# US 10,872,165 B2 · Apparatus and method for providing a secure database access > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,872,165 B2 - Document ID: US10872165B2 - Status: Granted - Kind: B2 - Application number: 16/609,057 - Filed: 2018-04-10 - Published: 2020-06-25 - Granted: 2020-12-22 - Earliest claimed: 2017-05-10 - Assignees: Siemens Aktiengesellschaft - Applicants: Siemens Aktiengesellschaft - Inventors: Fabienne Waidelich; Igor Liebermann - Web page: https://patentgrep.com/patent/US10872165B2 ## CPC - G06F 21/30: Authentication, i.e. establishing the identity or authorisation of security principals - G06F 21/6218: {to a system of files or objects, e.g. local or distributed file system or database} - G06F 16/252: {between a Database Management System and a front-end application} - G06F 21/31: User authentication - G06F 21/33: using certificates - G06F 21/602: {Providing cryptographic facilities or services} - G06F 21/725: {operating on a secure reference time value} - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04L 63/0823: {using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263)} - G06F 21/34: involving the use of external additional devices, e.g. dongles or smart cards - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A system and method for providing a secure database access from an application program implemented on a client device located in a first to a database located in a second zone, which is outside of the first zone, applying a traditional database access application programming interface, wherein implementing an database access driver on the client device in the first zone and implementing an access proxy in a second zone, which is connected to the database, performing an authentication of a user of the application program via an authentication agent located on the database access driver and an authentication server, delivering a credential from the authentication server to the database access driver in case of a successful authentication, and enabling database access to the user of the application program, if the credential is accepted by the database access proxy. ## Claims ### Claim 1 A method for providing a secure database access from an application program implemented on a client device located in a first zone to a database located in a second zone, which is outside of the first zone, applying an Open Database Connectivity ODBC or a JAVA Database Connectivity JDBC application programming Interface as a traditional database access application programming interface, the method comprising: implementing a database access driver on the client device in the first zone and implementing a database access proxy in the second zone, which is connected to the database, performing an authentication of a user of the application program via an authentication agent located on the database access driver and an authentication server located in the second zone or in a third zone other than the first or second zone, delivering a credential and a role of the user for accessing the database from the authentication server to the database access driver in response to a successful authentication, sending the credential and the role of the user from the database access driver to the database access proxy, and enabling database access to the user of the application program in response to the credential and the role of the user being accepted by the database access proxy, wherein the authentication server and the database access proxy periodically synchronize the role of the user for accessing the database. ### Claim 2 (depends on 1) The method according to claim 1, wherein the credential is a cryptographically secured credential. ### Claim 3 (depends on 1) The method according to claim 1, wherein the authentication server is located in the second zone or in a third zone other than the first of second zone, wherein the third zone is a central zone. ### Claim 4 (depends on 1) The method according to claim 1, wherein the database access protocol interface is performed by at least one vendor-specific driver in the database access proxy. ### Claim 5 (depends on 1) The method according to claim 1, wherein access rights of a user of the application program requesting access to the database are checked on the database access proxy. ### Claim 6 (depends on 1) The method according to claim 1, wherein access rights of a user of the application program stored in the database access proxy are updated by the authentication server. ### Claim 7 (depends on 1) The method according to claim 1, wherein access rights of a user of the application program requesting access to the database are administered on the authentication server, wherein the administration is on a repository connected to the authentication server. ### Claim 8 (depends on 1) The method according to claim 1, wherein the application program is registered at the authentication server during deployment of the application program on the client device. ### Claim 9 (depends on 1) The method according to claim 1, wherein operations performed by the database access proxy are logged by a logging unit. ### Claim 10 (depends on 1) The method according to claim 1, wherein data is transmitted on a secure second connection between the database access proxy and the database. ### Claim 11 (depends on 1) The method according to claim 1, wherein the third zone is a central zone. ### Claim 12 A system providing a secure database access from an application program implemented on a client device in a first zone to a database located in a second zone different from the first zone, applying an Open Database Connectivity ODBC or a JAVA Database Connectivity JDBC application programming Interface as a traditional database access application programming interface, comprising a database access protocol interface driver including an authentication agent the database access protocol interface driver being implemented on the client device in the first zone, a database access proxy being connected to a data base and located in the second zone, wherein the database access driver and the database access proxy are implemented for performing an authentication of a user of the application program via an authentication agent located on the database access driver and an authentication server located in the second zone or in a third zone other than the first or second zone, delivering a credential and a role of the user for accessing the database from the authentication server to the database access driver in response to a successful authentication, sending the credential and the role of the user from the database access driver to the database access proxy, and enabling database access to the user of the application program, in response to the credential and the role of the user are accepted by the database access proxy, wherein the authentication server and the database access proxy periodically synchronize the role of the user for accessing the database. ### Claim 13 (depends on 12) The system according to claim 12, wherein the third zone is a central zone. ### Claim 14 A computer program product, comprising a computer readable hardware storage device having computer readable program code stored therein, said program code executable by a processor of a computer system to implement a method for providing a secure database access from an application program implemented on a client device located in a first zone to a database located in a second zone, which is outside of the first zone, applying an Open Database Connectivity ODBC or a JAVA Database Connectivity JDBC application programming Interface as a traditional database access application programming interface, the method comprising: implementing a database access driver on the client device in the first zone and implementing a database access proxy in the second zone, which is connected to the database, performing an authentication of a user of the application program via an authentication agent located on the database access driver and an authentication server located in the second zone or in a third zone other than the first or second zone, delivering a credential and a role of the user for accessing the database from the authentication server to the database access driver in response to a successful authentication, sending the credential and the role of the user from the database access driver to the database access proxy, and enabling database access to the user of the application program in response to the credential and the role of the user being accepted by the database access proxy, wherein the authentication server and the database access proxy periodically synchronize the role of the user for accessing the database. ### Claim 15 (depends on 14) The computer program product according to claim 14, wherein the third zone is a central zone.