# US 8,544,073 B2 · Multi-platform single sign-on database driver

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,544,073 B2
- Document ID: US8544073B2
- Status: Granted
- Kind: B2
- Application number: 10/887,340
- Filed: 2004-07-07
- Published: 2005-05-19
- Granted: 2013-09-24
- Earliest claimed: 2003-07-07
- Assignees: Progress Software Corporation
- Applicants: James Walter Silhavy; Dirk Voet
- Inventors: James Walter Silhavy; Dirk Voet
- Web page: https://patentgrep.com/patent/US8544073B2

## CPC

- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- G06F 21/31: User authentication
- G06F 21/41: where a single sign-on provides access to a plurality of computers
- G06F 21/6227: {where protection concerns the structure of data, e.g. records, types, queries}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

Systems and methods of performing single sign-on authentication from multiple platforms when establishing a connection to a database are described. An application can securely access a database based on user credentials provided during a prior authentication. In an embodiment, single sign-on is accomplished by relying on existing and emerging authentication, security service, security mechanism, and wire protocols, enabling the creation of drivers to accommodate various platforms and databases. In another embodiment, a pure type 4 Java Driver is used, eliminating dependencies on native operating functionality.

## Claims

### Claim 1

A method of automatically providing access to a database from a client application based on prior authentication of a user, the method comprising:
obtaining a login credential created responsive to an input provided by the user during the prior authentication;
creating, by a driver, a security context that includes a context object based at least in part on an authenticated subject representing an authenticated instance of the user, the authenticated subject including the login credential;
initializing, by the driver, the security context including creating a login request based on a wire protocol and populating the login request with a token based on an instance of the security context; and
using the security context to establish a secure connection to the database for communication between the client application and the database.

### Claim 2 (depends on 1)

The method of claim 1 wherein the steps of obtaining the login credential and creating the security context are performed by the driver which is a pure Java Type 4 driver.

### Claim 3 (depends on 2)

The method of claim 2 wherein the driver is a JDBC driver.

### Claim 4 (depends on 1)

The method of claim 1 wherein an operating platform of the client application differs from an operating platform of the database.

### Claim 5 (depends on 1)

The method of claim 1 wherein an operating platform of the client application is selected from a group consisting of: a Unix platform, an IBM platform, and a Windows platform.

### Claim 6 (depends on 1)

The method of claim 1 wherein the database is a Microsoft SQL server database.

### Claim 7 (depends on 1)

The method of claim 1 wherein the database is a DB2 database.

### Claim 8 (depends on 1)

The method of claim 1 wherein the secure connection is implemented over a TCP/IP protocol.

### Claim 9 (depends on 1)

The method of claim 1 wherein the login credential is one selected from a group consisting of: a user name, a password, cryptographic data, and biologic data.

### Claim 10 (depends on 1)

The method of claim 1 wherein an operating environment of the client application differs from an operating environment of the database.

### Claim 11

A non-transitory computer-readable storage medium storing computer-executable program code for authenticating a client application to a database based on prior authentication of a client user using a security mechanism, the computer-executable program code comprising:
an authentication module for performing authentication of an instance of the client user to the security mechanism based on a client user credential generated during the prior authentication;
a client security services module for facilitating a secure connection for communications between the database and the client application consistent with the security mechanism and communicating with the authentication module to create a security context that includes a context object based at least in part on an authenticated subject representing an authenticated instance of the client user, the authenticated subject including a login credential; and
a driver for creating a wire protocol connection to the database from the client application based on a wire protocol and for communicating requests from the client application to the database using the secure connection facilitated by the client security services module, the driver initializing the security context by creating a login request based on the wire protocol and populating the login request with a token based on an instance of the security context.

### Claim 12 (depends on 11)

The computer-readable storage medium of claim 11 wherein the security mechanism comprises Kerberos, the authentication module comprises code for complying with a JAAS, and the client security services module comprises code for conforming with a GSS-API.

### Claim 13 (depends on 11)

The computer-readable storage medium of claim 11 wherein the wire protocol connection is created in accordance with a TDS protocol.

### Claim 14 (depends on 11)

The computer-readable storage medium of claim 11 wherein the wire protocol connection is created in accordance with a DRDA protocol.

### Claim 15 (depends on 11)

The computer-readable storage medium of claim 11 wherein the driver is configured to communicate requests from a plurality of client applications and further wherein the plurality of client applications are configured to operate on a plurality of different and distinct operating platforms.

### Claim 16 (depends on 11)

The computer-readable storage medium of claim 11 wherein the driver is a Type 4 JDBC driver.

### Claim 17 (depends on 11)

The computer-readable storage medium of claim 11 wherein the authentication module and the client security services module are supplied on a client side through a run-time environment.

### Claim 18 (depends on 17)

The computer-readable storage medium of claim 17 wherein the run-time environment comprises a Java run-time environment.

### Claim 19 (depends on 17)

The computer-readable storage medium of claim 17 wherein the run-time environment comprises .NET resources for supporting a .NET client application.

### Claim 20

A method of supplying automatic access to a database from a client application based on prior authentication of a user, the method comprising:
creating a connection object for connecting the client application to the database;
using the connection object to create a secure connection based on a user credential generated during the prior authentication of the user and a security context, the security context including a context object and created based at least in part on an authenticated subject representing an authenticated instance of the user, the authenticated subject including a login credential;
initializing the secure connection including creating a login request based on a wire protocol and populating the login request with a token based on an instance of the security context; and
communicating with the database over the initialized secure connection, wherein the client application operates in a client environment and the database operates in a database environment, and the client environment comprises a different type of environment than the database environment.

### Claim 21 (depends on 20)

The method of claim 20 wherein the step of creating the secure connection further comprises:
requesting the user credential generated during the prior authentication of the user;
obtaining the user credential;
using the user credential to generate an authentication credential; and
using the user credential and the authentication credential to create the secure connection.

### Claim 22 (depends on 21)

The method of claim 21 wherein the step of initializing the secure connection further comprises:
obtaining a client token;
using the client token to complete the login request to log on to the database;
sending the login request to the database;
receiving a server token;
sending the server token to a client security services module for authentication of the server token;
receiving a login acknowledgment from the database; and
processing the login acknowledgement.

### Claim 23 (depends on 20)

The method of claim 20 wherein the connection object is a TDS wire connection object.

### Claim 24 (depends on 20)

The method of claim 20 wherein the steps of creating the connection object, using the connection object to create the secure connection, initializing the secure connection, and communicating with the database over the initialized secure connection are performed by a Type 4 JDBC driver.

### Claim 25

A method of automatically providing access to a database to a user based on prior authentication of the user, the method comprising:
receiving a log on request from a driver, wherein the log on request includes a client token and is received subsequent to establishment of a security context, the establishment of the security context accomplished using a user credential generated during the prior authentication of the user, the security context including a context object and created based at least in part on an authenticated subject representing an authenticated instance of the user, the authenticated subject including a login credential, the security context initialized by creating the log on request based on a wire protocol and populating the log on request with the client token based on an instance of the security context;
extracting the client token from the log on request;
sending the client token to a security services module for authentication of the client token; and
sending an acknowledgement of the log on request to the driver.

### Claim 26 (depends on 25)

The method of claim 25, wherein the database comprises a DB2 database.

### Claim 27 (depends on 25)

The method of claim 25, wherein the steps of receiving the log on request from the driver, extracting the client token from the log on request, sending the client token to the security services module, and sending the acknowledgement of the log on request to the driver are performed by the database.

### Claim 28 (depends on 25)

The method of claim 25, wherein the driver comprises a Type 4 JDBC driver.

### Claim 29 (depends on 25)

The method of claim 25 wherein the log on request is further transmitted over a TCP/IP protocol.