Access Token Refresh with Inactivity-Based Session Timeout
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current access control mechanisms in data management systems result in either extended user access periods despite application closure or premature session timeouts due to the use of longer-lived refresh tokens, failing to meet service level agreements (SLAs).
Innovation Solution
Implementing a self-refreshing access token mechanism with a session inactivity timeout timer in the client that periodically refreshes the access token before expiration and transmits a logout request to the backend if the timer expires, ensuring timely session termination without relying on a separate refresh token.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Duration of action of moving object
If refresh tokens are used with longer lifespan than access tokens, then user access can be maintained for extended periods, but session timeout control becomes ineffective and users retain access beyond intended session duration
Solution Approach 1:
The patent segments the token system into two distinct components: access tokens with short lifespan for active session control, and refresh tokens with longer lifespan for authentication persistence. This segmentation allows the system to maintain security by invalidating access tokens on timeout while preserving the ability to re-authenticate through refresh tokens, thus resolving the contradiction between extended access and timeout control.
Solution Approach 2:
The system performs preliminary action by establishing the refresh token mechanism in advance, which enables the client to proactively request new access tokens before the current one expires. This preliminary setup allows the system to maintain continuous authenticated access while still enforcing session timeout policies through controlled access token invalidation, resolving the contradiction between session duration and timeout reliability.
2Productivity
If access tokens are refreshed periodically before expiration, then continuous access is maintained, but the system complexity increases due to additional token management mechanisms
Solution Approach 1:
The patent implements self-service by enabling the client to autonomously refresh access tokens using the refresh token without requiring server intervention or complex token management infrastructure. The client independently manages the token lifecycle by detecting expiration and requesting new tokens, thus maintaining continuous access while minimizing system complexity.
Solution Approach 2:
The system employs periodic action through scheduled access token refreshes initiated by the client before token expiration. This periodic refresh mechanism ensures continuous access while keeping the implementation simple, as it relies on straightforward time-based checks and token renewal requests rather than complex real-time monitoring systems.
3Measurement precision
If the client monitors session inactivity and manages token refresh, then accurate session timeout is achieved, but the client-side complexity and processing overhead increase
Solution Approach 1:
The patent applies universality by designing the session manager to perform multiple functions: it monitors session inactivity, manages access token lifecycle, handles refresh token operations, and enforces timeout policies. This multi-functional approach consolidates complexity into a single client-component rather than distributing it across multiple systems, thus achieving precise session detection without proportionally increasing overall system complexity.
Solution Approach 2:
The system implements feedback through the session manager's continuous monitoring of user activity and automatic adjustment of token refresh timing. The manager detects inactivity patterns and triggers token refresh or logout actions accordingly, providing precise session control while keeping the mechanism relatively simple through event-driven responses rather than complex continuous analysis.
Data Source
AI summary
Methods, systems, and devices for data management are described. A client may transmit, to a server, a login request for an application. The login request may include authentication parameters associated with a user. The client may receive, from the server, an access token that supports access via a user interface to one or more services associated with the application before expiration of a time-to-live for the access token. The client may transmit, prior to expiration of the time-to-live for the access token and based on a session inactivity timeout timer being active, a refresh request for a new access token. The refresh request may include an indication of the access token. The application may receive the new access token in response to the refresh request, and the new access token supports access to the one or more services before expiration of a time-to-live for the new access token.