Layered Logout Strategy for Web Management Session Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional web application logout strategies, such as setting a logout timer and issuing an idle session warning, can be frustrating in closed environments where users manage appliances with numerous configured objects, leading to time-consuming re-entry of data upon forced logoff due to inactivity.
Innovation Solution
Implementing a secure, layered logout strategy with varying security levels and associated permissions that are enforced upon timeouts, allowing users to maintain session continuity while gradually restricting access to management objects based on idle time, ultimately terminating the session only when all security levels expire.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a generic logout timer is implemented to terminate user sessions after idle time, then security is improved by automatically logging out inactive users, but user productivity deteriorates due to forced logoff requiring re-entry of configuration data
Solution Approach 1:
The patent segments the logout process into multiple security levels (first, second, and third levels) with different timeout values and permission sets. Instead of a single forced logout, the system applies progressive permission restrictions at each level, allowing users to retain access to less sensitive objects even after higher security level timeouts occur.
Solution Approach 2:
The patent applies different permission sets locally to different managed objects based on their security level classification. Each managed object is associated with a specific security level, and when a timeout occurs, only objects at that security level and above are restricted, while objects at lower security levels remain accessible with their original permission sets.
2Device complexity
If a single security level logout is enforced, then security is simplified to implement, but flexibility deteriorates because all managed objects are affected uniformly
Solution Approach 1:
The patent divides the set of managed objects into multiple segments based on security levels (first, second, third levels). Each segment has its own timeout value and permission set, allowing differentiated control without requiring a completely complex unified system.
Solution Approach 2:
The patent adds a security level dimension to the traditional logout mechanism. Instead of a single timeout value, the system operates across multiple timeout dimensions (timeout values associated with different security levels), creating a multi-layered permission structure that provides flexibility while maintaining manageable complexity.
Data Source
AI summary
A secure, layered logout of a user session is implemented in a web-based management tool, such as a middleware appliance. A logout strategy is provided to include a set of security levels of varying sensitivity, with each security level having a set of permissions associated therewith and that are enforced upon a timeout. Preferably, each succeeding security level in the set of security levels is reached as time increases from an idle time associated with the user session. Upon expiration of a timeout associated with a security level, the set of permissions associated with the security level are then enforced against at least one managed object while the user session continues. As each next security level is reached, the set of permissions associated with the security level are then enforced (with respect to the managed object or against one or more other managed objects), once again while the user session continues. Each of the objects preferably is managed independently of at least one other object; thus, the layered logout may enforce different permissions with respect to different managed objects while at the time maintaining the user session. If the user takes no action, eventually a timeout associated with a final security level of the set of security levels will occur, at which point the user session is finally terminated.