Session Manager for Application Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing application-to-application communication protocols in computing devices often cause user interface distractions by activating the destination application in the foreground, especially when multiple applications communicate rapidly, leading to user confusion and security risks due to unauthorized access.
Innovation Solution
Implementing a single sign-on (SSO) scheme using secured storage with session managers that authenticate users and manage access sessions, storing encryption keys and timeout data securely, allowing only signed applications to access and decrypt data, and terminating sessions when compliance rules are violated or access expires.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If the operating system activates the destination application in the foreground when receiving an API call, then the user can directly interact with the active application, but this causes user interface distractions and user confusion when multiple applications communicate rapidly
Solution Approach 1:
The patent extracts the user interface activation step from the application communication process. When applications communicate via API calls, the operating system no longer automatically activates the destination application in the foreground, thereby removing the source of user interface distractions while preserving the underlying communication functionality.
Solution Approach 2:
The patent introduces a session manager as an intermediary component that handles application communication sessions without requiring foreground activation. The session manager mediates between the source and destination applications, managing session state, authentication, and communication coordination in the background, thus eliminating the need for repeated user interface activations.
2Adaptability or versatility
If applications can freely access each other's data through API calls, then application-to-application communication is facilitated, but this creates security risks due to unauthorized access
Solution Approach 1:
The patent implements preliminary authentication and session establishment before applications can access each other's data. The session manager verifies authentication credentials and establishes secure session tokens in advance, ensuring that only authorized applications can communicate. This preliminary security check prevents unauthorized access while maintaining communication versatility.
Solution Approach 2:
The patent applies different access rights and security levels to different applications and data types. The session manager grants specific permissions based on application identity, data sensitivity, and session context, rather than applying uniform access control. This localized security approach enables versatile communication while protecting sensitive data from unauthorized access.
3Speed
If the operating system switches user interfaces frequently when applications communicate, then real-time communication is achieved, but this increases user confusion and reduces user experience
Solution Approach 1:
The session manager acts as a background mediator that handles all communication coordination, session state management, and data exchange between applications without requiring user interface switches. This enables high-speed real-time communication while keeping the user interface stable and confusion-free.
Solution Approach 2:
The patent segments the communication process into distinct layers: session management, data exchange, and user interface presentation. By separating these functions, the system can perform rapid communication operations in the background session layer while maintaining a stable user interface layer, thus achieving speed without user confusion.
Data Source
AI summary
Disclosed are examples of managing access sessions for a computing device. In some examples, a key is generated using a code obtained through a user interface. The key decrypts data stored in a data store of a client device. The key is decrypted using a boot time that represents a latest time the client device was booted. The key is stored in secured storage that is accessible by the at least one application based on a developer certificate.