Security Server Session Extension via Multi-Domain Client Assessment
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web server systems face challenges in maintaining extended sessions securely while minimizing user friction, as short sessions prevent unauthorized access but increase login frequency, leading to decreased usage and incomplete transactions.
Innovation Solution
A security server system determines whether a client device is a single-user device and not compromised using multi-domain data, allowing for extended session extensions only when these conditions are met, thereby enhancing security and reducing user friction.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If session duration is shortened to prevent unauthorized access, then security is improved, but user friction increases and productivity decreases
Solution Approach 1:
The system applies different session duration policies to different clients based on their characteristics. Single-user devices receive extended sessions while shared or potentially compromised devices receive shorter sessions or require re-authentication. This localized approach allows the system to maintain high security for at-risk clients while providing frictionless experience for trusted single-user devices.
Solution Approach 2:
The system dynamically changes the session duration parameter based on client assessment. Instead of using a fixed short session timeout, the system evaluates client behavior and device characteristics, then adjusts the session duration parameter accordingly. This allows extended sessions for verified single-user devices while maintaining short sessions for shared devices, resolving the contradiction between security and user friction.
2Productivity
If session duration is extended to reduce user friction, then productivity is improved, but security is worsened
Solution Approach 1:
The system implements dynamic session management where session duration is not fixed but adapts based on real-time client assessment. The system continuously monitors client behavior and device characteristics, adjusting session length dynamically. This allows the system to extend sessions for trusted single-user devices (improving productivity) while automatically shortening or terminating sessions for shared or compromised devices (maintaining security).
Solution Approach 2:
The system performs preliminary assessment of client devices before granting extended sessions. By evaluating device characteristics, user behavior patterns, and security risk indicators in advance, the system can make informed decisions about session duration. This preliminary action ensures that extended sessions are only granted to verified single-user devices, preventing security compromises while enabling productivity improvements.
3Reliability
If multi-domain data collection is implemented to assess client security, then security is improved, but device complexity increases
Solution Approach 1:
The system implements a universal client assessment mechanism that operates across multiple domains and web server systems. The same assessment logic and data collection methods are reused across different contexts, avoiding the need to build separate assessment systems for each domain. This multi-functional approach improves security assessment capability while minimizing the increase in device complexity through code reuse and standardized processes.
Data Source
AI summary
A security server device, method, non-transitory computer readable medium and security system that receives request data for a request from a client to a web server system where the request comprises a session identifier (ID) for a session between an authenticated user and the web server system. A determination is made whether the client is a single-user device based on the request data and multi-domain data. Another determinations is made on whether the client is compromised based on the request data. In response to the determinations that the client is a single-user device and is not compromised an extension of the session between the authenticated user on the client and the web server system is caused.