Access Control by Device and Data Level

Basic Concepts

Distributed data management implements access control based on data security labels and device security levels.

A higher data security label and device security level indicate stricter encryption and access control measures and higher data security.

Data Security Labels

The data can be rated into four security levels: S1, S2, S3, and S4.

Device Security Levels

Device security levels are classified into SL1 to SL5 based on devices' security capabilities, for example, whether a Trusted Execution Environment (TEE) or a secure storage chip is available. For example, the development boards RK3568 and Hi3516 are SL1 (lower security) devices, and tablets are SL4 (higher security) devices.

During device networking, you can run the hidumper -s 3511 command to query the device security level. The following example shows how to query the security level of the RK3568 board:

Access Control Mechanism in Cross-Device Synchronization

In cross-device data synchronization, data access is controlled based on the device security level and data security labels. In principle, data can be synchronized only to the devices whose data security labels are not higher than the device's security level. The access control matrix is as follows:

For example, the security level of development boards RK3568 and Hi3516 is SL1. The database with data security label S1 can be synchronized with RK3568 and Hi3516, but the databases with database labels S2-S4 cannot.

When to Use

The access control mechanism ensures secure data storage and synchronization across devices. When creating a database, you need to correctly set the security level for the database.

Setting the Security Level for a KV Store

When a KV store is created, the securityLevel parameter specifies the security level of the KV store. The following example shows how to create a KV store with security level of S1.

For details about the APIs, see Distributed KV Store.

import distributedKVStore from '@ohos.data.distributedKVStore';

let kvManager;
let context = getContext(this);
const kvManagerConfig = {
  context: context,
  bundleName: 'com.example.datamanagertest'
}
try {
  kvManager = distributedKVStore.createKVManager(kvManagerConfig);
  console.info('Succeeded in creating KVManager.');
} catch (e) {
  console.error(`Failed to create KVManager. Code:${e.code},message:${e.message}`);
}
let kvStore;
try {
  const options = {
    createIfMissing: true,
    encrypt: true,
    backup: false,
    autoSync: true,
    kvStoreType: distributedKVStore.KVStoreType.SINGLE_VERSION,
    securityLevel: distributedKVStore.SecurityLevel.S1
  };
  kvManager.getKVStore('storeId', options, (err, store) => {
    if (err) {
      console.error(`Failed to get KVStore. Code:${err.code},message:${err.message}`);
      return;
    }
    console.info('Succeeded in getting KVStore.');
    kvStore = store;
  });
} catch (e) {
  console.error(`An unexpected error occurred. Code:${e.code},message:${e.message}`);
}

Setting the Security Level for an RDB Store

When an RDB store is created, the securityLevel parameter specifies the security level of the RDB store. The following example shows how to create an RDB store with security level of S1.

For details about the APIs, see RDB Store.

import relationalStore from '@ohos.data.relationalStore';

let store;
const STORE_CONFIG = {
  name: 'RdbTest.db',
  securityLevel: relationalStore.SecurityLevel.S1
};
let promise = relationalStore.getRdbStore(this.context, STORE_CONFIG);
promise.then(async (rdbStore) => {
  store = rdbStore;
  console.info('Succeeded in getting RdbStore.')
}).catch((err) => {
  console.error(`Failed to get RdbStore. Code:${err.code},message:${err.message}`);
})