Session-Based Execution Control for Application Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing execution control systems, such as Lotus Notes' Execution Control List and Sun Java JAAS, often prompt users repeatedly for permission to execute actions, leading to reduced security as users opt for convenience by granting persistent permissions, exposing systems to security threats.
Innovation Solution
A system that generates alerts for executable actions and allows users to temporarily authorize actions for a current application session, providing options to execute actions without adding signers to the execution control list, thereby reducing repetitive prompts and maintaining security.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If users are prompted repeatedly for permission to execute actions, then security is maintained, but user convenience deteriorates and users may grant persistent permissions
Solution Approach 1:
The patent implements dynamic authorization that adapts based on session context. The system transitions from static persistent permissions to dynamic session-based permissions, where authorization is granted temporarily for the duration of an application session and automatically revoked when the session ends. This resolves the contradiction by providing security through automatic revocation while maintaining convenience through temporary session-based access without requiring repeated user prompts.
Solution Approach 2:
The patent changes the temporal parameter of permission duration from persistent/indeterminate to session-bound/finite. By tying authorization duration to application session lifecycle (start to end), the system automatically adjusts permission scope and duration based on actual usage context. This parameter change eliminates the need for users to repeatedly decide on persistent permissions while maintaining security through automatic expiration at session end.
2Ease of operation
If users grant persistent permissions for convenience, then user convenience improves, but security deteriorates as systems become exposed to security threats
Solution Approach 1:
The patent implements periodic re-evaluation of permissions through session-based renewal. Instead of granting one-time persistent permissions, the system continuously renews authorization at each new application session. This periodic approach maintains user convenience by automatically granting permissions at session start while improving security by requiring implicit re-authorization with each session rather than permanent access.
Solution Approach 2:
The system makes permissions dynamic rather than static, tying them to application session lifecycle. Permissions are granted when the application starts and automatically revoked when it closes, creating a dynamic authorization model that adapts to usage patterns. This resolves the security-convenience contradiction by providing easy access during active use while automatically restricting access when the application is not running.
3Reliability
If temporary permissions are granted for current session only, then security is enhanced by resetting permissions after session termination, but system complexity increases
Solution Approach 1:
The patent implements self-service session management where the system automatically handles permission granting and revocation based on application session events. The execution control system monitors application lifecycle events (start, end) and automatically adjusts permissions without requiring manual user intervention or complex external management. This self-service approach enhances security through automatic session-bound permissions while minimizing system complexity by leveraging existing application event hooks.
Solution Approach 2:
The system uses feedback from application session events to automatically adjust permissions. When the application starts, the system receives feedback and grants temporary permissions; when the application ends, the system receives feedback and revokes permissions. This feedback mechanism creates an automated closed-loop system that enhances security through session-bound permissions without requiring complex manual management, as the system self-regulates based on application lifecycle feedback.
Data Source
AI summary
The present invention provides a method, system, and computer program product for limiting authorization of an executable action to an application session. A method in accordance with an embodiment of the present invention comprises: generating an alert in response to an execution of an action in an application; and allowing a user to temporarily authorize the execution of the action for a current session of the application. The authorization for the execution of the action is removed when the current session of the application ends.