracle7)

SQL*Net Configuration Tools

Oracle Names

Features of DDO are:

• well-known Names Servers

A well-known Names Server is a host whose address is hard coded into the Oracle Names server and its clients. By hard coding the address of the well-known Names Server, clients do not need to be told, by way of configuration files, where to find it.

• dynamic service registration

When a service (for example, database) starts up, it automatically registers itself with the first well-known Names Server it locates. Once a service is registered with the Names Server, its address is available to SQL*Net clients throughout the network.

• minimized configuration

Default settings are hard coded for the Names Servers, SQL*Net, and Oracle Names, minimizing configuration.

NDS Native Naming Adapter

Advanced Networking Option (ANO) provides its own naming service adapter. See "Advanced Networking Option" in this chapter for more information.

The NDS Native Naming Adapter enables you to integrate Oracle service names (or database aliases) and addresses into your existing non-Oracle name services. This feature allows users from multiple points to use a single login to access a multi-server and multi-database network, and view the entire network under a single directory tree.

The NDS Native Naming Adapter uses the NDS naming environment to store service names and addresses of Oracle7 for NetWare databases. This environment allows users to connect to Oracle7 databases whose server name is defined as an NDS object name.

To use the NDS Native Naming Adapter, you must configure your Windows client machine to a Novell NetWare 4.x workstation.

Additional Information:  See:  "Connecting with the NDS Native Naming Adapter" in Chapter 5, "Database Connection Tasks" Oracle Advanced Networking Option Adminstrator's Guide Oracle7 Server Getting Started for NetWare Oracle7 Workgroup Server Getting Started for NetWare

 

SQL*Net Authentication Adapters

• NDS Authentication Adapter
• Windows NT Authentication Adapter

ANO provides other authentication adapters. See "Advanced Networking Option" in this chapter for ANO authentication adapters.

NDS Authentication Adapter

Windows NT Authentication Adapter

Advanced Networking Option

ANO is comprised of the following components:

• Network Security and Single Sign-On
• DCE Integration

 

Additional Information:  See:  Chapter 6, "Using the Advanced Networking Option" Oracle Advanced Networking Option Administrator's Guide

   

Network Security and Single Sign-On

The following concepts are explained below:

• Encryption
• Public Key Cryptography
• Digital Signatures
• Digital Certificates
• Certificate Revocation Lists (CRL)
• Supported Algorithms

Network Security

In symmetric-key encryption, the sender of a message uses a secret key to encrypt the message, and the receiver uses the same secret key to decrypt the message. If Alice and Bob want to communicate, they must each know what the secret key is (and the key must be exchanged in a way that the secrecy of the key is preserved). If Bob and Steve want to communicate, they must also have a separate key (so that, for example, Alice cannot read their messages).

The main drawback of symmetric-key encryption is that, in a system with many users wanting to communicate, the management and distribution of keys becomes overwhelming.

Public Key CryptographyPublic key cryptography solves the key management problem of symmetric-key cryptography. In the public key scheme, each person receives a pair of keys:

• a public key
• a private key

For example, Alice sends a message to Bob so that only Bob can read it. She encrypts the message with Bob's public key, which is public knowledge. Bob decrypts the message with his private key to read it. Only Bob owns the private key that is able to decrypt the message, and only Bob can read the message.

Digital SignaturesPublic key cryptography can be used for authentication (digital signatures) as well as for privacy (encryption). A digital signature is a non-forgeable way of authenticating the sender of a message. Only the sender of a message could actually have sent the message. The sender cannot later claim that someone impersonated her or him.

For example, Alice orders equipment, and the purchasing department (where Bob works) requires a digital signature on the purchase order. To sign the purchase order, Alice performs a computation (hash) of the message, encrypts the hash with her private key, and attaches the encrypted hash (digital signature) to the order before sending it. To verify the signature, Bob decrypts the hash with Alice's public key, performs the same computation on the order, and compares the results with Alice's decrypted hash. If the results are the same, then only Alice could have sent the message.

Digital CertificatesTo establish confidence in the identity associated with a public key, public keys are incorporated into digital certificates. A digital certificate is a binding of a public key to a user by a trusted third party known as a Certificate Authority (CA). The public key and user identity, together with other information such as the certificate expiration date, are digitally signed by the CA. CAs serve as electronic notaries, attesting to the identity of users and the validity of their public keys.

Certificates may be issued in several ways. For instance, Alice may generate her own key pair and send the public key to an appropriate CA with some proof of her identification. The CA verifies the identification and takes other steps to ensure that Alice is really Alice. Next, the CA sends Alice a certificate attesting to the binding between Alice and her public key, along with a hierarchy of certificates verifying the CA's public key. Alice can present this certificate chain whenever necessary to demonstrate the legitimacy of her public key.

Alternatively, the key pair may be generated by an administrator in a way that the person generating the keys does not know Alice's private key. Alice's private key may be given to her on a diskette or embedded within a token. Alice's public key is bound to a certificate by the CA, a copy given to Alice and a copy stored in a public database for ready access.

Certificate Revocation Lists (CRL)Public keys are sometimes revoked before their expiration date. Such instances include compromised keys or employment termination. A CRL lists such revoked public keys. CAs maintain CRLs and provide information about revoked keys originally certified by the CA. CRLs list only current keys, since expired keys are not valid. A revoked key past the expiration date is removed from the list. Although CRLs are maintained in a distributed manner, networked sites may provide a centralized location for the latest CRLs.

Note:  See the RSA Data Security website at http://www.rsa.com for more information about public key cryptography and digital signatures.

  Supported AlgorithmsThe following algorithms are supported for encryption and checksumming:

• Encryption
• RC4_40 (Domestic, Export and Upgrade)
• RC4_56 (Domestic only)
• RC4_128 (Domestic only)
• DES_56 (Domestic and Upgrade)
• DES_40 (Domestic, Export and Upgrade)
• Checksumming
• MD5 (Domestic, Export and Upgrade)

Single Sign-On

Authentication Adapters Provide Enhanced Security

The following adapters are supported for this reason:

• Kerberos
• CyberSAFE
• SecurID
• Biometric (Identix)

DCE Integration

• DCE Communication/Security Adapter
• DCE CDS Naming Adapter

 

Note:  DCE Integration for Windows is only available for version 2.1.4.1.6 of SQL*Net and is only compatible with one client version of SQL*Net 2.1.4.1.6. It also does not support the CDS naming adapter.

   

DCE Communication/Security Adapter

• authenticated Remote Procedure Call (RPC)

RPC is the transport mechanism that enables multi-vendor interoperability for DCE Integration. RPC also uses additional DCE services, including directory and security services, to provide location transparency and secure distributed computing.

• integrated security

DCE Integration works with the DCE Security Service to provide security within DCE cells. It enables a user logged onto DCE to securely access any Oracle application without specifying a user name or password. This function is referred to as external authentication to the database. In addition, clients and servers not running DCE authentication services can interoperate with systems that have DCE security by specifying an Oracle password.

• data privacy and integrity

DCE Integration uses multiple levels of security to ensure data authenticity, privacy, and integrity. For example, users have a range of choices, from no protection to full encryption for each connection, with a guarantee that no data has been modified in transit. For parts of your network that do not use DCE, you can use ANO-Network Security and Single Sign-On.

DCE CDS Naming Adapter

The DCE CDS Naming Adapter offers a distributed, replicated repository service for name, address, and attributes of objects across the network. Because servers register their name and address information in the DCE CDS Naming Adapter, Oracle clients can make location-independent connections to Oracle7 databases. Services can be relocated without any changes to the client configuration. An Oracle utility is provided to load the Oracle service names (with corresponding connect descriptors) into the DCE CDS Naming Adapter. After the names are loaded, Oracle connect descriptors can be viewed from a central location with standard DCE tools.

Prev Next

Copyright © 1997 Oracle Corporation.  All Rights Reserved.

Library

Product

Contents

Index