Server-to-Server Session Management for Identity Policy Enforcement
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Web applications face challenges in maintaining user context and enforcing conditional access policies due to short id token refresh times, leading to security gaps and user inconvenience, as expired tokens cause loss of context and unauthorized access.
Innovation Solution
Implementing server-to-server communication between identity and resource providers to manage user sessions, allowing the resource provider to request status updates on policy compliance, thereby maintaining context and enforcing policies without relying solely on token expiration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the id token has a short lifespan to enforce policies regularly, then security is improved, but user context is lost and user experience deteriorates
Solution Approach 1:
The patent segments the authentication mechanism into two distinct tokens: an id token with short lifespan for security policy enforcement, and a session token with long lifespan for maintaining user context and state. This segmentation allows each token to serve its specific purpose without compromising the other, resolving the contradiction between security and user experience.
Solution Approach 2:
The session token acts as an intermediary that bridges the gap between short-lived id tokens and long-term user sessions. It carries user context and state information, allowing the system to maintain continuous user experience even when id tokens expire and require revalidation.
2Reliability
If the id token expires frequently to reflect policy changes, then policy enforcement is improved, but computational overhead increases
Solution Approach 1:
The patent divides the authentication and session management functions into two separate token systems. The id token handles security and policy validation with short expiration, while the session token manages user context and state with long expiration. This segmentation reduces computational overhead by avoiding frequent complete reauthentication while maintaining policy enforcement through periodic id token validation.
Solution Approach 2:
The session token is issued in advance with a long lifespan, preliminarily establishing user authentication state and context. This eliminates the need for frequent reauthentication computations, reducing overall computational overhead while policy changes are still enforced through the separate id token mechanism.
3Ease of operation
If a long-lived cookie is used to maintain user session, then user convenience is improved, but security gaps occur when policies change
Solution Approach 1:
The patent segments the session management into a long-lived session token for user convenience and a short-lived id token for security. The session token maintains user context and state without security risks, while the id token periodically validates policy compliance. This segmentation resolves the contradiction by assigning different security roles to different tokens.
Solution Approach 2:
The system implements feedback through periodic id token validation against current policies. Even though the session token remains valid for user convenience, the id token provides continuous feedback on policy compliance, allowing the system to detect and respond to policy changes while maintaining user session continuity.
Data Source
Figure 1
Figure 2A~2B
Figure 3A~3C
AI summary
Managing user sessions in a networked computing environment. A method includes, at an identity provider computer system, providing a first id token to a resource provider for an entity. The first id token has therein a first policy check interval having a value defining a period when the first id token should be revalidated. Due to expiration of the first policy check interval, a first refresh token is received from a resource provider computer system that received the first id token. As a result of receiving the first refresh token from the resource provider computer system, the identity provider computer system evaluates conditional access policy for the entity. If the identity provider computer system determines that the conditional access policy for the entity has been met, the identity provider computer system provides a new id token and a new refresh token to the resource provider computer system.