WO2009143631A1 - Authenticated database connectivity for unattended applications - Google Patents
Authenticated database connectivity for unattended applications Download PDFInfo
- Publication number
- WO2009143631A1 WO2009143631A1 PCT/CA2009/000759 CA2009000759W WO2009143631A1 WO 2009143631 A1 WO2009143631 A1 WO 2009143631A1 CA 2009000759 W CA2009000759 W CA 2009000759W WO 2009143631 A1 WO2009143631 A1 WO 2009143631A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- credentials
- target resource
- native
- credential manager
- requestor
- Prior art date
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/30—Authentication, i.e. establishing the identity or authorisation of security principals
- G06F21/44—Program or device authentication
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/60—Protecting data
- G06F21/62—Protecting access to data via a platform, e.g. using keys or access control rules
- G06F21/6218—Protecting access to data via a platform, e.g. using keys or access control rules to a system of files or objects, e.g. local or distributed file system or database
Definitions
- the present invention relates to security systems for computer systems. More particularly, it relates to methods and systems for credential management, particularly for granting access to resources to software applications without human intervention.
- hard-coded passwords have a drawback in that they entail a recurring software maintenance issue. Also, there are significant costs associated with human redevelopment effort and there is a potential for application outages due to synchronization errors and timing. [0005] Regardless of these drawbacks, hard-coded passwords remain in use for approximately 90% of all corporate applications. New applications are being developed and deployed that contain hard-coded passwords. Third-party (vendor) applications force corporations to accept and deploy systems containing hard-coded passwords. 70% of datacenter applications are database driven.
- Provisioning systems offer the ability to push operating system and software configuration updates to servers.
- there are significant difficulties of utilizing these solutions for the purposes of unattended applications they do not include run-time retrieval of credentials for use by unattended scripts and applications; they do not include credential access and management capabilities for automatic use by unattended scripts and applications; they offer no tamper resistance; and they offer no defence against static or dynamic analysis.
- Another option is the use of Public Key Infrastructures. Public Key
- Kerberos authentication protocol offers the components needed to create a comprehensive and elegant authentication and authorization solution.
- Kerberos authentication protocol offers the components needed to create a comprehensive and elegant authentication and authorization solution.
- it does not protect keying materials while in memory; it relies upon user interaction for access to authentication credentials; it relies on hard-coded passwords for authentication by unattended applications; it does not include credential access and management capabilities for automatic use by unattended scripts and applications; it offers no tamper resistance; it offers no defence against static or dynamic analysis or tampering of the application code; it dramatically shifts the authentication paradigm for corporations and incurs large integration and deployment efforts; and it requires that both the authenticator and the authenticatee be modified to make use of Kerberos for authentication purposes.
- a computer-implemented method for providing secure credentials for accessing a target resource when executed on one or more processors, causes the one or more processors to perform the following steps.
- a connection request to the target resource is received from a requestor application.
- the request is then decoded, such as by parsing, to extract information required by a credential manager to authenticate the requestor application and to retrieve the secure credentials, such as username and password, for accessing the target resource.
- the credential manager manages and stores credentials for the target resource.
- the extracted information is then securely communicated to the credential manager to retrieve the credentials.
- the secure communication can, for example, comprise encrypting communications to and from the credential manager.
- a native target resource connection request to the target resource is generated. This native target resource connection request is then passed to a native target resource connectivity component to establish a connection between the requestor application and the target resource.
- the method can implement Java Database
- Receiving the connection request comprises receiving a JDBC Uniform Resource Locator (URL) containing a target resource URL, and a target alias for retrieving the credentials from the credential manager, and generating the native target resource connection request comprises packaging the retrieved credentials with the target resource URL to provide a native JDBC URL.
- JDBC Java Connectivity
- APIs Application Programming Interfaces
- Receiving the connection request comprises receiving a JDBC Uniform Resource Locator (URL) containing a target resource URL, and a target alias for retrieving the credentials from the credential manager
- generating the native target resource connection request comprises packaging the retrieved credentials with the target resource URL to provide a native JDBC URL.
- the method can implement Open
- receiving the connection request comprises receiving an ODBC connection request containing a target alias for retrieving the credentials from the credential manager, and a connection string for the native target resource connectivity component, and generating the native target resource connection request comprises packaging the retrieved credentials with the connection string.
- a computer program product comprising a computer-readable medium storing computer executable instructions to provide secure credentials for accessing a target resource. When executed, the instructions cause the one or more processors to implement the following functional modules.
- a requestor interface is implemented to communicate with a requestor application to receive a connection request including target resource information identifying the target resource and configuration information necessary to authenticate the requestor application.
- a credential service interface is implemented to securely communicate with a credential manager that manages and stores credentials for the target resource.
- a native database connectivity interface is implemented to communicate with a native database connectivity component that establishes a connection with the target resource.
- a decision engine is implemented to communicate with each of the requestor interface, the credential service interface and the native database connectivity interface.
- the decision engine function to decode the request to determine an identity of the target resource and the configuration information required by the credential manager to authenticate the requestor application and to retrieve the secure credentials for accessing the target resource, the credential manager managing and storing credentials for the target resource; securely communicate the extracted information to the credential manager to retrieve the credentials; generate a native database connection request to the target resource, including the retrieved credentials; and pass the native database connection request to the native database connectivity component to establish the connection.
- Figure 1 is a block diagram of a prior art system for credential management
- Figure 2 is a block diagram of a system using a database connectivity component according to an embodiment of the invention.
- Figure 3 is a flowchart of a database connection using a database connectivity component and a credential manager according to an embodiment of the invention.
- Figure 4 is a block diagram of a database connectivity component according to an embodiment of the present invention.
- FIG. 1 illustrates a prior art system 10 for credential management, as described in U.S. Application No. 11/640,371 (U.S. Publication No. 2008/0148373), entitled “Simplified Management of Authentication Credentials for Unattended Applications,” the contents of which are incorporated herein by reference in their entirety.
- a requestor node 12 has resident on it a server password manager (SPM) module 14, a requestor application 16 and, optionally, a secure cache module 18.
- SPM server password manager
- the requestor node 12 communicates with a credential manager (CM) node 20 that implements a password authority system.
- the CM node 20 has resident on it a CM module 22 and a data store module 24.
- the requestor node 12 communicates with the CM node 20 to request access to resources 26 on target node 28.
- a VPN (virtual private network) module 30 may optionally be resident on the target node 28 to govern communications with either or both the CM node 20 and the requestor node 12.
- the requestor node 12, the CM node 20, and the target node 28 are all nodes in a computer network and may be single machine servers or a collection of interconnected servers.
- the various modules in FIG. 1 are software modules which interact with the hardware of the nodes to execute their instructions.
- the CM node 20 operates with the CM module 22 controlling the data store
- the requestor application 16 when it needs access to the resources 26, must request these credentials to gain access to the resources.
- the requestor application's request is communicated to the SPM module 14 residing on the same node as the requestor application 16.
- the SPM module 14 receives the request, extracts the relevant information from the request, and packages that information into a request package for transmission to the CM module.
- the SPM module 14 encrypts the request package using encryption keys generated by the CM module 22 and previously communicated to the SPM module 14.
- the SPM module 14 also transmits, with the encrypted request package, fingerprint data related to the requestor node 12.
- the CM module To communicate the credentials to the target resources 26, the CM module
- the CM module 22 may send these credentials directly to the target resources 26 along with an identification of the requestor application 16 which is to be granted access.
- the CM module 22 may return the credentials to the SPM module 14 so that the requestor application 16 may directly use these credentials to access the target resources 26.
- the CM module 22 may also communicate with the target resources 26 and its associated SPM module 32 for updates regarding changed credentials such as passwords and encryption keys.
- the SPM module 14 in the requestor node 12 may use the secure cache 18 to store credentials for the requestor application 16 so that future accesses to the target resources need not go through the CM module 22.
- encryption keys generated by the CM module 22 and used by the SPM module 14 to encrypt/decrypt communications with the CM module 22 may also be stored in the secure cache 18.
- each SPM module 14, 32 must, before being able to execute the process outlined above, identify itself to the CM module 22 and receive unique encryption keys for use in communicating with the CM module 22.
- each SPM module 14, 32 gathers data about its node 12, 28 including what resources may be target resources, what applications may be requestor applications, and the details regarding these resources and applications.
- the SPM module 14, 32 also gathers configuration information for its node such as the hardware installed on the node and other configuration information that would uniquely identify that node. This configuration information (which may include serial numbers, applications installed on the node, version numbers of both software and hardware installed) may then be used as a "fingerprint" of that node.
- the fingerprint data may collected on one node can then be sent, along with the other information on that specific node, to the CM node 20 for validation.
- a requestor node, and the SPM module resident on it can request access to resources registered with the CM module 22.
- the requestor applications resident on nodes registered with the CM module 22 are permitted to access the target resources 26.
- New applications on a node must register and be validated by the CM module 22 prior to being able to request access to the target resources.
- each SPM module must provide its node's fingerprint data every time a requestor application resident on its node asks for access. As mentioned above, this fingerprint data is transmitted to the CM module 22 along with the relevant information relating to the target resource access request by the requestor application.
- the CM module 22 can retrieve the registration data for that particular node from the data store 24 to check if the fingerprint data received from the requester node matches the fingerprint data received when the requestor node was first validated. If there is a match, then the SPM module is what it purports to be and further checking may proceed. If there is no match, then the resource access request is denied.
- CM module generates cryptographic keys which are to be used in communications between the CM module 22 and the SPM module or requestor node. These cryptographic keys are, once a copy has been sent to the relevant SPM module/requestor node, kept in the data store 24 for use by the CM module.
- a requestor node may have more than one SPM module resident on it, with each SPM module being tasked with managing target resource access for at least one requestor application on the requestor node.
- each SPM module may have its own set of cryptographic keys for use in communicating with the CM module.
- For greater security one may have a configuration in which each requestor application has its own encryption keys shared with the CM module for use when communicating between the two.
- Each requestor application along with its associated SPM module and the node it is resident on, is registered and validated with the CM module.
- the requestor application asks for such access and transmits data that it originally transmitted to the CM module when it sought validation and registration.
- data may include its application name, its application file storage location, its application execution path, its application identification (ID), its application one-way hash value, its session authorization key, and the machine fingerprint of the node it is resident on.
- ID application identification
- the data store may be in the form of a database.
- Critical values may be encrypted using a strong cipher for storage in a database field in the database.
- Critical encrypted data may be written into a private database using a long, strong password, the private database being part of the database.
- This private database may then be protected using a password that is encrypted using a managed symmetric key.
- the managed key may then be placed in a public database table to allow the key to be changed in an ad hoc or scheduled manner.
- Each target resource e.g. an application on a target server
- Each target resource may be associated with a specific alias.
- Also associated with the alias are the target resource's credentials (e.g. account and password).
- a potential requestor application which may request access to the target resource, when registered/validated, is then mapped to the alias along with that requestor application's access rights and any run-time criteria required for the release of credentials for access to the target resource. This injects a level of indirection for retrieving credentials - it allows credentials to change without any impact on the requestor application. Requestor applications, therefore, need not be individually notified if credentials required to access a specific resource are changed.
- the SPM module 14 may use the secure cache 18 so that previously accessed resources may be accessed by other requestor applications on the same node. This will allow faster access to resources for requestor applications.
- credentials received from the CM module 22 may be saved in the secure cache 18.
- the SPM module 14 can authenticate the requestor application locally and provide the necessary credentials.
- the contents of the secure cache may be encrypted and the contents may be time limited in that the contents may be automatically deleted after a predetermined amount of time.
- the CM module may change the credentials for these resources.
- the CM module 22 can communicate with the resources (e.g. a software application) to change the credentials required to access the resources. Once the credentials have been changed, the new credentials are communicated to the CM module 22. The CM module 22 then updates the relevant records in the data store 24.
- the system illustrated in Figure 1 provides secure credential management for unattended applications.
- the SPM modules 14, 32 must be integrated with the requestor application and the target node 28, requiring skilled programmers and changes to the code of the requestor application 16. To encourage adoption of secure password authority systems within large enterprises running legacy applications, it is, therefore, desirable to provide a means to interface with the password authority system without requiring specialized recoding or programming knowledge.
- the present invention provides a method and system through which it is possible to authenticate database connections for unattended requestor applications by installing and configuring a SPM target resource connectivity component (hereafter "SPM connectivity component"), without need to recode the requestor application.
- SPM database connectivity component intercepts requests for a target resource, repackages the requests in a form comprehensible to a credential manager, accesses secure credentials from the credential manager, and passes the credentials to the target resource.
- the credential manager can, for example, be a CM node as described above, such as the CloakWare ® Server Password Manager or other available credential managers.
- Figure 2 depicts the overall system architecture of an embodiment of the invention.
- a requestor node 100 has resident on it a requestor application 102 that requires access to a target resource(s) 104 resident at a target node 106.
- An SPM connectivity component 108 interposed between the requestor application 102 and native target resource connectivity component 110 (hereafter "native connectivity component"), intercepts requests from the requestor application 102 for access to the target resource 104, and routes them to a credential manager (CM) 112, resident at the requestor node 102, or resident at a CM node 114, as illustrated.
- Native connectivity components are known components that provide database connections for a requestor application by implementing standard database connection Application Programming Interfaces (APIs), such as, for example, JDBC or ODBC. The connections may be database specific.
- APIs Application Programming Interfaces
- the credential manager 112 is a component deployed to or available to a requestor node 100.
- the credential manager 112 coordinates credential requests for local requestor applications.
- the credential manager 112 typically provides API's for varying types of requestor applications.
- the CM node 114 includes the components and functionality described above in relation to Figure 1.
- the requestor node 100, the CM node 114, and the target node 106 are all nodes in a computer network and may be single machine servers or a collection of interconnected servers.
- the various modules in Figure 2 are software modules which interact with the hardware of the nodes to execute their instructions.
- the overall operation of a credential management system using the SPM connectivity component 108 is illustrated in Figure 3, with reference to Figure 2.
- the requestor application 102 requests connection to a target resource 104, such as a database (step 150).
- the SPM connectivity component 108 intercepts or receives this request (step 152), and decodes the connection request (step 154).
- the SPM connectivity component requests credentials from the credential manager 112 (step 156).
- the credential manager 1 12 authenticates the request, and returns the necessary credentials to fulfill the request to the SPM connectivity component 108 (step 158).
- the SPM connectivity component 108 initializes a native database connection through the native connectivity component 1 10 using the credentials supplied by the credential manager 112 (step 160).
- the native connectivity component 110 then establishes, or attempts to establish, a connection to the external target system hosting the target resources 104 (step 162). If the credentials are valid, and the connection is established, an established connection to the target 104 is returned to the requestor application 102 (step 164). If the attempt to establish the connection is not successful, an optional retry can be executed. Further credentials are retrieved from the credential manager 112, and a connection retry is attempted commencing at step 156. The number of acceptable retries is a matter of design choice. [0036] As shown in Figure 4, the SPM connectivity component 108 is a software module. It is deployed in conjunction with the native database connectivity component 110 and the credential manager 112.
- the SPM connectivity component 108 comprises a requestor interface 180 for communicating with the requestor application 102, a credential service interface 182 for communicating with the credential manager 112, a native target resource connectivity interface 184 for communicating with native connectivity components, a security interface 186 for allowing for updates from a security manager, and a decision engine 188 for determining how to convert a request from a requestor to an appropriate API call to the credential manager 112.
- the SPM connectivity component provides an authenticated and authorized database connection for a requestor application.
- the SPM connectivity component serves as the database connectivity component which retrieves database, or other target resource, credentials on a real time basis, without requiring code changes to the requestor application where native connectivity components are dynamically loaded.
- the SPM connectivity component authenticates and authorizes all access for database connections for requestor applications.
- SPM connectivity component 108 can best be understood with reference to example implementations. Two example embodiments are described below: a JDBC SPM connectivity component, and an ODBC SPM connectivity component. These examples are non-limiting, and illustrative only. The examples assume a familiarity with Java programming, and with JDBC and ODBC connections, as is expected from someone of skill in the art.
- JDBC is an API for the Java programming language that defines how a client may access a database. It provides methods for querying and updating data in a database.
- the JDBC uses a custom Java DataSource object.
- a DataSource object is the representation of a data source in the Java programming language. In basic terms, a data source is a facility for storing data. It can be as sophisticated as a complex database for a large corporation or as simple as a file with rows and columns. A data source can reside on a remote server, or it can be on a local desktop machine. Applications access a data source using a connection, and a DataSource object can be thought of as a factory for connections to the particular data source that the DataSource instance represents.
- the custom Java DataSource object encapsulates the call to a data source or target resource, and transparently accesses the credential manager 112 to retrieve the secure credentials needed to access the data source.
- the role of the SPM connectivity component 108 is the transparent management of authentication in the database connection acquisition.
- a proxy JDBC Driver class referred to herein as an SPM Proxy Driver, is provided and implements the decision engine 188.
- This proxy Driver class operates on a specially defined URL that encodes all information required for the true underlying JDBC connection management and Driver utilization, managed by the native connectivity component 110.
- This proxy class is specified, by a user during configuration, as the Driver class for any database. The user can then encode the necessary JDBC URL information in a standard way.
- the JDBC Proxy Driver behaves as a normal JDBC driver, but is transparently performing delegated JDBC driver invocations, and calls to the credential manager 112.
- the proxy JDBC Driver class uses a specialized JDBC URL encoding which will be referred to as an SPM JDBC URL, details of which are provided below. Functionally, the SPM Proxy Driver obeys all requirements and follow all conventions of use that apply to a Java JDBC Driver class.
- each target resource e.g. an application on a target server
- the target resource's credentials e.g. account and password.
- a potential requestor application which requests access to the target resource, when registered/validated, is then mapped to the alias along with that requestor application's access rights and any run-time criteria required for the release of credentials for access to the target resource. This injects a level of indirection for retrieving credentials - it allows credentials to change without any impact on the requestor application. Requestor applications, therefore, need not be individually notified if credentials required to access a specific resource are changed.
- the custom designated URL property is defined to declare the exact driver class that the SPM Proxy Driver should use as the true (target) JDBC Driver. In all connection attempts, the credentials, such as user/password, are obtained from the credential manager 112. T he SPM Proxy Driver ignores all caller-supplied user/password instances.
- the SPM Proxy Driver can preferably also handle cases of failure or error in the invocation of the credential manager 112. To treat these cases, certain SPM specific exceptions, necessarily derived from SQLException, can be defined.
- the core class for the SPM JDBC proxying is the SPM Proxy Driver class, which implements the Java. sql. Driver interface and contains all of the required service implementations.
- the SPM Proxy Driver class manages all SPM JDBC URL's. More specifically: a single instance of the SPM Proxy Driver class registered with a driver manager manages all SPM JDBC URL's. This means that different databases may be accessed concurrently through a single SPM Proxy Driver instance.
- the SPM JDBC URL is a custom JDBC URL that encodes a true JDBC URL along with addition information for proxying the Driver and for handling and managing the credentials through the credential manager 112.
- Pn Vn where spm: is the literal prefix "spm:"; [url] is a true JDBC (base) URL which is user specific such as j dbc : hsqldb : hsql : / /localhost : 9001 /cspml each Pi is a property name for a property of the true JDBC URL or else one of the SPM distinguished properties SPMAlias or SPMDriver;
- SPMAlias must appear in the Pi list. Its value must be the intended SPM Alias for use in the user/password lookup;
- SPMDriver may appear in the Pi list and if so must be a valid JDBC Driver for the [url] value.
- the SPM properties are rendered into a Java Properties map from which the true JDBC Driver can acquire the values.
- the decision engine 188 is implemented within the SPM Proxy Driver class, and decodes or parses the SPM JDBC URL into relevant parts that it will use internally. These parts are:
- the Original URL Defined as the SPM JDBC URL as specified.
- the Driver URL defined as the SPM JDBC URL with any occurrences of SPMAlias and SPMDriver removed (also occurrences of user and password removed).
- the SPM Alias defined as the value of the required SPMAlias property.
- the Driver Class Name defined as the value of the SPMDriver property if present and null otherwise.
- the SPM Proxy Driver class obtains and holds the target JDBC Driver to call for the SPM JDBC URL connect by using an instance of the class named by the value of the property SPMDriver, if present, or otherwise by lookup for a driver which accepts the [url] (the Base URL). In either case, the acquisition of the target Driver can occurs by lookup through the DriverManager class. And, implementing the Java. sql.
- the SPM Proxy Driver stores all of the data required for establishing connections for a given SPM JDBC URL, such as the configuration or fingerprint information of the requestor application or server, in an instance of the JdbcDriverUrlEntry class.
- the JdbcDriverUrlEntry instances can be stored in a cache keyed by the SPM JDBC URL.
- the JDBC implementation of the SPM connectivity component provides a
- Java library e.g. jar file with JavaDoc
- JavaDoc JavaDoc
- the end user only needs to add the library with the driver and associated classes to the classpath of the requestor application Server; and configure DataSources in the requestor application server to use the SPM Proxy JDBC drivers specifying an SPM JDBC URL.
- attributes in the configuration file are modified to set the connection-url as specified previously, and to set the driver-class to the SPM JDBC Driver
- the SPM Proxy Driver class and its affiliated classes form an isolated component that can be separately deployed. It has integration dependencies on the cspmclient.jar library, possibly Iog4j (or other logging system) when integrated, and the vendor-specific JDBC Driver classes as declared in configuration through the SPM JDBC URL.
- connection request is made by the requestor application 102 supplying a
- the request is received by the SPM Proxy Driver, which first checks if the received URL is a SPM JDBC URL and thus handled by the class. If the URL is not a SPM JDBC URL, the connection request fails. If the URL is a SPM JDBC URL, then the required JdbcDriverUrlEntry instance is obtained from the JdbcDriverUrlEntryCache.
- the associateDriver service of the JdbcUrlDriverEntryCache class is responsible for locating the target JDBC Driver that is associated with (bound to) a SPM JDBC URL in a JdbcUrlDriverEntry instance. The cache entry is created at this point if it does not exist.
- a call is made to the credential manager 112 to retrieve the necessary secure credentials, such as a username and password, in each iterated attempt.
- Communication between the credential manager 112 and the SPM connectivity component embodied by the SPM Proxy Driver is preferably encrypted to avoid detection or interception by unauthorized parties.
- the encryption is previously negotiated between the credential manager 112 and the SPM Proxy Driver, and may, for example, involve an exchange of encryption keys.
- the credential manager 112 returns the secure credentials necessary to establish a connection with the target resource 26. On each attempt, a call is then made to the native target JDBC driver to obtain a connection.
- the parameters used are the base JDBC URL and a properties object containing the merged properties from the JdbcDriverUrlEntry instance and the properties provided by the requestor application 102.
- the credentials such as a hard-coded username and password
- a connection is returned immediately to the requestor application 102 if one is obtained. Otherwise, a retry can be initiated as described above in relation to Figure 3, or an SQLException can be thrown to the caller.
- This low-level driver management for connection acquisition means that all new connections obtained for a user whose database password has been changed (e.g. by the credential manager 112) are made using the new password. This action occurs automatically without any knowledge or intervention by any owning data source.
- Such connection management by the SPM JDBC driver ensures that database password changes are completely transparent to the data source's activities.
- an custom SPM ODBC driver is provided.
- ODBC provides a standard software API method for accessing target resources, such as database management systems.
- the driver uses a credential manager COM object to retrieve the credentials from the credential manager 112 when a request to connect to the database is made from the requestor application 102.
- the request is then passed to the native target ODBC driver to complete the transition.
- the SPM ODBC driver implements all ODBC 2.0 functions and some of the deprecated ODBC 1.0 functions for backward compatibility.
- the SPM ODBC Driver implements the decision engine 188.
- the SPM ODBC Driver connection string contains the following information: Driver - the name of SPM ODBC Driver; Alias - the target Alias to send to the credential manager 112 when retrieving the credentials; and TargetDriver - the connection string for the target driver.
- the TargetDriver string contains all of the information required by the target driver, but does not contain the userld and/or password.
- the SPM ODBC Driver needs to add functionality to three functions:
- SQLConnect - creates a connection to a database using a predefined DSN
- SQLDriverConnect - creates a connection to a database using a connection string
- ConfigDSN - creates, modifies or deletes a DSN.
- the SQLConnect function has 7 parameters. The first parameter is passed when calling the API function SQLConnect. The second and third parameters are used to retrieve the configuration. The remaining 4 parameters, username and password, are ignored.
- the driver's SQLConnect function When the driver's SQLConnect function is called, it will: retrieve the Target Alias and Target DSN; retrieve the credentials using the Target Alias; and call the API function SQLConnect function passing the Target DSN and the credentials retrieved from the credential manager.
- the SQLDriverConnect function has 8 parameters. The third and forth parameters are used to retrieve the configuration information. The remaining parameters are passed down when the API function SQLDriverConnect is called.
- SQLDriverConnect When the driver's SQLDriverConnect function is called, it will: extract the Target Alias and Target Driver from the connection string; retrieve the credentials using the Target Alias; create a copy of the Target Driver connection string and add the credentials (user id and password) retrieved from the credential manager 112; and call the API function SQLDriverConnect function passing the update copy of Target Driver connection string.
- Embodiments of the invention can be represented as a software product stored in a machine-readable medium (also referred to as a computer-readable medium, a processor-readable medium, or a computer usable medium having a computer-readable program code embodied therein).
- the machine-readable medium can be any suitable tangible medium, including magnetic, optical, or electrical storage medium including a diskette, compact disk read only memory (CD-ROM), memory device (volatile or nonvolatile), or similar storage mechanism.
- the machine-readable medium can contain various sets of instructions, code sequences, configuration information, or other data, which, when executed, cause a processor to perform steps in a method according to an embodiment of the invention.
- Those of ordinary skill in the art will appreciate that other instructions and operations necessary to implement the described invention can also be stored on the machine-readable medium.
- Software running from the machine-readable medium can interface with circuitry to perform the described tasks.
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- General Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- Software Systems (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- General Health & Medical Sciences (AREA)
- Bioethics (AREA)
- Health & Medical Sciences (AREA)
- Databases & Information Systems (AREA)
- Storage Device Security (AREA)
Abstract
Description
Claims
Priority Applications (6)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
EP09753392A EP2281263A4 (en) | 2008-05-30 | 2009-06-01 | Authenticated database connectivity for unattended applications |
JP2011510795A JP5635978B2 (en) | 2008-05-30 | 2009-06-01 | Authenticated database connection for applications without human intervention |
US12/992,325 US8839414B2 (en) | 2008-05-30 | 2009-06-01 | Authenticated database connectivity for unattended applications |
CN200980126751.5A CN102089767B (en) | 2008-05-30 | 2009-06-01 | Authenticated database connectivity for unattended applications |
KR1020107029804A KR101720160B1 (en) | 2008-05-30 | 2009-06-01 | Authenticated database connectivity for unattended applications |
CA2725992A CA2725992C (en) | 2008-05-30 | 2009-06-01 | Authenticated database connectivity for unattended applications |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US5755708P | 2008-05-30 | 2008-05-30 | |
US61/057,557 | 2008-05-30 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2009143631A1 true WO2009143631A1 (en) | 2009-12-03 |
Family
ID=41376526
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CA2009/000759 WO2009143631A1 (en) | 2008-05-30 | 2009-06-01 | Authenticated database connectivity for unattended applications |
Country Status (7)
Country | Link |
---|---|
US (1) | US8839414B2 (en) |
EP (1) | EP2281263A4 (en) |
JP (1) | JP5635978B2 (en) |
KR (1) | KR101720160B1 (en) |
CN (1) | CN102089767B (en) |
CA (1) | CA2725992C (en) |
WO (1) | WO2009143631A1 (en) |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP3037303A4 (en) * | 2013-08-22 | 2017-04-12 | Hitachi Automotive Systems, Ltd. | Vehicle control device |
Families Citing this family (33)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP2363806A1 (en) * | 2010-03-03 | 2011-09-07 | Software AG | Connection handler and method for providing applications with heterogeneous connection objects |
US8935705B2 (en) | 2011-05-13 | 2015-01-13 | Benefitfocus.Com, Inc. | Execution of highly concurrent processing tasks based on the updated dependency data structure at run-time |
US20130132372A1 (en) * | 2011-11-17 | 2013-05-23 | Benefitfocus.Com | Systems and methods for dynamic service integration |
US11281690B1 (en) * | 2013-02-27 | 2022-03-22 | Amazon Technologies, Inc. | Dynamic identification and retrieval of connection strings |
JP6343900B2 (en) * | 2013-10-10 | 2018-06-20 | 富士通株式会社 | Communication terminal, communication processing method, and communication processing program |
US9417932B2 (en) | 2013-10-28 | 2016-08-16 | International Business Machines Corporation | Launching and managing unattended application programs |
EP3069231B1 (en) * | 2013-11-13 | 2020-11-04 | Palo Alto Networks, Inc. | Automated sdk ingestion |
GB2523350A (en) * | 2014-02-21 | 2015-08-26 | Ibm | Implementing single sign-on in a transaction processing system |
US9811263B1 (en) * | 2014-06-30 | 2017-11-07 | Altera Corporation | Memory controller architecture with improved memory scheduling efficiency |
US10798077B1 (en) * | 2015-01-23 | 2020-10-06 | Hewlett-Packard Development Company, L.P. | Securely authenticating untrusted operating environments |
US10348866B2 (en) * | 2016-02-19 | 2019-07-09 | Wuhan Mbaas Computing Co. Ltd. | Apparatus, system and method to provide IoT cloud backend service |
US10841337B2 (en) | 2016-11-28 | 2020-11-17 | Secureworks Corp. | Computer implemented system and method, and computer program product for reversibly remediating a security risk |
US20180225325A1 (en) * | 2017-02-07 | 2018-08-09 | International Business Machines Corporation | Application resiliency management using a database driver |
CN107071052B (en) * | 2017-02-17 | 2021-08-24 | 尹智帅 | Device, system and method for providing cloud back-end service for Internet of things equipment |
US10735470B2 (en) | 2017-11-06 | 2020-08-04 | Secureworks Corp. | Systems and methods for sharing, distributing, or accessing security data and/or security applications, models, or analytics |
US10594713B2 (en) | 2017-11-10 | 2020-03-17 | Secureworks Corp. | Systems and methods for secure propagation of statistical models within threat intelligence communities |
US10931630B2 (en) * | 2017-11-16 | 2021-02-23 | Servicenow, Inc. | System and method for connecting using aliases |
US10785238B2 (en) | 2018-06-12 | 2020-09-22 | Secureworks Corp. | Systems and methods for threat discovery across distinct organizations |
US11003718B2 (en) | 2018-06-12 | 2021-05-11 | Secureworks Corp. | Systems and methods for enabling a global aggregated search, while allowing configurable client anonymity |
US10693968B2 (en) * | 2018-09-12 | 2020-06-23 | Pivotal Software, Inc. | Secure binding workflow |
US11442899B2 (en) * | 2019-03-19 | 2022-09-13 | Servicenow, Inc. | Systems and methods for improved application programing interface (API) retry handling |
US11374938B2 (en) * | 2019-04-23 | 2022-06-28 | Jpmorgan Chase Bank, N.A. | Database-agnostic secure structured database connector |
US11310268B2 (en) | 2019-05-06 | 2022-04-19 | Secureworks Corp. | Systems and methods using computer vision and machine learning for detection of malicious actions |
US11418524B2 (en) | 2019-05-07 | 2022-08-16 | SecureworksCorp. | Systems and methods of hierarchical behavior activity modeling and detection for systems-level security |
US11381589B2 (en) | 2019-10-11 | 2022-07-05 | Secureworks Corp. | Systems and methods for distributed extended common vulnerabilities and exposures data management |
US11522877B2 (en) | 2019-12-16 | 2022-12-06 | Secureworks Corp. | Systems and methods for identifying malicious actors or activities |
CN111339552B (en) * | 2020-02-12 | 2022-05-17 | 厦门网宿有限公司 | Database access method and device |
CN111753270B (en) * | 2020-06-28 | 2023-04-07 | 支付宝(杭州)信息技术有限公司 | Application program login verification method, device, equipment and storage medium |
US11588834B2 (en) | 2020-09-03 | 2023-02-21 | Secureworks Corp. | Systems and methods for identifying attack patterns or suspicious activity in client networks |
US11528294B2 (en) | 2021-02-18 | 2022-12-13 | SecureworksCorp. | Systems and methods for automated threat detection |
US12034751B2 (en) | 2021-10-01 | 2024-07-09 | Secureworks Corp. | Systems and methods for detecting malicious hands-on-keyboard activity via machine learning |
US12015623B2 (en) | 2022-06-24 | 2024-06-18 | Secureworks Corp. | Systems and methods for consensus driven threat intelligence |
CN116244361B (en) * | 2022-12-23 | 2023-10-10 | 北京柏睿数据技术股份有限公司 | Method and system for dynamic persistence processing of database connection |
Citations (9)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US5937159A (en) * | 1997-03-28 | 1999-08-10 | Data General Corporation | Secure computer system |
US6006333A (en) * | 1996-03-13 | 1999-12-21 | Sun Microsystems, Inc. | Password helper using a client-side master password which automatically presents the appropriate server-side password to a particular remote server |
US6006018A (en) * | 1995-10-03 | 1999-12-21 | International Business Machines Corporation | Distributed file system translator with extended attribute support |
US6052785A (en) * | 1997-11-21 | 2000-04-18 | International Business Machines Corporation | Multiple remote data access security mechanism for multitiered internet computer networks |
US6668327B1 (en) * | 1999-06-14 | 2003-12-23 | Sun Microsystems, Inc. | Distributed authentication mechanisms for handling diverse authentication systems in an enterprise computer system |
US20050005090A1 (en) | 2003-07-01 | 2005-01-06 | International Business Machines Corporation | Method and system for dynamic client authentication in support of JAAS programming model |
US20050108521A1 (en) * | 2003-07-07 | 2005-05-19 | Silhavy James W. | Multi-platform single sign-on database driver |
US20060156023A1 (en) | 2005-01-13 | 2006-07-13 | Bea Systems, Inc. | Credential mapping of WebLogic and database user ids |
US20080148373A1 (en) | 2006-12-18 | 2008-06-19 | Garney David Adams | Simplified management of authentication credentials for unattended applications |
Family Cites Families (12)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
JP2002157226A (en) * | 2000-11-16 | 2002-05-31 | Nec Corp | Centralized password managing system |
JP2002278931A (en) * | 2001-03-21 | 2002-09-27 | Sony Communication Network Corp | Method and system for managing log-in |
JP4109874B2 (en) | 2002-02-05 | 2008-07-02 | キヤノン株式会社 | Information processing apparatus, control method therefor, program, and recording medium |
US7178163B2 (en) * | 2002-11-12 | 2007-02-13 | Microsoft Corporation | Cross platform network authentication and authorization model |
US7644275B2 (en) * | 2003-04-15 | 2010-01-05 | Microsoft Corporation | Pass-thru for client authentication |
KR100483700B1 (en) * | 2003-12-03 | 2005-04-19 | 주식회사 잉카인터넷 | Method to cut off an illegal process access and manipulation for the security of online game client by real-time |
JP2006005980A (en) | 2004-06-15 | 2006-01-05 | Fujitsu Access Ltd | Power circuit |
US7581248B2 (en) * | 2004-06-28 | 2009-08-25 | International Business Machines Corporation | Federated identity brokering |
JP2006059280A (en) * | 2004-08-24 | 2006-03-02 | Mitsubishi Electric Corp | Electronic equipment |
EP1712975A1 (en) * | 2005-04-14 | 2006-10-18 | Nederlandse Organisatie Voor Toegepast-Natuurwetenschappelijk Onderzoek Tno | Method and system for authenticating a terminal or terminal user |
KR100748697B1 (en) * | 2006-03-17 | 2007-08-13 | 삼성전자주식회사 | Method and system for distributed database multiple connection with application |
JP2008059187A (en) | 2006-08-30 | 2008-03-13 | Idea Collaborations Co Ltd | Network authentication system using proxy |
-
2009
- 2009-06-01 JP JP2011510795A patent/JP5635978B2/en not_active Expired - Fee Related
- 2009-06-01 CA CA2725992A patent/CA2725992C/en not_active Expired - Fee Related
- 2009-06-01 EP EP09753392A patent/EP2281263A4/en not_active Ceased
- 2009-06-01 WO PCT/CA2009/000759 patent/WO2009143631A1/en active Application Filing
- 2009-06-01 US US12/992,325 patent/US8839414B2/en active Active
- 2009-06-01 CN CN200980126751.5A patent/CN102089767B/en not_active Expired - Fee Related
- 2009-06-01 KR KR1020107029804A patent/KR101720160B1/en active IP Right Grant
Patent Citations (9)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US6006018A (en) * | 1995-10-03 | 1999-12-21 | International Business Machines Corporation | Distributed file system translator with extended attribute support |
US6006333A (en) * | 1996-03-13 | 1999-12-21 | Sun Microsystems, Inc. | Password helper using a client-side master password which automatically presents the appropriate server-side password to a particular remote server |
US5937159A (en) * | 1997-03-28 | 1999-08-10 | Data General Corporation | Secure computer system |
US6052785A (en) * | 1997-11-21 | 2000-04-18 | International Business Machines Corporation | Multiple remote data access security mechanism for multitiered internet computer networks |
US6668327B1 (en) * | 1999-06-14 | 2003-12-23 | Sun Microsystems, Inc. | Distributed authentication mechanisms for handling diverse authentication systems in an enterprise computer system |
US20050005090A1 (en) | 2003-07-01 | 2005-01-06 | International Business Machines Corporation | Method and system for dynamic client authentication in support of JAAS programming model |
US20050108521A1 (en) * | 2003-07-07 | 2005-05-19 | Silhavy James W. | Multi-platform single sign-on database driver |
US20060156023A1 (en) | 2005-01-13 | 2006-07-13 | Bea Systems, Inc. | Credential mapping of WebLogic and database user ids |
US20080148373A1 (en) | 2006-12-18 | 2008-06-19 | Garney David Adams | Simplified management of authentication credentials for unattended applications |
Non-Patent Citations (1)
Title |
---|
See also references of EP2281263A4 * |
Cited By (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
EP3037303A4 (en) * | 2013-08-22 | 2017-04-12 | Hitachi Automotive Systems, Ltd. | Vehicle control device |
Also Published As
Publication number | Publication date |
---|---|
US20110093937A1 (en) | 2011-04-21 |
US8839414B2 (en) | 2014-09-16 |
KR20110034622A (en) | 2011-04-05 |
CN102089767A (en) | 2011-06-08 |
JP2011522315A (en) | 2011-07-28 |
KR101720160B1 (en) | 2017-04-10 |
JP5635978B2 (en) | 2014-12-03 |
CA2725992C (en) | 2018-01-16 |
CA2725992A1 (en) | 2009-12-03 |
CN102089767B (en) | 2015-01-21 |
EP2281263A4 (en) | 2011-08-03 |
EP2281263A1 (en) | 2011-02-09 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
CA2725992C (en) | Authenticated database connectivity for unattended applications | |
AU2019206006B2 (en) | System and method for biometric protocol standards | |
EP2115654B1 (en) | Simplified management of authentication credentials for unattended applications | |
JP6625636B2 (en) | Identity infrastructure as a service | |
JP5795604B2 (en) | Method and apparatus for providing trusted single sign-on access to applications and Internet-based services | |
US9130920B2 (en) | Monitoring of authorization-exceeding activity in distributed networks | |
JP4853939B2 (en) | Offline access in document control systems | |
US20150121498A1 (en) | Remote keychain for mobile devices | |
US20070297615A1 (en) | Computing Device with a Process-Based Keystore and method for Operating a Computing Device | |
CN108701094A (en) | The safely storage and distribution sensitive data in application based on cloud | |
US11716312B1 (en) | Platform for optimizing secure communications | |
Del Vecchio et al. | Evaluating Grid portal security | |
Salecha | Security and Secrets Management | |
Albayati et al. | Profile Based Access Control Model Using JSON Web Tokens | |
Ochoa | Security for Java Web Applications Using Apache Shiro | |
CN116629855A (en) | Data access method, application information configuration method, related device and equipment | |
Castro et al. | Runtime adaptive multi-factor authentication for mobile devices | |
Çelikkan | Configuring AIX 5L for Kerberos Based Authentication Using Network Authentication Service | |
Ashraf et al. | Implementation of a single sign on based authetication system | |
JP2010218264A (en) | Information processing system, database access method, and program |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
WWE | Wipo information: entry into national phase |
Ref document number: 200980126751.5 Country of ref document: CN |
|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 09753392 Country of ref document: EP Kind code of ref document: A1 |
|
WWE | Wipo information: entry into national phase |
Ref document number: 12992325 Country of ref document: US |
|
ENP | Entry into the national phase |
Ref document number: 2725992 Country of ref document: CA |
|
WWE | Wipo information: entry into national phase |
Ref document number: 8459/DELNP/2010 Country of ref document: IN |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2011510795 Country of ref document: JP |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
WWE | Wipo information: entry into national phase |
Ref document number: 2009753392 Country of ref document: EP |
|
ENP | Entry into the national phase |
Ref document number: 20107029804 Country of ref document: KR Kind code of ref document: A |