Session Idle Timeout Control Based on Login Trust Attributes
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing session management systems fail to dynamically adjust idle time based on user login attributes, leaving accounts vulnerable to malicious actors when users forget to log out on public devices.
Innovation Solution
Implement a system that adjusts session idle time based on user login attributes such as device type, location, and trustworthiness, using a modified session cookie to terminate sessions prematurely on untrusted devices and extend idle time on trusted devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a static session length is used, then the system is simple to manage, but security is compromised because malicious actors can take over sessions after users leave public devices
Solution Approach 1:
The patent implements dynamic session timeout values that automatically adjust based on device characteristics. The system determines whether a device is public or private and sets session timeout accordingly - shorter timeouts for public devices and longer timeouts for private devices. This dynamic adjustment resolves the contradiction by making session management adaptive rather than static, improving security on public devices without unnecessarily complicating private device management.
Solution Approach 2:
The system changes the session timeout parameter based on device type detection. By detecting whether the device is public or private and adjusting the session timeout parameter accordingly, the system resolves the contradiction between security and complexity. The parameter change is automatic and rule-based, maintaining simplicity while improving security.
2Reliability
If step-up authentication is implemented, then some security threats are mitigated, but not all interactions are covered leaving gaps in protection
Solution Approach 1:
The system performs preliminary action by detecting device type and setting appropriate session timeout values before any potentially harmful interactions occur. This preventive measure ensures that even if users forget to log out or leave devices unattended, the session will automatically terminate after the appropriate timeout period, providing continuous security coverage without requiring user awareness or additional authentication steps.
Solution Approach 2:
The session timeout mechanism acts as an intermediary security layer that operates independently of user authentication. Rather than relying solely on user-initiated step-up authentication, the system introduces an automatic timeout intermediary that provides continuous protection across all interactions, filling the gaps left by user-dependent authentication methods.
3Ease of operation
If session timeout is extended for convenience, then user experience improves, but vulnerability window increases allowing more time for malicious takeover
Solution Approach 1:
The system applies local quality by differentiating session timeout settings based on device location/type. Public devices receive shorter timeout values to minimize vulnerability windows, while private devices receive longer timeout values to ensure session continuity. This localized approach resolves the contradiction by tailoring session duration to the specific risk context of each device type.
Data Source
AI summary
Systems and methods for session time duration management based on user login attributes are disclosed. A method may include: receiving, at an authentication platform for a website and from a browser executed by an electronic device, a user login; authenticating the user login credentials; requesting a session with the browser with a modified session idle time from a session provider, wherein the session provider is configured to generate a session cookie with the modified session idle time; receiving the session cookie from the session provider; and communicating the session cookie to the browser. The website may be configured to receive an interaction from the browser in the session, determine a current session idle time for the session, compare the current session idle time to the modified session idle time, and terminate the session in response to the current session idle time being greater than the modified session idle time.