Information Terminal Session Management for Web Application Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing web application systems face challenges in establishing both an automatic update function and a session timeout mechanism, leading to potential security vulnerabilities when handling sensitive information, as automatic updates can maintain sessions even without user activity, allowing malicious third parties to hijack sessions and access security information.
Innovation Solution
Implementing a method that requests update information from the server before a session times out, displays the updated application screen, and prevents display of security information screens after a predetermined period of inactivity, ensuring session timeout and screen operation timeout functions are independent and secure.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of information
If automatic update function is implemented for web application screen, then information freshness is improved, but session security deteriorates because sessions are maintained even without user activity
Solution Approach 1:
The patent segments the session management into two independent timeout mechanisms: (1) session timeout for maintaining connection security, and (2) screen operation timeout for controlling access to security information. This segmentation allows automatic updates to occur while maintaining security boundaries, resolving the contradiction between information freshness and session security.
Solution Approach 2:
The patent applies different timeout characteristics to different functional aspects: session timeout uses a longer period to allow automatic updates, while screen operation timeout uses a shorter period to restrict access to security information. This local differentiation of timeout quality enables simultaneous achievement of information freshness and security.
2Reliability
If session timeout mechanism is implemented to enhance security, then session security is improved, but automatic update function deteriorates because sessions may be terminated during automatic updates
Solution Approach 1:
The patent divides timeout control into separate session timeout and screen operation timeout mechanisms with different time periods. The session timeout uses a longer period that accommodates automatic update cycles, preventing premature termination while maintaining security through the independent screen operation timeout mechanism.
Solution Approach 2:
The patent changes the timeout parameter values based on functional requirements: session timeout is set to a longer period to preserve connectivity for automatic updates, while screen operation timeout is set to a shorter period to enforce security restrictions. This parameter differentiation resolves the contradiction between security and automatic update functionality.
3Reliability
If screen operation timeout is implemented to prevent unauthorized access, then security information protection is improved, but user convenience deteriorates due to additional authentication requirements
Solution Approach 1:
The patent implements preliminary authentication through screen operation timeout monitoring, which proactively prevents unauthorized access before it can occur. By detecting inactivity and requiring re-authentication in advance, the system protects security information while maintaining user convenience for legitimate users who will be promptly re-authenticated after brief pauses.
Data Source
Figure 1A~1C
Figure 2
Figure 3
AI summary
A method for controlling an information terminal, including: (a) requesting a server to transmit update information for predetermined information included in an application screen before a session with the server is timed out after no request to the sever continues during a first time; (b) displaying the application screen including the update information received from the server; and (c) not displaying the application screen corresponding to an operation with respect to the application screen that leads to an application screen including security information being displayed when the operation is executed by an operator after lapse of a second time from a most recent operation with respect to the application screen by the operator.