Global Sign-Out on Shared Mobile Devices
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile device authentication systems are inefficient for shared devices, particularly in enterprise settings, as they lack a straightforward method for global sign-out, leading to usability issues and potential data security risks when multiple users share devices.
Innovation Solution
Implementing heuristics to determine if a device is shared, replacing the traditional 'sign out' link with an 'end of shift' link, and using a session revocation manager to invalidate refresh tokens and cookies, ensuring a user is signed out of all applications, with options for administrators to enforce global sign-out.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If traditional sign-out mechanisms are used on shared devices, then individual application sign-out is possible, but global sign-out across all applications cannot be achieved and session artifacts remain on the device
Solution Approach 1:
The patent combines multiple individual sign-out operations into a single global sign-out action. When a user signs out from one application on a shared device, the system automatically triggers sign-out across all other applications and removes session artifacts from shared storage, merging what would otherwise be multiple separate operations into one unified action.
Solution Approach 2:
The patent segments the sign-out process into two distinct modes: individual application sign-out for personal devices and global sign-out for shared devices. The system detects device type and applies the appropriate segmentation, allowing users to selectively sign out from specific applications on personal devices while enforcing global sign-out on shared devices to maintain security.
2Reliability
If accounts are removed from shared storage to enable sign-out, then user privacy is protected, but other applications that share the same storage lose access to necessary tokens and session data
Solution Approach 1:
The patent extracts session artifacts and tokens from shared storage when a global sign-out is initiated. Instead of leaving sensitive data in shared storage areas where multiple applications can access it, the system removes these artifacts entirely from the device, ensuring that user privacy is protected while preventing other applications from accessing compromised session data.
Solution Approach 2:
The patent implements preliminary anti-action by proactively removing session artifacts and invalidating tokens before a user can inadvertently expose sensitive information. When a sign-out gesture is detected on a shared device, the system immediately cleans up shared storage and revokes access tokens, preventing potential security issues before they can occur.
3Ease of operation
If session artifacts are maintained on shared devices for multiple applications, then application functionality is preserved, but security risks increase when devices are shared between multiple users
Solution Approach 1:
The patent implements dynamic session management where the persistence of session artifacts changes based on device type. On personal devices, session artifacts are maintained dynamically across applications to ensure continuity. On shared devices, the system dynamically switches to a state where session artifacts are removed after each user's sign-out, adapting the security model to the contextual usage scenario.
Solution Approach 2:
The patent introduces an intermediary mechanism that detects device type and mediates between application continuity needs and security requirements. This intermediary layer monitors user gestures and device characteristics, then applies appropriate session management policies - maintaining artifacts for personal devices while enforcing their removal for shared devices, thus mediating the conflict between functionality and security.
4Productivity
If multiple users share a device without global sign-out capability, then device utilization is maximized, but data security and user privacy cannot be ensured
Solution Approach 1:
The patent implements periodic session cleanup on shared devices through gesture-based detection. Each time a user performs a sign-out gesture or the device detects a transition between users, the system periodically removes session artifacts and invalidates tokens. This periodic action ensures that even though multiple users share the device for extended periods, security is maintained through regular cleanup cycles.
Solution Approach 2:
The patent enables the device to automatically manage session security without requiring explicit user intervention for each sign-out event. The system self-monitors for sign-out gestures, automatically triggers global sign-out across all applications, and cleans up shared storage. This self-service approach maintains security while allowing continuous device utilization by multiple users.
Data Source
Figure 1
Figure 2A
Figure 2B
AI summary
Heuristics can be used to determine if an alternate behavior is desired on a particular mobile device to enable one-touch sign-out. The alternate behavior can be the appearance of a sign-out experience and mechanism. For example, instead of a "sign out" link appearing, an "end of shift" link can be displayed. Heuristics can be used to determine if a particular mobile device is a shared device. If the device is a shared device, this information can be made discoverable to mobile applications (e.g. by including a "shared device" flag in authentication tokens). When a mobile application finds the shared device flag indicates the device is shared, the "Sign-out" link for the mobile application can be replaced with an "End my shift" link. In response to a user clicking on the link, a global sign out can delete session artifacts on the device and/or on the server