Using a PKCS module for opening multiple databases

• US 9,306,937 B2
• Filed: 12/05/2014
• Issued: 04/05/2016
• Est. Priority Date: 11/30/2009
• Status: Active Grant

• Current Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Original Assignee: Red Hat, Inc. (International Business Machines Corporation)
• Inventors: Relyea, Robert
• Primary Examiner(s): Cervetti, David Garca
• Application Number:
  US14/562,346
• Publication Number:
  US 20150095639A1
• Time in Patent Office: 487 Days
• Field of Search: 713/156, 713/152, 713/167
• US Class Current: 1/1
• CPC Class Codes: G06F 21/602 Providing cryptographic facilities or services
• CPC Class Codes: G06F 21/6218 to a system of files or objects, e.g. local or distributed file system or database
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy

Abstract

A processing device is to determine that a module, executed from a memory by the processing device, is initialized from opening a first database. The processing device is to identify a second database to be opened from a request from an application to access data that is stored in the second database. The processing device is to create, a slot, via the initialized module, to open the second database using the initialized module.

Claims

1. A method comprising:

determining that a module, executed from a memory by a processing device, is initialized from opening a first database;

identifying a second database to be opened from a request from an application to access data that is stored in the second database; and

creating, by the processing device, a slot, via the initialized module, to open the second database using the initialized module.

2. The method of claim 1, wherein the module comprises a PKCS-based module.

3. The method of claim 1, wherein identifying the second database comprises:

receiving load data that identifies the second database, the load data being in view of user-configurable policy information.

4. The method of claim 3, wherein the user-configurable policy information is stored in a lightweight directory access protocol (LDAP)-based database.

5. The method of claim 3, wherein the user-configurable policy information identifies a database to be opened in view of at least one of:

server type, application type, application name, or user.

6. The method of claim 3, wherein receiving the load data comprises:

receiving an initialization request to access security data stored in a database;

opening a system database in response to receiving the initialization request, wherein the system database identifies a module database interface;

accessing, via the module database interface, user-configurable policy information stored in an LDAP-based database; and

obtaining the load data to open the second database.

7. The method of claim 1, wherein determining that the module is initialized comprises:

attempting to initialize the module; and

receiving an error code indicating that the module is already initialized.

8. The method of claim 1, wherein the module comprises at least one of a soft-token module to open a database storing security data or a Privacy Enhanced Mail (PEM) module to open a database storing a PEM file.

9. The method of claim 1, wherein the data comprises at least one of a key, a certificate, or a Privacy Enhanced Mail (PEM) file.

10. A system comprising:

a memory; and

a processing device operatively coupled to the memory, the processing device to;

determine that a module, executed from the memory by the processing device, is initialized from opening a first database;

identify a second database to be opened from a request from an application to access data that is stored in the second database; and

create, by the processing device, a slot, via the initialized module, to open the second database using the initialized module.

11. The system of claim 10, wherein the module comprises a PKCS-based module.

12. The system of claim 10, wherein the processing device is to identify the second database by:

receiving load data that identifies the second database, the load data being based on user-configurable policy information.

13. The system of claim 12, wherein the user-configurable policy information identifies a database to be opened based on at least one of:

server type, application type, application name, and user.

14. The system of claim 12, wherein to receive the load data, the processing device is to:

receive an initialization request to access security data stored in a database;

open a system database in response to receiving the initialization request, wherein the system database identifies a module database interface;

access, via the module database interface, user-configurable policy information stored in an LDAP-based database; and

obtain the load data to open the second database.

15. The system of claim 10, the processing device to:

attempt to initialize the module; and

receive an error code indicating that the module is already initialized.

16. The system of claim 10, wherein the data comprises at least one of a key, a certificate, or a Privacy Enhanced Mail (PEM) file.

17. A non-transitory computer-readable medium comprising instructions encoded thereon that, when executed by a processing device, cause the processing device to:

determine that a module, executed from the memory by the processing device, is initialized from opening a first database;

identify a second database to be opened from a request from an application to access data that is stored in the second database; and

create, by the processing device, a slot, via the initialized module, to open the second database using the initialized module.

18. The non-transitory computer-readable medium of claim 17, wherein to identify the second database, the processing device is to:

receive load data that identifies the second database, the load data being in view of user-configurable policy information.

19. The non-transitory computer-readable medium of claim 18, wherein to receive the load data, the processing device is to:

receive an initialization request to access security data stored in a database;

open a system database in response to receiving the initialization request, wherein the system database identifies a module database interface;

access, via the module database interface, user-configurable policy information stored in an LDAP-based database; and

obtain the load data for opening the second database.

20. The non-transitory computer-readable medium of claim 17, wherein to determine that the module is initialized, the processing device is to:

attempt to initialize the module; and

receive an error code indicating that the module is already initialized.