1# Access Control by Device and Data Level 2 3 4## Basic Concepts 5 6Distributed data management implements access control based on data security labels and device security levels. 7 8A higher data security label and device security level indicate stricter encryption and access control measures and higher data security. 9 10 11### Data Security Labels 12 13The data can be rated into four security levels: S1, S2, S3, and S4. 14 15 | Risk Level| Security Level| Definition| Example| 16| -------- | -------- | -------- | -------- | 17| Critical| S4 | Special data types defined by industry laws and regulations, involving the most private individual information or data that may cause significant adverse impact on an individual or group once disclosed, tampered with, corrupted, or destroyed.| Political opinions, religious and philosophical belief, trade union membership, genetic data, biological information, health and sexual life status, sexual orientation, device authentication, and personal credit card information| 18| High| S3 | Data that may cause critical adverse impact on an individual or group once disclosed, tampered with, corrupted, or destroyed.| Individual real-time precise positioning information and movement trajectory| 19| Moderate| S2 | Data that may cause major adverse impact on an individual or group once disclosed, tampered with, corrupted, or destroyed.| Detailed addresses and nicknames of individuals| 20| Low| S1 | Data that may cause minor adverse impact on an individual or group once disclosed, tampered with, corrupted, or destroyed.| Gender, nationality, and user application records| 21 22 23### Device Security Levels 24 25Device security levels are classified into SL1 to SL5 based on devices' security capabilities, for example, whether a Trusted Execution Environment (TEE) or a secure storage chip is available. For example, the development boards RK3568 and Hi3516 are SL1 (lower security) devices, and tablets are SL4 (higher security) devices. 26 27During device networking, you can run the **hidumper -s 3511** command to query the device security level. The following example shows how to query the security level of the RK3568 board: 28 29 30 31 32## Access Control Mechanism in Cross-Device Synchronization 33 34In cross-device data synchronization, data access is controlled based on the device security level and data security labels. In principle, data can be synchronized only to the devices whose data security labels are not higher than the device's security level. The access control matrix is as follows: 35 36|Device Security Level|Data Security Labels of the Synchornizable Device| 37|---|---| 38|SL1|S1| 39|SL2|S1 to S2| 40|SL3|S1 to S3| 41|SL4|S1 to S4| 42|SL5|S1 to S4| 43 44For example, the security level of development boards RK3568 and Hi3516 is SL1. The database with data security label S1 can be synchronized with RK3568 and Hi3516, but the databases with database labels S2-S4 cannot. 45 46 47## When to Use 48 49The access control mechanism ensures secure data storage and synchronization across devices. When creating a database, you need to correctly set the security level for the database. 50 51 52## Setting the Security Level for a KV Store 53 54When a KV store is created, the **securityLevel** parameter specifies the security level of the KV store. The following example shows how to create a KV store with security level of S1. 55 56For details about the APIs, see [Distributed KV Store](../reference/apis/js-apis-distributedKVStore.md). 57 58 59 60```js 61import distributedKVStore from '@ohos.data.distributedKVStore'; 62 63let kvManager; 64let context = getContext(this); 65const kvManagerConfig = { 66 context: context, 67 bundleName: 'com.example.datamanagertest' 68} 69try { 70 kvManager = distributedKVStore.createKVManager(kvManagerConfig); 71 console.info('Succeeded in creating KVManager.'); 72} catch (e) { 73 console.error(`Failed to create KVManager. Code:${e.code},message:${e.message}`); 74} 75let kvStore; 76try { 77 const options = { 78 createIfMissing: true, 79 encrypt: true, 80 backup: false, 81 autoSync: true, 82 kvStoreType: distributedKVStore.KVStoreType.SINGLE_VERSION, 83 securityLevel: distributedKVStore.SecurityLevel.S1 84 }; 85 kvManager.getKVStore('storeId', options, (err, store) => { 86 if (err) { 87 console.error(`Failed to get KVStore. Code:${err.code},message:${err.message}`); 88 return; 89 } 90 console.info('Succeeded in getting KVStore.'); 91 kvStore = store; 92 }); 93} catch (e) { 94 console.error(`An unexpected error occurred. Code:${e.code},message:${e.message}`); 95} 96``` 97 98 99## Setting the Security Level for an RDB Store 100 101When an RDB store is created, the **securityLevel** parameter specifies the security level of the RDB store. The following example shows how to create an RDB store with security level of S1. 102 103For details about the APIs, see [RDB Store](../reference/apis/js-apis-data-relationalStore.md). 104 105 106 107```js 108import relationalStore from '@ohos.data.relationalStore'; 109 110let store; 111const STORE_CONFIG = { 112 name: 'RdbTest.db', 113 securityLevel: relationalStore.SecurityLevel.S1 114}; 115let promise = relationalStore.getRdbStore(this.context, STORE_CONFIG); 116promise.then(async (rdbStore) => { 117 store = rdbStore; 118 console.info('Succeeded in getting RdbStore.') 119}).catch((err) => { 120 console.error(`Failed to get RdbStore. Code:${err.code},message:${err.message}`); 121}) 122``` 123
