Gateway Session Management via Request Analysis

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing session management systems in wide area networks are vulnerable to unauthorized access due to automatically-generated requests that can extend user sessions beyond intended time limits, defeating authentication policies and compromising protected resources.

Innovation Solution

A gateway with a session management module that analyzes requests and responses to differentiate between user-initiated and automatically-initiated requests, resetting timers only for user-initiated actions to prevent session termination and maintain security.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If time limit policies are implemented to terminate abandoned sessions, then security of protected resources is improved, but session duration is reduced

Engineering Contradiction:

ImprovesecurityVSAvoidsession duration

Core Design Contradiction:

ReliabilityVSDuration of action of moving object

Solution Approach 1:

The session management system dynamically adjusts session termination decisions based on real-time analysis of request patterns. Instead of using fixed time limits, the system continuously monitors whether requests are user-initiated or automatically-generated, and adapts session duration accordingly. This allows sessions to extend beyond standard time limits when legitimate user activity is detected, while still terminating truly abandoned sessions.

Inventive Principle:

Principle #15Dynamics

Solution Approach 2:

The system implements feedback mechanisms by analyzing the nature of requests and responses to determine whether a session should be terminated. The session management module receives feedback about request characteristics (user-initiated vs. automatically-generated) and uses this information to make informed decisions about session continuation, rather than relying solely on predetermined time limits.

Inventive Principle:

Principle #23Feedback

2Ease of operation

If all requests are assumed to be user-initiated and reset the session timer, then ease of operation is improved, but security is worsened due to unauthorized session extension

Engineering Contradiction:

Improvesession management simplicityVSAvoidsecurity

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The session management module acts as an intermediary between the request processing system and session termination logic. Instead of requiring complex analysis throughout the system, the session management module centralizes the differentiation between user-initiated and automatically-generated requests. It receives requests, determines their nature, and makes session extension decisions, simplifying the overall system while maintaining security.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The system replaces the simple mechanical approach of resetting timers for all requests with an intelligent analysis mechanism. Instead of uniformly treating all requests the same way, the system analyzes request characteristics and applies different logic based on whether requests are user-initiated or automatically-generated, achieving both security and operational efficiency.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Reliability

If session termination is enforced strictly based on time limits, then security is improved, but loss of time occurs due to premature termination of active sessions

Engineering Contradiction:

ImprovesecurityVSAvoidsession interruption

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system performs preliminary analysis of request patterns to identify automatically-generated requests before making session termination decisions. By pre-establishing the ability to differentiate between user-initiated and automatically-generated requests, the system可以避免 premature termination of active user sessions while still enforcing time limits on truly abandoned sessions.

Inventive Principle:

Principle #10Preliminary action

Data Source

PatentUS7954152B2Session management by analysis of requests and responses

Publication Date: 2011.05.31 MICROSOFT TECHNOLOGY LICENSING LLC

AI summary

Session management by analysis of requests and responses is described herein. A gateway receives requests from a client system, forwards the same to a protected resource, and receives responses from the protected resource. The gateway includes a session management module that manages an authenticated session between the client system and the protected resource. In one aspect, the session management module receives responses that are labeled to indicate whether the requests corresponding to the responses are user-initiated or automatically-initiated. In other aspects, the session management module analyzes the requests to identify any periodic patterns appearing therein. The session management module identifies any requests that are part of a periodic pattern as automatically-initiated requests. In either case, the session management module maintains a timer for each session, and resets the timer when a user-initiated request is identified. Any session whose timer expires is terminated.