| Prev | Next | Start of Chapter | Next Chapter | Contents | Glossary | Index | Comments | (4 out of 4)

Defining Network Security for a KB

G2 provides network access security by using configuration statements such as this:

where configuration-statements define the level of access you permit.

As with all configuration statements, network access configurations can affect items within the workspace hierarchy that use Item-configuration, or items in a particular class hierarchy that use Instance-configuration.

Using Configuration Statements for Network Access

By using the set up network access as follows: configuration statements, you can allow or prohibit different kinds of network access, using several clauses as follows. For a complete description of using configurations, see Chapter 7, Configurations.

This configuration clause... Allows or prohibits...
Connect
Other G2 processes, G2 Gateway, or Telewindows from connecting. This configuration can be set only in the KB Configuration system table.
Read
Another G2 process from reading variable values. You cannot allow or prohibit read access to or from G2 Gateway and Telewindows.
Write
Another G2 process from writing variable values. You cannot allow or prohibit write access to or from G2 Gateway and Telewindows.
Execute
Execute access to any item from another G2 process or from G2 Gateway.
Inform
Messages being sent to the operator (the message board) from another G2 process.

Allowing or Prohibiting Connect Access

The allow/prohibit connect clauses are different from other configurations in these ways:

For example, if you prohibit connect access to an entire KB by adding the configuration statement to the KB Configuration system table, you cannot override that prohibitive state with a subsequent configuration statement.

When you require network access with security, you can configure the KB to allow network access at a broad level, and prohibit access at specific levels. For example, to implement network access with security, you could allow connect access but restrict reading, writing, and executing objects that need to be hidden. In this way, you can provide a restricted KB view to an external connecting process, while still allowing network access.

Prohibiting access can be absolute, by including a prohibit absolutely clause in the configuration statement, which indicates that no other configuration clauses anywhere in the class hierarchy can override the configuration.

| Prev | Next | Start of Chapter | Next Chapter | Contents | Glossary | Index | Comments | (4 out of 4)

Copyright © 1997 Gensym Corporation, Inc.