Server Client Session Extension Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing communication systems between servers and clients do not securely manage open sessions, leaving them vulnerable to unauthorized access if users forget to close them.
Innovation Solution
A method where the client transmits data to the server to control open communication sessions, with the server authenticating the client using a session extension key or associated key to authorize or terminate the session, ensuring secure continuation or closure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Duration of action of moving object
If the server keeps the communication session open indefinitely, then the session remains available for legitimate use, but the session becomes vulnerable to unauthorized access if the user forgets to close it
Solution Approach 1:
The server implements periodic authentication by sending authentication requests at predetermined time intervals during the communication session. The session is extended only if the client successfully responds with valid authentication data. This periodic verification ensures that abandoned sessions are automatically closed while maintaining availability for active users.
2Reliability
If the server automatically closes the session after a fixed time, then security is improved, but legitimate long-duration communications are disrupted
Solution Approach 1:
The session duration is made dynamic rather than fixed. The server adjusts the session lifetime based on periodic authentication results - extending the session when valid authentication data is received and closing it when authentication fails or is not provided. This allows the session to adapt to actual usage patterns, maintaining both security and legitimacy.
3Duration of action of moving object
If the user must manually close the session, then the session can remain open as long as needed, but the user burden increases and forgotten sessions remain open
Solution Approach 1:
The session management system operates autonomously without requiring user intervention. The server automatically sends authentication requests and processes responses to extend or close sessions. The client application handles authentication in the background, eliminating the need for users to manually close sessions while ensuring abandoned sessions are terminated.
4Reliability
If the server sends frequent authentication requests, then session security is enhanced, but system overhead and latency increase
Solution Approach 1:
The authentication interval is set to a predetermined optimal time period that balances security requirements with system performance. This parameter can be configured based on the specific application's security needs and performance constraints, allowing flexible adjustment between security strength and overhead without requiring frequent authentication that would cause excessive latency.
Data Source
Figure 1~2
AI summary
The invention relates to a method (20) for communicating between a server (18) and a client (14). According to the invention, the server and the client accessing at least one session extension key and/or a key associated with the session extension key, as associated key, the server authorizes to extend an open communication session with the client until an expiration time only if the client sends to the server authentication data (214) allowing the server to authenticate at least the client on a basis of the session extension key, the expiration time being a time at which the communication session is open completed by a predetermined extension time period. The invention also relates to corresponding client, server and system.