Technique of password encryption and decryption for user authentication in a federated content management system

[0002] 1. Field of the Invention

[0003] This invention relates in general to database management systems performed by computers, and in particular, to a technique of password encryption and decryption for user authentication in a federated content management system.

[0004] 2. Description of Related Art

[0005] The present invention relates to a system and method for representing and searching multiple heterogeneous datastores and managing the results of such searches. Datastore is a term used to refer to a generic data storage facility, such as a relational data base, flat-file, hierarchical data base, etc. Heterogeneous is a term used to indicate that the datastores need not be similar to each other. For example, each datastore may store different types of data, such as image or text, or each datastore may be based on a different theory of data model, such as Digital Library/VisualInfo or Domino Extended Search (DES).

[0006] For nearly half a century computers have been used by businesses to manage information such as numbers and text, mainly in the form of coded data. However, business data represents only a small part of the world's information. As storage, communication and information processing technologies advance, and as their costs come down, it becomes more feasible to digitize other various types of data, store large volumes of it, and be able to distribute it on demand to users at their place of business or home.

[0007] New digitization technologies have emerged in the last decade to digitize images, audio, and video, giving birth to a new type of digital multimedia information. These multimedia objects are quite different from the business data that computers managed in the past, and often require more advanced information management system infrastructures with new capabilities. Such systems are often called “digital libraries.”

[0008] Bringing new digital technologies can do much more than just replace physical objects with their electronic representation. It enables instant access to information; supports fast, accurate, and powerful search mechanisms; provides, new “experiential” (i.e. virtual reality) user interfaces; and implements new ways of protecting the rights of information owners. These properties make digital library solutions even more attractive and acceptable not only to corporate IS organizations, but to the information owners, publishers and service providers.

[0009] Generally, business data is created by a business process (an airline ticket reservation, a deposit at the bank, and a claim processing at an insurance company are examples). Most of these processes have been automated by computers and produce business data in digital form (text and numbers). Therefore it is usually structured coded data. Multimedia data, on the contrary, cannot be fully pre-structured (its use is not fully predictable) because it is the result of the creation of a human being or the digitization of an object of the real world (x-rays, geophysical mapping, etc.) rather than a computer algorithm.

[0010] The average size of business data in digital form is relatively small. A banking record—including a customers name, address, phone number, account number, balance, etc.—represents at most a few hundred characters, i.e. few hundreds/thousands of bits. The digitization of multimedia information (image, audio, video) produces a large set of bits called an “object” or “blobs” (Binary Large Objects). For example, a digitized image of the parchments from the Vatican Library takes as much as the equivalent of 30 million characters (30 MB) to be stored. The digitization of a movie, even after compression, may take as much as the equivalent of several billions of characters (3-4 GB) to be stored.

[0011] Multimedia information is typically stored as much larger objects, ever increasing in quantity and therefore requiring special storage mechanisms. Classical business computer systems have not been designed to directly store such large objects. Specialized storage technologies may be required for certain types of information, e.g. media streamers for video or music. Because certain multimedia information needs to be preserved “forever” it also requires special storage management functions providing automated back-up and migration to new storage technologies as they become available and as old technologies become obsolete.

[0012] Finally, for performance reasons, the multimedia data is often placed in the proximity of the users with the system supporting multiple distributed object servers. This often requires a logical separation between applications, indices, and data to ensure independence from any changes in the location of the data.

[0013] The indexing of business data is often imbedded into the data itself. When the automated business process stores a person's name in the column “NAME,” it actually indexes that information. Multimedia information objects usually do not contain indexing information. This “meta data” needs to be created in addition by developers or librarians. The indexing information for multimedia information is often kept in “business like” databases separated from the physical object.

[0014] In a Digital Library (DL), the multimedia object can be linked with the associated indexing information, since both are available in digital form. Integration of this legacy catalog information with the digitized object is crucial and is one of the great advantages of DL technology. Different types of objects can be categorized differently as appropriate for each object type. Existing standards like MARC records for libraries, Finding Aids for archiving of special collections, etc. . . . can be used when appropriate.

[0015] The indexing information used for catalog searches in physical libraries is mostly what one can read on the covers of the books: authors name, title, publisher, ISBN, . . . enriched by other information created by librarians based on the content of the books (abstracts, subjects, keywords, . . . ). In digital libraries, the entire content of books, images, music, films, etc. . . . are available and “new content” technologies are needed; technologies for full text searching, image content searching (searching based on color, texture, shape, etc. . . . ), video content searching, and audio content searching. The integrated combination of catalog searches (e.g. SQL) with content searches will provide more powerful search and access functions. These technologies can also be used to partially automate further indexing, classification, and abstracting of objects based on content.

[0016] To harness the massive amounts of information spread throughout these networks, it has become necessary for a user to search numerous storage facilities at the same time without having to consider the particular implementation of each storage facility.

[0017] Object-oriented approaches are generally better suited for such complex data management. The term “object-oriented” refers to a software design method which uses “classes” and “objects” to model abstract or real objects. An “object” is the main building block of object-oriented programming, and is a programming unit which has both data and functionality (i.e., “methods”). A “class” defines the implementation of a particular kind of object, the variables and methods it uses, and the parent class it belongs to.

[0018] Some known programming tools that can be used for developing search and result-management frameworks include IBM VisualAge C++, Microsoft Visual C++, Microsoft Visual J++, and Java.

[0019] There is a need in the art for an improved federated system. In particular, there is a need in the art for a technique of password encryption and decryption for user authentication in a federated content management system.

[0020] To overcome the limitations in the prior art described above, and to overcome other limitations that will become apparent upon reading and understanding the present specification, the present invention discloses a method, apparatus, and article of manufacture for a technique of password encryption and decryption for user authentication in a federated content management system.

[0021] According to an embodiment of the invention, one or more commands are executed in a computer to perform a datastore operation on a datastore connected to the computer. A string of characters are received. The string of characters is encrypted based on a first character standard. Then, the encrypted string of characters is transformed to be compatible with a second character standard.

[0022] Referring now to the drawings in which like reference numbers represent corresponding parts throughout:

[0023] FIG. 1 is a diagram illustrating a computer architecture that could be used in accordance with the present invention;

[0024] FIG. 2 is a diagram illustrating a class hierarchy for Data Object classes;

[0025] FIG. 3 is a diagram illustrating a class hierarchy for Datastore classes;

[0026] FIG. 4 is a diagram illustrating one composition of a federated datastore;

[0027] FIG. 5 is a diagram illustrating an overview of the password system;

[0028] FIG. 6 is a flow diagram illustrating steps performed by the password system to generate a tagged; and

[0029] FIG. 7 is a flow diagram illustrating steps performed by the password system to transform a tagged string into its original format.

[0030] In the following description of the preferred embodiment, reference is made to the accompanying drawings which form a part hereof, and in which is shown by way of illustration a specific embodiment in which the invention may be practiced. It is to be understood that other embodiments may be utilized and structural and functional changes may be made without departing from the scope of the present invention.

[0031] FIG. 1 is a diagram illustrating a computer architecture that could be used in accordance with the present invention. The present invention is described herein by way of example and is not intended to be limited to the described embodiment. The description of the preferred embodiment is based on, but certainly not limited to, the IBM design of Java Grand Portal Class Library, the Digital Library Java Application Programming Interface (API).

[0032] The Java Grand Portal 120 is comprised of client and server classes. In particular, Java Grand Portal is a set of Java classes which provides access and manipulation of local or remote data stored in Digital Library storage facilities. It uses a Java API based on OMG-Object Query Services (OQS) and a Dynamic Data Object protocol, which is a part of OMG/Persistence Object Services.

[0033] The Java API provides multi-search capabilities such as:

[0034] 1. Searching within a given datastore using one or a combination of supported query types, i.e.,

[0035] Parametric query—Queries requiring an exact match on the condition specified in the query predicate and the data values stored in the datastore.

[0036] Text query—Queries on the content of text fields for approximate match with the given text search expression, e.g. the existence (or non-existence) of certain phrases or word-stems.

[0037] Image query—Queries on the content of image fields for approximate match with the given image search expression, e.g. image with certain degree of similarity based on color percentages, layout, or texture.

[0038] 2. Each search type is supported by one or more search-engines.

[0039] 3. Searching on the results of a previous search.

[0040] 4. Searching involving heterogeneous datastores.

[0041] The Digital Library Grand Portal classes provide a convenient API for Java application users; the applications can be located at local or remote sites. Java classes will typically reside on both server and client sides; both sides providing the same interface. The client side of Java classes communicates with the server side to access data in the Digital Library through the network. Communication between client and server sides is done by these classes; it is not necessary to add any additional programs.

[0042] In particular, FIG. 1 is an architectural diagram outlining the structure of the federated search for Digital Library repositories using the federated datastore 100, comprised of a federated datastore client and server. A federated datastore 100 is a virtual datastore which combines several heterogeneous datastores 102 into a consistent and unified conceptual view. This view, or a federated schema, is established via schema mapping 104 of the underlying datastores. The users interact with a federated datastore 100 using the federated schema, without needing to know about the individual datastores 102 which participate in the federated datastore 100.

[0043] One embodiment of the invention provides a password system that supports password encryption and decryption for user authentication in a federated content management system. In one embodiment of the invention, one or more programs or functions implement the password system. In one embodiment, these programs and functions reside at the federated datastore.

[0044] The federated datastore 100 does not have a corresponding back-end client. Since it is a virtual datastore, the federated datastore 100 relies on the underlying physical back-end client associated with it, such as the DL client (i.e., Digital Library client), OnDemand, VisualInfo, etc. As mentioned before, this association is established by a schema mapping component 104.

[0045] The communication between the federated datastore 100 client and server can be done by any appropriate protocol. On top of Java Grand Portal client classes, the users can develop application programs using, for example, any existing Java Beans 122 development environment.

[0046] The federated datastore 100 coordinates query evaluation, data-access, and transaction processing of the participating heterogeneous datastores 102. Given the federated schema, a multi-search query can be formulated, executed, and coordinated to produce results in the form of a datastore-neutral dynamic data object.

[0047] Note that each heterogeneous datastore and the federated datastore are created using one datastore definition. The federated datastore 100 and the heterogeneous datastores 102 are all subclasses of a class called Datastore, therefore, all of these datastores 100 and 102 have the same interface. Therefore, a user would be able to access the federated datastore 100 and the heterogeneous datastores 102 in a consistent and uniform manner.

[0048] Additionally, the objects stored in the federated datastore 100 and the heterogeneous datastores 102 are subclasses of an Object class. The Object class includes subclasses for dynamic data objects (DDOs) and extended data objects (XDOs). A DDO has attributes, with type, value, and properties. The value of an attribute can be a reference to another DDO or XDO, or a collection of DDOs or XDOs.

[0049] FIG. 2 is a diagram illustrating a class hierarchy for Data Object classes. The objects stored in and manipulated by the datastores and fetch operations belong to data object classes. These objects are returned as the result of a fetch, or created and used in CRUD (add, retrieve, update, delete) operations.

[0050] A DataObjectBase 200 is an abstract base class for all data objects known by datastores. It has a protocol attribute, that indicates to the datastore which interface can be used to operate on this object. A XDOBase 210 is the base class used to represent user-defined-types (UDT) or large objects. In particular, the XDOBase 210 is the base class for some user-defined types 212 and XDOs 214. A XDO 214 represents complex UDTs or large objects (LOB). This object can exist stand-alone or as a part of a DDO 236. Therefore, it has a persistent object identifier and CRUD operations capabilities.

[0051] Blob 216 is a base class for BLOBs as a placeholder to share all generic operations pertaining to BLOBs. Clob 218 is a base class for CLOBs (Character Large Objects) as a placeholder to share all generic operations pertaining to CLOBs. DBClob 220 is a base class for DBCLOBs (database character large object) as a placeholder to share all generic operations pertaining to DBCLOBs. BlobDB2222 represents a BLOB specific to DB2, and BlobDL 22 represents a BLOB specific to DL. Similarly, though not shown, there may be subclasses for ClobDB2, ClobDL, etc.

[0052] A DataObject 230 is a base class for PersistentObject 232 and DDOBase 234. A PersistentObject 232 represents a specific object whose code is statically generated and compiled. This type of object will not be covered in this document. A DDOBase 234 is a base class for a dynamic data object 236 (without the CRUD methods). A DDO (Dynamic Data Object) 236 represents generic data objects which are constructed dynamically at runtime. This object fits well with query and browsing activities in Portal where objects are only known and generated at runtime. It supports the CRUD operations (add, retrieve, update, and delete), and, with the help of its associated datastore, a DDO can put itself into and out of the datastore.

[0053] One skilled in the art would recognize that these are only example classes and subclasses and other structures maybe used for objects and other classes or subclasses may be added to or removed from the tree shown in FIG. 2.

[0054] With respect to the notion of “federation”, each participating datastore preserves the right to maintain its “personality”, i.e. its own query language, data-model or schema, method of interaction, etc, and at the same time cooperating in a federation to provide a federated schema. This design allows the users to preserve the natural view to their favorite datastore as well as access them in conjunction with other datastores in a federated context. The federated datastore 100 can combine the participating native datastores in two ways:

[0055] With mapping. As described above, mapping of concepts across participating datastores is established to provide a unified conceptual view. Based on this federated schema, federated queries with both join and union expressions can be formulated.

[0056] Without mapping. In this case, the federated datastore 100 only reflects the union of each participating datastore's conceptual view. Although it coordinates query processing and data-access for each underlying datastore, the federated datastore 100 must accept queries in each datastore's native language since the query translation process can not be performed without mapping. In addition, since there is no conceptual mapping between datastores, the FederatedQuery 19 results can only reflect the union of results from each datastore.

[0057] The embodiment of the invention is incorporated into one or more software programs that reside at the federated datastore 100. Generally, the software programs and the instructions derived therefrom, are all tangibly embodied in a computer-readable medium, e.g. one or more of the data storage devices, which may be connected to the federated datastore 100. Moreover, the software programs and the instructions derived therefrom, are all comprised of instructions which, when read and executed by the computer system 100, causes the computer system 100 to perform the steps necessary to implement and/or use the present invention. Under control of an operating system, the software programs and the instructions derived therefrom, may be loaded from the data storage devices into a memory of the federated datastore 100 for use during actual operations.

[0058] Thus, the present invention may be implemented as a method, apparatus, or article of manufacture using standard programming and/or engineering techniques to produce software, firmware, hardware, or any combination thereof The term “article of manufacture” (or alternatively, “computer program product”) as used herein is intended to encompass a computer program accessible from any computer-readable device, carrier, or media. Of course, those skilled in the art will recognize many modifications may be made to this configuration without departing from the scope of the present invention.

[0059] Those skilled in the art will recognize that the exemplary environment illustrated in FIG. 1 is not intended to limit the present invention. Indeed, those skilled in the art will recognize that other alternative hardware environments may be used without departing from the scope of the present invention.

[0060] FIG. 3 is a diagram illustrating a class hierarchy for Datastore classes. A main datastore class 300 is an abstract base class (i.e., superclass) for all datastores. In particular, some datastore classes that are based on the datastore class 300 and inherit its characteristics are the following: a DL Datastore class 302, a VisualInfo Datastore class 304, a Federated Datastore class 306, and an OnDemand Datastore class 308.

[0061] FIG. 4 is a diagram illustrating one composition of a federated datastore. The federated datastore 400 connects to heterogeneous datastores 402, 404, 406, and 408. As illustrated, a federated datastore 406 may connect to and be nested under federated datastore 400. Additionally, the federated datastore 406 may connect to heterogeneous datastores 410, 412, and 414. The depicted architecture is only a sample, and one skilled in the art would recognize that other examples fall within the scope of the invention.

[0062] In the preferred embodiment, the federated datastore 100 takes query strings expressed in a federated query language. An example class definition for DatastoreFederated 100 is set forth below.

[0063] DKDatastoreFed.java

[0064] package com.ibm.mm.sdk.server;

[0065] public class DKDatastoreFed extends dkAbstractDataStore

[0066] implements DKConstantFed,

[0067] DKConstant,

[0068] DKMessageldFed,

[0069] DKMessageld,

[0070] dkFederation,

[0071] javaio.Serializable

[0072] {

[0073] public dkCollection listEntities( ) throws DKException, Exception

[0074] public String[ ] listEntityNames( ) throws DKException, Exception

[0075] public String[ ] listTextEntityNames( ) throws DKException, Exception

[0076] public String[ ] listPainEntityNames( ) throws DKException, Exception

[0077] public dkCollection listEntityAtts(String entityName) throws DKExcepion, Exception

[0078] public String[ ] listEntityAttrNames(String entityName) throws DKException, Exception

[0079] public String registerMapping(DKNVPair sourceMap) throws DKException, Exception

[0080] public void unRegisterMapping(String mappingname) throws DKException, Exception

[0081] public String[ ] listMappingNames( ) throws DKException, Exception

[0082] public dkSchemaMapping getMapping(String mappingName) throws DKException,

[0083] Exception

[0084] public synchronized dkExtension getExtension(String extensionName) throws

[0085] DKException, Exception

[0086] public synchronized void addExtension(String extensionName,

[0087] dkExtension extensionObj) throws DKException, Exception

[0088] public synchronized void removeExtension(String extensionName) throws

[0089] DKException, Exception

[0090] public synchronized String[ ] listExtensionNames( ) throws DKException, Exception public DKDDO createDDO(String objectType,

[0091] int Flags) throws DKException, Exception

[0092] public dkCollection listSearchTemplates( ) throws DKException, Exception

[0093] public String[ ] listSearchTemplateNames( ) throws DKException, Exception

[0094] public dkSearchTemplate getSearchTemplate(String templateName) throws

[0095] DKException, Exception

[0096] public void destroy( ) throws DKException, Exception

[0097] public synchronized string addRemoveCursor (dkResultSetCursor iCurt int action)

[0098] throws DKException, Exception

[0099] public dkDatastore datastoreByServerName (String dsType, String dsName)

[0100] throws DKException, Exception

[0101] public void changePassword (String serverName,

[0102] String user Id,

[0103] String oldPwd,

[0104] String newPwd)

[0105] throws DKException, Exception

[0106] public void requestConnection (String serverName,

[0107] String userId,

[0108] String passwd,

[0109] String connectString)

[0110] throws DKException, Exception

[0111] public void excludeServer (Sting serverName, String templateName)

[0112] throws DKException, Exception

[0113] public boolean isServerExcluded (String serverName, String templateName)

[0114] throws DKException, Exception, java.rmi.RemoteException

[0115] public String[ ] listExcludedServers(String templateName) throws DKException,

[0116] Exception

[0117] public void clearExcludedServers(String templateName) throws DKException,

[0118] Exception

[0119] };ps

[0120] The following methods are part of the federated datastore class:

[0121] public DKDatastoreFed( ) throws DKException, Exception

[0122] Constructs default Federated Datastore.

[0123] public DKDatastoreFed(String configuration) throws DKException, Exception

[0124] Constructs default Federated Datastore.

[0125] public void connect(String datastore_name,

[0126] String user_name,

[0127] String authentication,

[0128] String connect_string) throws DKException, Exception

[0129] Establishes a connection to a federated datastore.

[0130] Parameters:

[0131] datastore_name—federated datastore name

[0132] user_name—userid to logon to this federated datastore

[0133] authentication—password for this user_namne

[0134] connect_string—additional information string

[0135] Throws: DKException

[0136] if either:

[0137] datastore_narne, user_name, or authentication is null

[0138] or if error occurs in the federated datastore

[0139] Overrides:

[0140] connect in class dkAbstractDatastore

[0141] public void disconnect( ) throws DKException, Exception

[0142] Disconnects from the federated datastore.

[0143] Throws: DKException

[0144] if unable to disconnect from server.

[0145] Overrides:

[0146] disconnect in class dkAbstractDatastore

[0147] public Object getOption(int option) throws DKException

[0148] Gets defined datastore option

[0149] Parameters:

[0150] option—an option id

[0151] Returns:

[0152] the value for the given option

[0153] Throws: DKException

[0154] if option is not set

[0155] Overrides:

[0156] getOption in class dkAbstractDatastore

[0157] public void setOption(int option, Object value) throws DKException

[0158] Sets the given “option” with a specific “value”.

[0159] Parameters:

[0160] option—an option id

[0161] value—the value for the “option”

[0162] Throws: DKException

[0163] if option/value is invalid

[0164] Overrides:

[0165] setOption in class dkAbstractDatastore

[0166] public Object evaluate(String command,

[0167] short commandLangType,

[0168] DKNVPair params[ ]) throws DKException, Exception

[0169] Evaluates a query and returns the result as a dkQueryableCollection object.

[0170] Parameters:

[0171] command—a query stirng that represent the query criteria

[0172] commandLangType—a query language type, for Federated, it will be

[0173] DK_FEDERATED_QL_TYPE

[0174] params—a narne/value pairs list

[0175] Returns:

[0176] a query result collection

[0177] Throws: DKException

[0178] if “command” argument is null

[0179] Overrides:

[0180] evaluate in class dkAbstractDatastore

[0181] public Object evaluate(dkQuery query) throws DKException, Exception

[0182] Evaluates a query and returns the result as a DKAny containing dkQueryableCollection.

[0183] Parameters:

[0184] query—a given query object

[0185] Returns:

[0186] a query result collection

[0187] Throws: DKException

[0188] if the “query” input is null or not of federated query type.

[0189] Overrides:

[0190] evaluate in class dkAbstractDatastore

[0191] public Object evaluate(DKCQExpr qe) throws DKException, Exception

[0192] Evaluates a query.

[0193] Parameters:

[0194] qe—a common query expression object

[0195] Returns:

[0196] a collection of the results

[0197] Throws: DKException

[0198] if common query expression object is invalid

[0199] Overrides:

[0200] evaluate in class dkAbstractDatastore

[0201] public dkResultSetCursor execute(String command,

[0202] short commandLangType,

[0203] DKNVPair params[ ]) throws DKException, Exception

[0204] Executes a command query of the federated datastore and returns a result set cursor.

[0205] Parameters:

[0206] command—a query string that represents the query criteria.

[0207] commandLangType—a query language type, for Federated, it will be

[0208] DK_FEDERATED_QL_TYPE.

[0209] params[ ]—a name/value pairs list.

[0210] Returns:

[0211] a dkResultSetCursor object.

[0212] Throws: DKException

[0213] if “command” is null or invalid, or “commandLangType” is not Federated Query type.

[0214] Overrides:

[0215] execute in class dkAbstractDatastore

[0216] public dkResultSetCursor execute(dkQuery query) throws DKException, Exception

[0217] Executes a command query of the federated datastore and returns a result set cursor. This method takes a Federated query object as an argument.

[0218] Parameters:

[0219] query—a federated dkQuery object

[0220] Returns:

[0221] a dkResultSetCursor object

[0222] Throws: DKException

[0223] if “query” object is null or query.qlType( ) is not

[0224] DK_FEDERATED_QL_TYPE

[0225] Overrides:

[0226] execute in class dkAbstractDatastore

[0227] public dkResultSetCursor execute(DKCQExpr cqe) throws DKException, Exception

[0228] Executes a query expression.

[0229] Parameters:

[0230] cqe—a common query expression object

[0231] Returns:

[0232] resultSetCursor which represents a federated datastore cursor.

[0233] Throws: DKException

[0234] if “cqe” object is invalid

[0235] Overrides:

[0236] execute in class dkAbstractDatastore

[0237] public void execute WithCallback(dkQuery query,

[0238] dkcallback callbackObj) throws DKException, Exception

[0239] Executes a query with callback function.

[0240] Parameters:

[0241] query—a query object

[0242] callbackObj—a dkCallback object

[0243] Overrides:

[0244] executeWithCallback in class dkAbstractDatastore

[0245] public void execute WithCallback(String command

[0246] short commandLangType,

[0247] DKNVPair params[ ],

[0248] dkcallback callbackObj) throws DKException, Exception

[0249] Execute the query with callback function.

[0250] Parameters:

[0251] command—a query string

[0252] commandLang—a query type

[0253] params—additional query option in name/value pair

[0254] callbackObj—a dkCallback object

[0255] Overrides:

[0256] executeWithCallback in class dkAbstractDatastore

[0257] public void execute WithCallback(DKCQExpr cqe,

[0258] dkCallback callbackObj) throws DKException, Exception

[0259] Execute a query expression with callback function.

[0260] Parameters:

[0261] cqe—a common query expression object

[0262] callbackObj—a dkCallback object

[0263] Overrides:

[0264] executeWithCallback in class dkAbstractatastore

[0265] public dkQuery createQuery(String command,

[0266] short commandLangType,

[0267] DKNVPairparams[ ]) throws DKException

[0268] Creates a federated query object.

[0269] Parameters:

[0270] command—a query string that represents the query criteria

[0271] commandLangType—a query language type, it will be one of the following:

[0272] DK_CM_TEMPLATE_QL_TYPE

[0273] DK_CM_TEXT_QL_TYPE

[0274] DK_CM_IMAGE_QL_TYPE

[0275] DK_CM_PARAMETRIC_QL_TYPE

[0276] DK_CM_COMBINED_QL_TYPE

[0277] params[ ]—a name/value pairs list

[0278] Returns:

[0279] a federated dkQuery object

[0280] Throws: DKException

[0281] if “command” is null

[0282] Overrides:

[0283] createQuery in class dlkAbstractDatastore

[0284] public dkQuery createQuery(DKCQExpr qe) throws DKException

[0285] Creates a query object.

[0286] Parameters:

[0287] cqe—a common query expression object

[0288] Throws: DKException

[0289] if “cqe” object is invalid

[0290] Overrides:

[0291] createQuery in class dkAbstractDatastore

[0292] public dkcollection listDataSources( ) throws DKException

[0293] List the available datastore sources that a user can connect to.

[0294] Returns:

[0295] a collection of ServerDef objects describing the servers

[0296] Throws: DKException

[0297] if internal error occurs from server

[0298] Overrides:

[0299] listDataSources in class dkAbstractDatastore

[0300] public String[ ] listDataSourceNames( ) throws DKException

[0301] Gets a list of datasource names.

[0302] Returns:

[0303] an array of datasource names

[0304] Throws: DKException

[0305] if error occurs when retrieving datasource names

[0306] Overrides:

[0307] listDataSourceNames in class dkAbstractDatastore

[0308] public void addObject(dkDataObject dataobj) throws DKException, Exception

[0309] Adds a DDO object—since federated datastore does not allow adding object dynamically, this method will throw DKUsageError exception.

[0310] Parameters:

[0311] ddo—a Federated object to be added.

[0312] Throws: DKException

[0313] is thrown for all calls to this method.

[0314] Overrides:

[0315] addObject in class dkAbstractDatastore

[0316] public void deleteObject(dkDataObject dataobj) throws DKException, Exception

[0317] Deletes a data object.

[0318] Parameters:

[0319] ddo—a federated DDO object to be deleted

[0320] Throws: DKException

[0321] since Federated server does not support deletion of documents for now.

[0322] Overrides:

[0323] deleteObject in class dkAbstractDatastore

[0324] public void retrieveObject(dkDataObject dataobj) throws DKException, Exception

[0325] Retrieves a data-object.

[0326] Parameters:

[0327] ddo—document object to be retrieved.

[0328] Throws: DKException

[0329] when retrieve failed.

[0330] Overrides:

[0331] retrieveObject in class dkAbstractDatastore

[0332] public void updateObject(dkDataObject dataobj) throws DKException, Exception

[0333] Updates a data-object.

[0334] Parameters:

[0335] ddo—the data-object to be updated.

[0336] Throws: DKException

[0337] if error occurs in the datastore

[0338] Overrides:

[0339] updateObject in class dkAbstractDatastore

[0340] public void commit( ) throws DKException

[0341] Commits all activities since the last commit. This method will do nothing for federated since this datastore does not support commit/rollback functions.

[0342] Throws: DKException

[0343] is thrown since federated datastore does not support transaction scope for now.

[0344] Overrides:

[0345] commit in class dkAbstractDatastore

[0346] public void rollback( ) throws DKException

[0347] Rolls back all activities since the last commit. This method will do nothing for federated datastore since it does not support commit/rollback functions yet.

[0348] Throws: DKException

[0349] is thrown since Federated does not support transaction scope for now.

[0350] Overrides:

[0351] rollback in class dkAbstractDatastore

[0352] public boolean isconnected( )

[0353] Checks to see if the datastore is connected

[0354] Returns:

[0355] true if connected, false otherwise

[0356] Overrides:

[0357] isConnected in class dkAbstractDatastore

[0358] public DKHandle connection( ) throws Exception

[0359] Gets the connection handle for the datastore.

[0360] Returns:

[0361] the connection handle

[0362] Overrides:

[0363] connection in class dkAbstractDatastore

[0364] public DKHandle handle(String type) throws Exception

[0365] Gets a datastore handle.

[0366] Parameters:

[0367] type—type of datastore handle wanted

[0368] Returns:

[0369] a datastore handle

[0370] Overrides:

[0371] handle in class dkAbstractDatastore

[0372] public String userName( )

[0373] Gets the user name that user used to logon to the datastore.

[0374] Returns:

[0375] the userid that user used to logon

[0376] Overrides:

[0377] userName in class dkAbstractDatastore

[0378] public String datastoreName( ) throws Exception

[0379] Gets the name of this datastore object. Usually it represents a datastore source's server name.

[0380] Returns:

[0381] datastore name

[0382] Overrides:

[0383] datastoreName in class dkAbstractDatastore

[0384] public String datastoreType( ) throws Exception

[0385] Gets the datastore type for this datastore object.

[0386] Returns:

[0387] datastore type

[0388] Overrides:

[0389] datastoreType in class dkAbstractDatastore

[0390] public dkDatastoreDef datastoreDef( ) throws DKException, Exception

[0391] Gets datastore definition.

[0392] Returns:

[0393] the meta-data (dkDatastoreDef) of this datastore

[0394] Overrides:

[0395] datastoreDef in class dkAbstractDatastore

[0396] public dkcollection listEntities( ) throws DKException, Exception

[0397] Gets a list of federated entities from Federated server.

[0398] Returns:

[0399] a collection of dkEntityDef

[0400] Throws: DKException

[0401] if error occurs

[0402] Overrides:

[0403] listEntities in class dkAbstractDatastore

[0404] public String[ ] listEntityNames( ) throws DKException, Exception

[0405] Gets a list of federated entities names from Federated server.

[0406] Returns:

[0407] an array of names

[0408] Throws: DKException

[0409] if error occurs

[0410] Overrides:

[0411] listEntityNames in class dkAbstractDatastore

[0412] public String[ ] listTextEntityNames( ) throws DKException, Exception

[0413] Gets a list of federated text search entities names from Federated server.

[0414] Returns:

[0415] an array of names

[0416] Throws: DKException

[0417] if error occurs

[0418] public String[ ] listParmEntityNames( ) throws DKException, Exception

[0419] Gets a list of federated parametric search entities names from Federated server.

[0420] Returns:

[0421] an array of names

[0422] Throws: DKException

[0423] if error occurs

[0424] Overrides:

[0425] listEntityAttrs

[0426] public dkcollection listEntityAttrs(String entityName) throws DKException, Exception

[0427] Gets a list of attributes for a given entity name.

[0428] Parameters:

[0429] entityName—name of entity to retrieve attributes for

[0430] Returns:

[0431] a dkCollection of dkAttrDef objects

[0432] Throws: DKException

[0433] if the entity name does not exist

[0434] Overrides:

[0435] listEntityAttrs in class dkAbstractDatastore

[0436] public String[ ] listEntityAttrNames(String entityName) throws DKException, Exception

[0437] Gets a list of attribute names for a given entity name.

[0438] Parameters:

[0439] entityName—name of entity to retrieve attribute names for

[0440] Returns:

[0441] an array of attribute names

[0442] Throws: DKException

[0443] if the entity name does not exist

[0444] Overrides:

[0445] listEntityAttrNames in class dkAbstractDatastore

[0446] public String registerMapping(DKNVPair sourceMap) throws DKException, Exception

[0447] Registers a mapping definition to this datastore. Mapping is done by entities.

[0448] Parameters:

[0449] sourceMap—source name and mapping, a DKNVPair class with the following possible values:

[0450] (“BUFFER”,): buffer_ref is a reference to a string in memory (“FILE”,): file_name is the name of the file containing the mapping

[0451] (“URL”,): URL-address location of the mapping

[0452] (“LDAP”,): LDAP file-narne

[0453] (“SCHEMA”,): a reference to a dkSchemaMapping object

[0454] defining the

[0455] mapping. Currently, only “SCHEMA” option is supported, others

[0456] may be

[0457] added later.

[0458] Returns:

[0459] the name of the mapping definition.

[0460] Overrides:

[0461] registerMapping in class dkAbstractDatastore

[0462] See Also:

[0463] unRegisterMapping

[0464] public void unRegisterMapping(String mappingName) throws DKException, Exception

[0465] Unregisters mapping information from this datastore.

[0466] Parameters:

[0467] mappingName—name of the mapping information

[0468] Overrides:

[0469] unRegisterMapping in class dkAbstractDatastore

[0470] See Also:

[0471] registerMapping

[0472] public String[ ] listMappingNames( ) throws DKException, Exception

[0473] Gets the list of the registered mappings for this datastore.

[0474] Returns:

[0475] an array of registered mapping objects' names. The array length would be zero if there is no mapping registered.

[0476] Overrides:

[0477] listMappingNames in class dkAbstractDatastore

[0478] See Also:

[0479] registerMapping

[0480] public dkSchemaMapping getMapping(String mappingName) throws DKException, Exception

[0481] Gets mapping information from this datastore.

[0482] Parameters:

[0483] mappingName—name of the mapping information

[0484] Returns:

[0485] the schema mapping object

[0486] Overrides:

[0487] getMapping in class dkAbstractDatastore

[0488] See Also:

[0489] registerMapping

[0490] public synchronized dkextension getExtension(String extensionName) throws DKException, Exception

[0491] Gets the extension object from a given extension name.

[0492] Parameters:

[0493] extensionName—name of the extension object.

[0494] Returns:

[0495] extension object.

[0496] Overrides:

[0497] getextension in class dkAbstractDatastore

[0498] public synchronized void addExtension(String extensionName, dkExtension extensionObj) throws DKException, Exception

[0499] Adds a new extension object.

[0500] Parameters:

[0501] extensionName—name of new extension object

[0502] extensionObj—the extension object to be set

[0503] Overrides:

[0504] addextension in class dkAbstractDatastore

[0505] public synchronized void removeExtension(String extensionName) throws DKException, Exception

[0506] Removes an existing extension object.

[0507] Parameters:

[0508] extensionName—name of extension object to be removed

[0509] Overrides:

[0510] removeExtension in class dkAbstractDatastore

[0511] public synchronized String[ ] listExtensionNames( ) throws DKException, Exception

[0512] Gets the list of extension objects' names.

[0513] Returns:

[0514] an array of extension objects' names

[0515] Overrides:

[0516] listExtensionNames in class dkAbstractDatastore

[0517] public DKDDO createDDO(String objectType, int Flags) throws DKException, Exception

[0518] Creates a new DDO with object type, properties and attributes set for a given back-end server.

[0519] Parameters:

[0520] objectType—the object type

[0521] Flags—to indicate various options and to specify more detailed characteristics of the DDO to create. For example, it may be a directive to create a document DDO, a folder, etc.

[0522] Returns:

[0523] a new DDO of the given object type with all the properties and attributes set, so that the user only needs to set the attribute values

[0524] Overrides:

[0525] createDDO in class dkAbstractDatastore

[0526] public dkCollection listSearchTemplates( ) throws DKException, Exception

[0527] Gets a list search templates from a federated server.

[0528] Returns:

[0529] a DKSequentialCollection of search templates

[0530] Throws: DKException

[0531] if internal datastore error occurs

[0532] public String[ ] listSearchTemplateNames( ) throws DKException, Exception

[0533] Gets a list search templates' names from a federated server.

[0534] Returns:

[0535] an array of search template names

[0536] Throws: DKException

[0537] if internal datastore error occurs

[0538] public dkSearchTemplate getSearchTemplate(String templateName) throws DKException,

[0539] Exception

[0540] Gets a search template information from a given template name.

[0541] Returns:

[0542] dkSearchTemplate object.

[0543] Throws: DKException

[0544] if internal datastore error occurs

[0545] public void destroy( ) throws DKException, Exception

[0546] datastore destroy—datastore cleanup if needed

[0547] Overrides:

[0548] destroy in class dkAbstractDatastore

[0549] public synchronized string addRemoveCursor (dkResultSetCursor iCurt int action) throws DKException, Exception

[0550] public dkdatastore datastoreByServerName (String dsType, String dsName) throws DKException, Exception

[0551] Gets a reference to the specified datastore. The datastore must be connected, otherwise it will return null even if one is found. First, it will look in the free connection pool. If none found, it will look under the connection pool held by active cursors.

[0552] Parameters:

[0553] <action> consider the case when transaction is active

[0554] public void changePassword (String serverName,

[0555] String user Id,

[0556] String oldPwd,

[0557] String newPwd)

[0558] throws DKException, Exception

[0559] Changes the password of a given user Id for a specified server. Administrator only finction.

[0560] Parameters:

[0561] userId—the user-id

[0562] oldPwd—the old password

[0563] newPwd—the new password

[0564] public void requestConnection (String serverName,

[0565] String userId,

[0566] String passwd,

[0567] String connectString)

[0568] throws DKException, Exception

[0569] Requests a connection to a particular server with the given userid, password & connectString.

[0570] Parameters:

[0571] userId—the user Id

[0572] passwd—the password

[0573] connectString—the connect string to logon

[0574] public void excludeServer (Sting serverName, String templateName) throws DKException, Exception

[0575] Requests the named server to be skipped for the named search template.

[0576] Parameters:

[0577] serverName—a back end server name

[0578] templateName—a search template name

[0579] public boolean isServerExcluded (String serverName, String templateName) throws DKException, Exception, java.rmi.RemoteException

[0580] Checks if the given server is in the excluded list for the named search template.

[0581] Parameters:

[0582] serverName—a back end server name

[0583] templateName—a search template name

[0584] Returns:

[0585] true or false

[0586] public String[ ] listExcludedServers(String templateName) throws DKException, Exception

[0587] Lists all the excluded servers for the named search template

[0588] Parameters:

[0589] s—templateName—a search template name

[0590] Returns:

[0591] an array of server names that were excluded during search

[0592] public void clearExcludedServers(String templateName) throws DKException, Exception

[0593] Clears all the excluded servers for the named search template

[0594] Parameters:

[0595] s—templateName—a search template name

[0596] The following is sample syntax of a federated query string. However, it is to be understood that other syntax, including other parameters, may be used for the federated query string without departing from the scope of the invention.

[0597] There are several mechanisms for users to submit federated queries for execution. For example, users can create a federated query string and pass it to a federated query object and then invoke an execute or evaluate method on that object to trigger the query processing. Alternatively, a user can pass the federated query string to the execute or evaluate method in the federated datastore to process the query directly. The query string will be parsed into a federated query canonical form (query expression), which is essentially a datastore neutral representation of the query. In case the input query comes from a graphical user interface (GUI) based application, the query does not need to be parsed and the corresponding canonical form can be directly constructed.

[0598] The query canonical form is the input for the federated query processor module. This module will perform the following tasks:

[0599] Query translation. Translates the query canonical form into several native queries that corresponds to each native datastore associated to this federated datastore . The translation information is obtained from the schema mapping.

[0600] Data conversion. Converts data in the query into a native data type for each of the associated native datastores. This process uses the mapping and conversion mechanisms described in the schema mapping.

[0601] Data filtering. Filters only the relevant data during the construction of native queries.

[0602] Each native query is submitted to the corresponding native datastore for execution. Initially, the results returned are cursors to the data in each datastore.

[0603] The end-result of an initial query is a federated result set cursor object, which is a virtual collection (i.e., at this time, data has not actually been retrieved) of cursors to objects in each of the native datastores.

[0604] The user can retrieve the actual data using a fetch. When a fetch is issued for data, the data is returned by the native datastores to the federated query results processor module, which will do the following:

[0605] Data conversion. Converts data from the native type into a federated type according to the mapping information.

[0606] Data filtering. Filters the results to include only the requested data.

[0607] Result merging. Merges the results from several native datastores into a federated collection.

[0608] The federated result set cursor object provides the facility to separate query results according to the source native datastores. To do such a processing, the user/application may either use the federated cursor to fetch data or a native datastore cursor to fetch data from a particular datastore.

[0609] A FederatedQuery represents and executes queries across heterogeneous datastores. This query can be a combination of a DL parametric query, OnDemand query, and other query types involving supported datastores. To retrieve data from each datastore, the federated datastore delegates the query processing task to each of the native datastores.

[0610] FederatedQuey.java

[0611] package corn ibm.mm.sdk.server;

[0612] public class FederatedQuery implements Query

[0613] {

[0614] public FederatedQuery(Datastore creator, String querystring);

[0615] public FederatedQuery(FederatedQuery fromQuery);

[0616] public void prepare(NVPair params[ ]);

[0617] public void execute(NVPair params[ ]);

[0618] public int status( );

[0619] public Object result( );

[0620] public short qlType( );

[0621] public String querystring( );

[0622] public Datastore datastore( );

[0623] public dkResultSetCursor resultSetCursor( );

[0624] public int numberOfResults( );

[0625] }

[0626] A schema mapping represents a mapping between the schema in a datastore with the structure of the data-object that the user wants to process in memory. Schema mapping has been generally described in U.S. patent application Ser. Nos. 08/276,382 and 08/276,747, also assigned to IBM.

[0627] A federated schema is the conceptual schema of a federated datastore 100, which defines a mapping between the concepts in the federated datastore 100 to concepts expressed in each participating datastore schema In general, a schema mapping handles the difference between how the data are stored in the datastore (as expressed by the datastore's conceptual schema) and how the user wants to process them in the application program. This mapping can also be extended to incorporate relationship associations among entities in a federated datastore, e.g., associating an employee's name with the appropriate department name. Since the mapping process can be a bit tedious, it is usually done with the help of a typical GUI-oriented schema mapping program.

[0628] In addition to schema-mapping information involving the mapping of entities and attributes, a federated datastore 100 must also have access to the following information:

[0629] User-id and password mapping. To support single sign-on features, each user-id in the federated datastore 100 needs to be mapped to its corresponding user-ids in the native datastores.

[0630] Datastore registration. Each native datastore needs to be registered so it can be located and logged-on to by the federated datastore 100 processes on behalf of its users.

[0631] An embodiment of the invention provides a password system. The password system provides password encryption and decryption for user authentication in a federated content management system. As content is getting more complex and diversified, the system administration of a federated content management system for heterogeneous datastores is becoming more critical. The password system handles password encryption and decryption for various federated and native datastores, regardless of the language environments of these datastores (e.g., C, C++ or Java environments). Password encryption and decryption for user authentication is an important security mechanism in enterprise computing.

[0632] In a federated content management system, a user can log onto a federated datastore using a federated system administration tool and gain access to multiple heterogeneous back-end datastores (i.e., native datastores). In particular, the user enters only a federated user identifier (ID) and a federated password. Internally, at each native datastore, a mapping between a federated user ID/password and native user ID/password is stored (typically by a system administrator) in each native datastore. For security reasons, when the federated password is received by the federated datastore, the federated datastore needs to retrieve the native password from a native datastore in an encrypted format. The encrypted password is then decrypted by the federated datastore before it is used for logging on to a native datastore. The back-end datastores may consist of one or more datastores, such as one of the following: VisualInfo, Digital Library, OnDemand, ImagePlus 390, VisualInfo 400, and Domino.Doc.

[0633] A Data Encryption Standard (DES) system is used as the encryption/decryption technique. Encryption is the translation of data into a secret code. Encryption is an effective way to achieve data security. Decryption is the process of decoding data that has been encrypted. The DES system is a symmetric-key encryption system that uses a 56 bit key. The symmetric-key encryption system is an encryption system in which the sender and receiver of a message share a single, common key that is used to encrypt and decrypt the message. A key is used to read the encrypted data. A key refers to a password or table that is used to decipher encoded data.

[0634] The DES system has been standardized by the American National Standards Institute (ANSI). DES has been a popular encryption/decryption technique for over twenty years. Nevertheless, the use of DES to handle a password as a character string for user authentication has exposed some deficiencies. The DES system has a problem in decrypting an encrypted password as a character string. In particular, the DES system does not handle a “00000000” byte properly during string processing. The “00000000” byte refers to a computer-implemented zero, which is not a printable character.

[0635] Additionally, the DES system may be implemented in one language (e.g., the C language) in a native datastore, while the DES technique may be implemented in another language (e.g., the Java language) at the federated datastore. Use of the different languages leads to incompatibility in encryption and decryption. For example, the native datastore encrypts a native password using the C language DES implementation, which uses an ASCII standard. On the other hand, the federated datastore decrypts a native password using the Java language DES implementation, which uses a Unicode standard. In particular, a native password may contain a generated ASCII character, used by the C language, that is not compatible with the Unicode format used in the Java language.

[0636] ASCII is an acronym for the American Standard Code for Information Interchange. ASCII refers to a code for representing English characters as numbers, with each alphabet letter assigned a number from 0 to 127. For example, the ASCII code for uppercase M is 77. The native password is represented with ASCII codes. Additionally, the ASCII code may use 8 bits for a character, which enables encoding alphabet letters as well as non-English characters, graphics symbols, and mathematical symbols. Unicode is a standard for representing characters as integers. Unlike ASCII, which uses 8 bits for each character, Unicode uses 16 bits, which enables Unicode to represent many more characters than ASCII.

[0637] Furthermore, it is desirable to have a password contain printable characters. For example, this enables a user to manually input a password and also enables a user to forward a password to another user. Currently, the native password may contain non-printable characters.

[0638] The password system resolves these problems with a technique for handling password encryption and decryption for user authentication in a federated content management system.

[0639] FIG. 5 is a diagram illustrating an overview of the password system. A federated datastore client 500 is connected to a federated datastore server 502. The federated datastore server 502 is connected to several native datastores. The native datastores include a DL (Digital Library) datastore 504, a VisualInfo datastore 506, and an OnDemand datastore 508.

[0640] Initially, if a user would like to retrieve data from the native datastores 504, 506, or 508, the user submits a federated password 510 at the federated datastore client 500. Although not shown, a user may also submit the federated password 510 directly at the federated datastore server 502.

[0641] The federated datastore client 500 passes the federated password 510 to the federated datastore server 502. The federated datastore server 502 initially determines whether the federated password 510 is valid. If the federated password 510 is not valid, the federated datastore server 502 returns an indication to the user, via the federated datastore client 500, indicating that the submitted federated password 510 is not valid. If the federated password 510 is valid, the federated datastore server 502 maps the federated password for the user to one or more native passwords 512.

[0642] In particular, a system administrator maintains native passwords 512 for a user at each native datastore 504, 506, and 508. The federated datastore server 502 has a table that maps the native password 512 for a user to the federated password 510. Therefore, with the federated password 510, the native datastore 504, 506, or 508 returns the native password 512 in encrypted form. The encryption is performed using the password system of the present invention.

[0643] For each native password 512, the federated datastore server 502 stores the encrypted native password 512. Then, when the user wishes to retrieve data from one of the native datastores 504, 506, or 508, the federated server 502 decrypts the native password 512 and uses the native password 512 to attempt to retrieve data from a particular native datastore 504, 506, and 508. The decryption is performed using the password system of the present invention.

[0644] The password system generates a tagged password that consists of an encrypted password and a tag. Additionally, the password system uses a unique procedure for generating the tag from the encrypted password. A password is initially input to a DES system for encryption. After the encrypted password is returned from the DES system, the password system generates a tag from the encrypted password. The tag carries information to ensure that the “00000000” byte is handled properly, that compatibility is maintained in different language environments (e.g., C and Java), and that the tagged password can be displayed as printable characters.

[0645] The password system has a number of benefits. For example, the password system supports bi-directional encryption and decryption. This is an improvement over the existing password encryption/decryption technique, which has a problem with decryption in one language environment of a password that has been encrypted in another language environment. Additionally, multiple language support is available for C, C++, and Java The compatibility between ASCII codes and Unicode codes is maintained by ensuring that the encrypted characters are in the range of decimal 32 to decimal 126 (which are ASCII codes representing printable ASCII characters). The decrypted string is shown as a printable character string. Since all the encrypted characters are in the range of decimal 32 to decimal 126, they can be displayed as printable characters. This is an advantage for processing the password. Moreover, the encrypted password can be easily stored in a flat file or a database table.

[0646] The password system encompasses the structure of a tagged password that consists of an encrypted password and a tag, as well as a procedure that generates the tag from the encrypted password.

[0647] The password system takes the string that needs to be encrypted (e.g., the native password) eight characters at a time and treats the eight characters as two 32-bit numbers. A DES system processes these two 32-bit numbers with the keys (0x1F38542A, 0xBC34612F) and returns an eight-character encrypted string. If the returned string contains non-printable ASCII characters, there will be problems when the string is encrypted using one language (e.g., C++) and decrypted using another language (e.g., Java). The password system solves this problem by ensuring that the encrypted characters are in the range of 32 (i.e., 0x20 in hexadecimal) and 126 (i.e., 0x7E in hexadecimal). In this range Unicode characters are equivalent to the ASCII characters (as well as ISO8859-1 (Latin-1) characters). The password system uses a tag with four control characters to ensure that the encrypted characters in the appropriate range.

[0648] A tagged password has a total length of 12 characters, consisting of an encrypted password of 8 characters and a tag of 4 characters. The password system receives an encrypted password from a DES system. Then, the password system generates a tag, which is a set of control characters, from the encrypted password. Below is a sample structure of an encrypted password, a tag, and their character positions.

[0649] Each control character (e.g., C0, C1, C2, or C3) defines the control codes for two encrypted characters (e.g., B0, B1, B2, B3, B4, B5, B6, or B7). The relationship between the characters of the encrypted password and the control characters of the tag can be described as follows:

[0650] control character C0 is generated from encrypted password characters B0 and B1.

[0651] control character C1 is generated from encrypted password characters B2 and B3.

[0652] control character C2 is generated from encrypted password characters B4 and B5.

[0653] control character C3 is generated encrypted password characters from B6 and B7.

[0654] Each control character has eight bits. The following is a sample structure for one control character (e.g., C0, C1, C2, or C3):

[0655] Bit 0 and bit 1 are used to ensure that the control character is within the range of 32 to 126 (i.e., is a printable character). Bit 2, bit 3, and bit 4 are set based on the value of the first encrypted password character that the control character is associated with. Bit 5, bit 6, and bit7 are set based on the value of the second character of the encrypted password that the control character is associated with. For example, control character C0 is associated with encrypted password characters B0 and B1. Therefore, bit 2, bit 3, and bit 4 are associated with encrypted password character B0. Also, bit 5, bit 6, and bit7 are associated with encrypted password character B1.

[0656] The first bit (bit 0) of a control character is always “off” (i.e., set to zero). This ensures that the control character is an ASCII character.

[0657] The second bit (bit1) of a control character is always “on” (i.e., set to one). This ensures that the decimal value of this control character is not less than 32 (i.e., is not a non-printable character having a code less than 32).

[0658] The third bit (bit 2) of a control character is set based on the first bit (bit 0) of the first encrypted password character to which that control bit corresponds. In particular, if bit 0 of the first encrypted password character is set to one, the password system changes bit 0 of the first encrypted password character to zero. This ensures that the first encrypted password character is an ASCII character, not a Unicode character. Additionally, the password system sets bit 2 of the control character to one. Setting bit 2 of the control character to one is an indication that bit0 of the first encrypted password character was reset (i.e., changed from one to zero). If bit 0 of the first encrypted password character is zero, the password system sets bit 2 of the control character to 0, without modifying the first encrypted password character.

[0659] The fourth bit (bit3) of a control character is set based on the value of the first encrypted password character. In particular, if the value of the first encrypted password character is less than 32 (i.e., a hexadecimal value of 0x20), the password system adds 32 to the value of the first encrypted password character. This ensures that the first encrypted password character is not less than 32 for printing purposes. Then, the password system sets bit 3 of the control character to one to indicate that 32 has been added to the value of the first encrypted password character. If the value of the first encrypted password character is equal to or greater than 32, the password system sets bit 3 of the control bit to zero, without modifying the first encrypted password character.

[0660] The fifth bit (bit 4) of the control character is based on the value of the first encrypted password character. In particular, if the value of the first encrypted password character is 127 (i.e., a hexadecimal value of 0x7F), the password system changes the first encrypted password character to 36 (i.e., a hexadecimal value of 0x24, which represents a ‘$’ sign). This ensures that the first encrypted password character is not 127 for printing purposes. Also, the selection of a value of 36 is one example only, and other printable values may be used instead. Additionally, the password system sets bit 4 of the control bit to one to indicate that the first encrypted password character has been changed to 36. If the value of the first encrypted password character is not 127, the password system sets bit 4 to zero, without modifying the first encrypted password character.

[0661] The sixth bit (bit 5) of the control character is based on the value of the second encrypted password character. In particular, if bit 0 of the second encrypted password character is set to one, the password system changes bit 0 of the second encrypted password character to zero. This ensures that the second encrypted password character is an ASCII character, not a Unicode character. Additionally, the password system sets bit 5 of the control character to one to indicate that bit0 of the second encrypted password character was reset. If bit 0 of the second encrypted password character is zero, the password system sets bit 2 of the control character to 0, without modifying the second encrypted password character.

[0662] The seventh bit (bit 6) of the control character is based on the value of the second encrypted password character. In particular, if the value of the second encrypted password character is less than 32 (i.e., a hexadecimal value of 0x20), the password system adds 32 to the value of the second encrypted password character. This ensures that the second encrypted password character is not less than 32 for printing purposes. Then, the password system sets bit 6 of the control character to one to indicate that 32 has been added to the value of the second encrypted password character. If the value of the second encrypted password character is equal to or greater than 32, the password system sets bit 6 of the control bit to zero, without modifying the second encrypted password character.

[0663] The eighth bit (bit 7) of the control character is based on the value of the second encrypted password character. In particular, if the value of the second encrypted password character is 127 (i.e., a hexadecimal value of 0x7F), the password system changes the second encrypted password character to 36 (i.e., a hexadecimal value of 0x24, which represents a ‘$’ sign). This ensures that the second encrypted password character is not 127 for printing purposes. Also, the selection of a value of 36 is one example only, and other printable values may be used instead. Additionally, the password system sets bit 7 of the control bit to one to indicate that the second encrypted password character has been changed to 36. If the value of the second encrypted password character is not 127, the password system sets bit 7 to zero, without modifying the second encrypted password character.

[0664] To ensure that the control character is in the range of 32 to 126 The first bit (bit 0) of the control character is set to 0, and the and second bit (bit 1) of the control character is set to 1. Additionally, since bits 3 and 4, and bits 6 and 7, are not set at the same time, the control character itself will not be 127.

[0665] Using the control characters, the password system can perform decryption of the tagged string (i.e., transform the string back to its original encrypted form for use in accessing native datastores). For example, for a control character, if bit 2 is on, the password system changes bit 0 of the first encrypted password character to 1. If bit 3 of the control character is on, the password system subtracts 32 from the first encrypted password character. If bit 4 of the control character is on, the password system changes the first character to 0x7f. Similarly, bits 5-7 are processed for a second encrypted password character.

[0666] For example, if the string to be encrypted is “password”, after applying the DES system with keys (01F38542A, 0xBC34612F), the encrypted string is “0x 3e 0e 94 9d 91 54 18 dc”. The password system transforms the encrypted string into the following tagged string: “0x 3e 2e34 3d 31 54 38 5c 42 76 70 54”. The first 8 characters are the transformed, encrypted character string; and, the last 4 characters represent the control codes of the tag. The hexadecimal string corresponds to “>0.4=1T8/BvpT”.

[0667] FIG. 6 is a flow diagram illustrating steps performed by the password system to generate a tagged. In block 600, the password system receives an eight character string to be encrypted. In block 602, the password system performs encryption with a DES systems to obtain an encrypted string. In one embodiment, the received string is a native password that is used to access a native datastore.

[0668] In block 604, the password system assigns the characters of the encrypted string to B[0] to B[7] (string B). In block 606, the password system generates an initial tag of 4 control characters, C[0] to C[3] (string C). At t his point, the password system also sets bit 0 of each control character to 0 (to ensure that the control character is an ASCII character) and sets bit 1 of each control character to 1 (to ensure that the decimal value of the control character is not less than 32).

[0669] The iteration through blocks 608-628 may change the bits in the encrypted string characters and their corresponding control characters. In particular, blocks 616 and 618 handle bit 2 and bit 5 of a control character. Blocks 620 and 622 handle bit 3 and bit 6 of a control character. Blocks 624 and 626 handle bit 4 and bit 7 of a control character.

[0670] Continuing with the flow diagram, in block 608, the password system sets a counter “i” to zero. The counter is used to count through the encrypted string characters assigned to B0 to B7. In block 610, the password system determines whether the counter is less than 8. If the counter is less than 8, the password system continues to block 616, otherwise, the password system continues to block 612. That is, if each of the encrypted string characters (counted 0 to 7) are processed, the password system concatenates the encrypted string characters (i.e., string B) and the control characters (i.e., string C) in block 612. Then, in block 614, the password system outputs the twelve character tagged string.

[0671] In block 616, the password system determines whether an encrypted string character (B[i]) is greater than 127. If so, the password system continues to block 618, otherwise, the password system continues to block 620. In block 618, the password system resets bit 0 of the encrypted string character to zero (to ensure that the encrypted string character is an ASCII character) and sets a bit of the corresponding control character. The bit set is either bit 2 or bit 5, depending on whether the encrypted string character is the first or second character associated with the control character.

[0672] In block 620, the password system determines whether an encrypted string character (B[i]) is less than 32. If so, the password system continues to block 622, otherwise, the password system continues to block 624. In block 622, the password system adds 32 to the value of the encrypted string character, to ensure that the value of the encrypted string character is not less than 32 (i.e., characters less than 32 are not printable characters). Additionally, the password system sets a bit of the corresponding control character. The bit set is either bit 3 or bit 6, depending on whether the encrypted string character is the first or second character associated with the control character.

[0673] In block 624, the password system determines whether an encrypted string character (B[i]) is 127 (i.e., an unknown character). If so, the password system continues to block 626, otherwise, the password system continues to block 624. Therefore, in block 626, the password system sets the value of the encrypted string character to 36 (i.e., B[i] is 127, hexadecimal 0x5B is 91, and the difference is 36), which represents a dollar sign ($). Moreover, the password system sets a bit of the corresponding control character. The bit set is either bit 4 or bit 7, depending on whether the encrypted string character is the first or second character associated with the control character.

[0674] In block 628, the password system increments the counter. Then, the password system loops back to block 610.

[0675] FIG. 7 is a flow diagram illustrating steps performed by the password system to transform a tagged string into its original format. In block 700, the password system receives a 12 character tagged string. In block 702, the password system assigns the first eight characters to B[0] to B[7] (string B). In block 704, the password system assigns the last four characters to C[0] to C[3] (string C). In b 706, the password system initializes counter j to zero. The counter is used to count through the control characters. In block 708, the password system determines whether the counter is less than 4. If so, the password system continues to block 710, otherwise, the password system continues to block 720.

[0676] In block 710, when bit 2 or bit 5 of a control character are set, the password system sets bit 0 of the corresponding encrypted string character to 1. As discussed above, each control character corresponds to two encrypted string characters. Thus, for bit 2, the corresponding encrypted string character is the first corresponding encrypted string character; for bit 5, the corresponding encrypted string character is the second corresponding encrypted string character. In block 712, when bit 3 or bit 6 of a control character are set, the password system subtracts 32 from the corresponding encrypted string character. For bit 3, the corresponding encrypted string character is the first corresponding encrypted string character; for bit 6, the corresponding encrypted string character is the second corresponding encrypted string character. In block 714, when bit 4 or bit 7 of the control character are set, the password system sets the corresponding encrypted character to 127. For bit 4, the corresponding encrypted string character is the first corresponding encrypted string character; for bit 7, the corresponding encrypted string character is the second corresponding encrypted string character. In block 716, the password system increments the counter and loops back to block 708.

[0677] In block 720, the password system performs decryption on string B with a DES system to obtain a decrypted string B. In block 722, the password system returns string B. In one embodiment, the resulting string B is a native password that is used to access a native datastore.

[0678] This concludes the description of the preferred embodiment of the invention. The following describes some alternative embodiments for accomplishing the present invention. For example, any type of computer, such as a miniframe, minicomputer, personal computer, mobile device, or embedded system, or computer configuration, such as a timesharing mainframe, local area network, or standalone personal computer, could be used with the techniques of the present invention.

[0679] The foregoing description of the preferred embodiment of the invention has been presented for the purposes of illustration and description. It is not intended to be exhaustive or to limit the invention to the precise form disclosed. Many modifications and variations are possible in light of the above teaching. It is intended that the scope of the invention be limited not by this detailed description, but rather by the claims appended hereto.