86 lines
5.3 KiB
XML
86 lines
5.3 KiB
XML
<svg xmlns="http://www.w3.org/2000/svg" width="1280" height="720" viewBox="0 0 1280 720" role="img" aria-labelledby="title desc">
|
|
<title id="title">ORDS Agent 데이터 접근 통제 아키텍처</title>
|
|
<desc id="desc">Agent 요청에서 ORDS 사용자 식별, DB 보안 정책 적용, 허용 결과 반환까지의 아키텍처와 DB User, Bearer Key, VPD, DDS 적용 경로.</desc>
|
|
<rect width="1280" height="720" fill="#f8fafc"/>
|
|
<defs>
|
|
<marker id="arrow" viewBox="0 0 10 10" refX="9" refY="5" markerWidth="8" markerHeight="8" orient="auto-start-reverse">
|
|
<path d="M 0 0 L 10 5 L 0 10 z" fill="#334155"/>
|
|
</marker>
|
|
<style>
|
|
.h1 { font-family: Arial, Helvetica, sans-serif; font-size: 36px; font-weight: 700; fill: #0f172a; }
|
|
.sub { font-family: Arial, Helvetica, sans-serif; font-size: 20px; fill: #475569; }
|
|
.title { font-family: Arial, Helvetica, sans-serif; font-size: 21px; font-weight: 700; fill: #0f172a; }
|
|
.text { font-family: Arial, Helvetica, sans-serif; font-size: 17px; fill: #334155; }
|
|
.small { font-family: Arial, Helvetica, sans-serif; font-size: 15px; fill: #475569; }
|
|
.mono { font-family: Menlo, Consolas, monospace; font-size: 15px; fill: #1e293b; }
|
|
.trunk { fill: #ffffff; stroke: #2563eb; stroke-width: 2; rx: 10; }
|
|
.branch { fill: #fefce8; stroke: #ca8a04; stroke-width: 2; rx: 10; }
|
|
.policy { fill: #ecfdf5; stroke: #059669; stroke-width: 2; rx: 10; }
|
|
.result { fill: #eef2ff; stroke: #4f46e5; stroke-width: 2; rx: 10; }
|
|
</style>
|
|
</defs>
|
|
|
|
<text x="54" y="62" class="h1">Agent 권한 매핑 및 데이터 접근 통제</text>
|
|
<text x="54" y="100" class="sub">사용자 식별 방식은 갈라지지만, 최종 데이터 제한은 보호 객체(VIEW/TABLE)에서 DB가 적용한다.</text>
|
|
|
|
<rect x="42" y="154" width="150" height="96" class="trunk"/>
|
|
<text x="66" y="192" class="title">1. Agent</text>
|
|
<text x="66" y="222" class="text">검색 요청</text>
|
|
|
|
<line x1="192" y1="202" x2="250" y2="202" stroke="#334155" stroke-width="3" marker-end="url(#arrow)"/>
|
|
<rect x="252" y="154" width="160" height="96" class="trunk"/>
|
|
<text x="276" y="192" class="title">2. ORDS</text>
|
|
<text x="276" y="222" class="text">요청 수신</text>
|
|
|
|
<line x1="412" y1="202" x2="470" y2="202" stroke="#334155" stroke-width="3" marker-end="url(#arrow)"/>
|
|
<rect x="472" y="154" width="190" height="96" class="trunk"/>
|
|
<text x="496" y="188" class="title">3. 사용자 식별</text>
|
|
<text x="496" y="218" class="text">DB User 또는 Key</text>
|
|
|
|
<line x1="662" y1="202" x2="720" y2="202" stroke="#334155" stroke-width="3" marker-end="url(#arrow)"/>
|
|
<rect x="722" y="154" width="210" height="96" class="trunk"/>
|
|
<text x="746" y="188" class="title">4. 권한 기준 생성</text>
|
|
<text x="746" y="218" class="text">Context / DDS Identity</text>
|
|
|
|
<line x1="932" y1="202" x2="990" y2="202" stroke="#334155" stroke-width="3" marker-end="url(#arrow)"/>
|
|
<rect x="992" y="154" width="230" height="96" class="trunk"/>
|
|
<text x="1016" y="188" class="title">5. 보호 객체</text>
|
|
<text x="1016" y="216" class="text">VIEW/TABLE 조회</text>
|
|
<text x="1016" y="239" class="text">정책 적용</text>
|
|
|
|
<rect x="446" y="318" width="245" height="126" class="branch"/>
|
|
<text x="474" y="356" class="title">식별 경로 A</text>
|
|
<text x="474" y="386" class="mono">SESSION_USER</text>
|
|
<text x="474" y="416" class="text">DB 계정으로 사용자 매핑</text>
|
|
<line x1="568" y1="318" x2="568" y2="250" stroke="#ca8a04" stroke-width="2.5" marker-end="url(#arrow)"/>
|
|
|
|
<rect x="156" y="318" width="245" height="126" class="branch"/>
|
|
<text x="184" y="356" class="title">식별 경로 B</text>
|
|
<text x="184" y="386" class="mono">Authorization: Bearer</text>
|
|
<text x="184" y="416" class="text">Key로 내부 사용자 매핑</text>
|
|
<line x1="400" y1="372" x2="472" y2="235" stroke="#ca8a04" stroke-width="2.5" marker-end="url(#arrow)"/>
|
|
|
|
<rect x="736" y="318" width="245" height="126" class="branch"/>
|
|
<text x="764" y="356" class="title">식별 경로 C</text>
|
|
<text x="764" y="386" class="mono">END USER</text>
|
|
<text x="764" y="416" class="text">DDS 보안 사용자</text>
|
|
<line x1="828" y1="318" x2="828" y2="250" stroke="#ca8a04" stroke-width="2.5" marker-end="url(#arrow)"/>
|
|
|
|
<rect x="230" y="508" width="340" height="126" class="policy"/>
|
|
<text x="260" y="548" class="title">VPD 적용 경로</text>
|
|
<text x="260" y="578" class="text">SYS_CONTEXT + p_object + EXISTS</text>
|
|
<text x="260" y="606" class="small">권한 테이블 기반 행 제한</text>
|
|
<text x="260" y="626" class="small">Redaction 값 마스킹</text>
|
|
<line x1="570" y1="562" x2="746" y2="250" stroke="#059669" stroke-width="2.5" marker-end="url(#arrow)"/>
|
|
|
|
<rect x="710" y="508" width="340" height="126" class="policy"/>
|
|
<text x="740" y="548" class="title">DDS 적용 경로</text>
|
|
<text x="740" y="578" class="text">DATA ROLE + DATA GRANT</text>
|
|
<text x="740" y="606" class="small">행 / 컬럼 / 작업 통제</text>
|
|
<text x="740" y="626" class="small">선언형 제한</text>
|
|
<line x1="880" y1="508" x2="1048" y2="250" stroke="#059669" stroke-width="2.5" marker-end="url(#arrow)"/>
|
|
|
|
<rect x="368" y="654" width="544" height="48" class="result"/>
|
|
<text x="410" y="685" class="title">결과: 허용된 행과 컬럼만 반환</text>
|
|
</svg>
|