Remote Authentication Token Revocation for Web Session Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional web-based service sign-in processes on mobile devices are cumbersome and insecure, as they require users to manually enter long passwords and do not allow for remote revocation of authentication tokens, leaving devices vulnerable to unauthorized access even after password changes.
Innovation Solution
A remote sign-out methodology that allows users to delete authentication tokens from a central server, invalidating access to web-based services from any device, thereby preventing unauthorized access by misappropriation of the initial sign-in device.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If persistent cookies with extended expiration periods are used to keep user sessions valid, then the ease of operation is improved, but the security is worsened because unauthorized access cannot be revoked
Solution Approach 1:
The patent implements dynamic session management by introducing a remote sign-out mechanism that allows users to dynamically terminate sessions on any device. The system maintains a registry of active sessions and their associated device identifiers, enabling the authentication server to dynamically invalidate sessions remotely. This transforms the static, extended-duration cookie approach into a dynamic system where session validity can be changed in real-time based on user actions or security events.
2Ease of operation
If remote device wipe mechanisms are implemented through scheduled synchronizations, then the ease of operation is improved, but the security is worsened because misappropriation between synchronizations enables unauthorized access
Solution Approach 1:
The patent implements preliminary action by establishing a continuous session registry that proactively tracks all active sessions before any misappropriation can occur. Rather than waiting for scheduled synchronization events to detect and respond to device loss, the system maintains real-time awareness of all active sessions through the authentication token registry. This allows immediate remote sign-out capability to be activated at any moment, preventing unauthorized access during the intervals between scheduled operations.
3Reliability
If additional software is installed on mobile devices to support remote data wipes, then the security is improved, but the device complexity is worsened
Solution Approach 1:
The patent extracts the session management functionality from the mobile device itself and relocates it to the authentication server. Instead of requiring complex client-side software to implement remote wipe capabilities, the system moves the session registry and invalidation logic to the server side. The mobile device only needs to participate in standard authentication protocols, while all sophisticated session tracking and remote termination operations are performed externally by the authentication server, eliminating the need for additional device software.
Data Source
AI summary
Remote sign-out of web based service sessions. As a part of remote sign-out of web based service sessions, a user authentication token is accessed that is used to establish a web based service session and this user authentication token is stored in memory of an authentication server and returned in a cookie to the device. User access and deletion of the user authentication token from memory is accommodated using a device different from that which initially established the web based service session. Upon receipt of a browser request involving the user authentication token, it is determined whether the user authentication token is stored in memory. An access denial indication is provided to a web based service that indicates that the user authentication token is not stored in memory.