Supporting multiple security mechanisms in a database driver

Abstract

A computer program product and database driver for connecting a client to a database server are provided. The computer program product and database driver provide for providing a generic interface, the generic interface being operable to interoperate with one or more non-GSSAPI (Generic Security Services Application Programming Interface) compliant security mechanisms, providing a set of specialized interfaces, the set of specialized interface being operable to interoperate with one or more GSSAPI compliant security mechanisms, and establishing a connection between a client and a database server using the generic interface or the set of specialized interfaces depending on a security mechanism used by the client. The one or more non-GSSAPI compliant security mechanisms and the one or more GSSAPI compliant security mechanisms may be predefined or user-defined.

1 . A database driver implemented on a computer system to interoperate with multiple security mechanisms, the database driver comprising:
 a generic interface operable to interoperate with one or more non-GSSAPI (Generic Security Services Application Programming Interface) compliant security mechanisms; and   a set of specialized interfaces operable to interoperate with one or more GSSAPI compliant security mechanisms,   wherein the database driver is operable to establish a connection between a client and a database server using one of the generic interface or the set of specialized interfaces in relation to a security mechanism used by the client, and   wherein the security mechanism used by the client is operable to ensure the connection between the client and the database server is established in a secure manner.   
   
   
       2 . The database driver of  claim 1 , further comprising:
 a separate interface in communication with the generic interface and the set of specialized interfaces, the separate interface being operable to:
 free up one or more system resources used to establish the connection between the client and the database server and 
 erase cryptographic information created to establish the connection between the client and the database server. 
   
   
   
       3 . The database driver of  claim 2 , wherein the separate interface is invoked in response to establishment of the connection between the client and the database server. 
   
   
       4 . The database driver of  claim 1 , wherein the generic interface is operable to retrieve security context information created in accordance with the security mechanism used by the client, the security mechanism used by the client being one of the one or more non-GSSAPI compliant security mechanisms. 
   
   
       5 . The database driver of  claim 1 , wherein the set of specialized interfaces comprises:
 a first interface operable to be utilized by the client to set a principal name in a security module, the security module being created by the client to encapsulate the security mechanism used by the client;   a second interface operable to retrieve the principal name set by the client from the security module;   a third interface operable to be utilized by the client to set a credential in the security module;   a fourth interface operable to retrieve the credential set by the client from the security module; and   a fifth interface operable to retrieve a context from the security module, the context being created by the security module using a combination of the principal name and the credential set by the client,   wherein the security mechanism used by the client is one of the one or more GSSAPI compliant security mechanisms.   
   
   
       6 . The database driver of  claim 5 , wherein the database driver is operable to invoke the context to obtain security context information created in accordance with the security mechanism used by the client. 
   
   
       7 . The database driver of  claim 1 , wherein at least one of the one or more non-GSSAPI compliant security mechanisms is a user-defined security mechanism. 
   
   
       8 . The database driver of  claim 1 , wherein at least one of the one or more GSSAPI compliant security mechanisms is a user-defined security mechanism. 
   
   
       9 . The database driver of  claim 1 , wherein the security mechanism used by the client is a user-defined security mechanism. 
   
   
       10 . A computer program product comprising a computer readable medium, the computer readable medium including a computer readable program for enabling a database driver to interoperate with multiple security mechanisms by providing a connection between a client and a database server through the database driver, wherein the computer readable program when executed on a computer causes the computer to:
 provide a generic interface in the database driver, the generic interface being operable to interoperate with one or more non-GSSAPI (Generic Security Services Application Programming Interface) compliant security mechanisms;   provide a set of specialized interfaces in the database driver, the set of specialized interface being operable to interoperate with one or more GSSAPI compliant security mechanisms; and   provide a connection between the client and the database server using one of the generic interface or the set of specialized interfaces in relation to a security mechanism used by the client,   wherein the security mechanism used by the client is operable to ensure the connection between the client and the database server is established in a secure manner.   
   
   
       11 . The computer program product of  claim 10 , wherein the computer readable program when executed on the computer further causes the computer to:
 provide a separate interface in the database driver, the separate interface being in communication with the generic interface and the set of specialized interfaces, wherein the separate interface is operable to:
 free up one or more system resources used to establish the connection between the client and the database server and 
 erase cryptographic information created to establish the connection between the client and the database server. 
   
   
   
       12 . The computer program product of  claim 11 , wherein the computer readable program when executed on the computer further causes the computer to:
 invoke the separate interface in response to establishment of the connection between the client and the database server.   
   
   
       13 . The computer program product of  claim 10 , wherein establish a connection between the client and the database server comprises:
 utilize the generic interface to retrieve security context information created in accordance with the security mechanism used by the client, wherein the security mechanism used by the client is one of the one or more non-GSSAPI compliant security mechanisms;   transfer the security context information to the database server; and   establish the connection between the client and the database server responsive to the security context information being authenticated by the database server.   
   
   
       14 . The computer program product of  claim 13 , wherein the computer readable program when executed on the computer further causes the computer to:
 report an error to the client responsive to receiving an authentication failure notice from the database server.   
   
   
       15 . The computer program product of  claim 13 , wherein the computer readable program when executed on the computer further causes the computer to:
 authenticate security context information relating to the database server responsive to mutual authentication being required; and   report an error to the database server responsive to authentication failure.   
   
   
       16 . The computer program product of  claim 10 , wherein establish a connection between the client and the database server comprises:
 utilize a second interface in the set of specialized interfaces to retrieve a principal name from a security module, the security module being created by the client to encapsulate the security mechanism used by the client, wherein the principal name is set by the client in the security module using a first interface in the set of specialized interfaces;   utilize a fourth interface in the set of specialized interfaces to retrieve a credential from the security module, the credential being set by the client in the security module using a third interface in the set of specialized interfaces;   utilize a fifth interface in the set of specialized interfaces to retrieve a context from the security module, the context being created by the security module using a combination of the principal name and the credential set by the client;   invoke the context to obtain security context information created in accordance with the security mechanism used by the client;   transfer the security context information, the principal name, and the credential to the database server; and   establish the connection between the client and the database server responsive to the security context information, the principal name, and the credential being authenticated by the database server,   wherein the security mechanism used by the client is one of the one or more GSSAPI compliant security mechanisms.   
   
   
       17 . The computer program product of  claim 16 , wherein the computer readable program when executed on the computer further causes the computer to:
 report an error to the client responsive to receiving an authentication failure notice from the database server.   
   
   
       18 . The computer program product of  claim 16 , wherein the computer readable program when executed on the computer further causes the computer to:
 authenticate security context information relating to the database server responsive to mutual authentication being required; and   report an error to the database server responsive to authentication failure.   
   
   
       19 . The computer program product of  claim 10 , wherein at least one of the one or more non-GSSAPI compliant security mechanisms is a user-defined security mechanism. 
   
   
       20 . The computer program product of  claim 10 , wherein at least one of the one or more GSSAPI compliant security mechanisms is a user-defined security mechanism. 
   
   
       21 . The computer program product of  claim 10 , wherein the security mechanism used by the client is a user-defined security mechanism.