Apparatus and method for providing global session persistence

• US 20040044866A1
• Filed: 08/29/2002
• Published: 03/04/2004
• Est. Priority Date: 08/29/2002
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Casazza, James
• Granted Patent: US 7,386,672 B2
• Time in Patent Office: Days
• US Class Current: 711/163
• CPC Class Codes: G06F 12/0891 using clearing, invalidating or resetting means
• CPC Class Codes: G06F 12/1466 Key-lock mechanism
• CPC Class Codes: G06F 21/62 Protecting access to data via a platform, e.g. using keys or access control rules
• CPC Class Codes: G06F 21/78 to assure secure storage of data address-based protection against unauthorised use of memory G06F12/14; record carriers for use with machines and with at least a part designed to carry digital markings G06K19/00
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 67/5682 Policies or rules for updating, deleting or replacing the stored data
• CPC Class Codes: Y10S 707/99939 Privileged access

Abstract

An apparatus and method provide persistent data during a user session on a networked computer system. A global data cache is divided into three sections: trusted, protected, and unprotected. An authorization mechanism stores and retrieves authorization data from the trusted section of the global data store. A common session manager stores and retrieves data from the protected and unprotected sections of the global data cache. Using the authorization mechanism, software applications may verify that a user is authorized without prompting the user for authorization information. Using the common session manager, software applications may store and retrieve data to and from the global data store, allowing the sharing of data during a user session. After the user session terminates, the data in the global data cache corresponding to the user session is invalidated.

Claims

1. An apparatus comprising:

at least one processor;

a memory coupled to the at least one processor;

a global data cache coupled to the at least one processor; and

a common session manager that stores data in the global data cache during a user session, that provides access to the data to a plurality of software applications, and that invalidates the data in the global data cache after the user session is terminated.

2. The apparatus of claim 1 wherein the common session manager provides access to the data stored in the global data cache to a plurality of software applications during the user session.

3. The apparatus of claim 1 wherein the data stored in the global data cache comprises authorization information corresponding to the user session.

4. The apparatus of claim 1 wherein the global data cache includes a plurality of sections, each section requiring different authorization to access data stored in the corresponding section.

5. The apparatus of claim 4 wherein the plurality of sections include a trusted section, a protected section, and an unprotected section.

6. The apparatus of claim 5 wherein the trusted section includes authorization information for the user session.

7. The apparatus of claim 5 wherein the protected section includes information that may only be accessed if the user provides authorization information corresponding to the information stored in the protected section.

8. The apparatus of claim 5 wherein the unprotected section includes information that may be accessed by any user that has a valid session identifier.

9. The apparatus of claim 1 further comprising an authorization mechanism that is called by a software application to determine whether a user is authorized to access the software application.

10. The apparatus of claim 9 wherein the authorization mechanism provides single sign-on capability for all software applications that access the global data cache.

11. An apparatus comprising:

(A) at least one processor;

(B) a memory coupled to the at least one processor;

(C) a global data cache coupled to the at least one processor, the global data cache including;

(C1) a trusted section that includes authorization information for a user session;

(C2) a protected section that includes information that may be accessed only if the user is authorized to access the information stored in the protected section; and

(C3) an unprotected section that includes information that may be accessed by any user that has a valid session identifier;

(D) a common session manager that stores data in the global data cache during a user session, and that invalidates the data in the global data cache after the user session is terminated; and

(E) an authorization mechanism that is called by a software application to determine whether a user is authorized to access the software application, the authorization mechanism providing single sign-on capability for all software applications that access the global data cache.

12. The apparatus of claim 11 wherein the common session manager provides access to the data stored in the global data cache to a plurality of software applications during the user session.

38. The program product of claim 11 wherein the common session manager provides access to the data stored in the global data cache to a plurality of software applications during the user session.

13. A method for sharing data between first and second software applications during a user session, the method comprising the steps of:

a user providing data to the first software application;

the first software application storing the data in a global data cache;

the second software application accessing the data in the global data cache; and

invalidating the data in the global data cache corresponding to the user session after the user session terminates.

14. The method of claim 13 wherein the data stored in the global data cache comprises authorization information corresponding to the user session.

15. The method of claim 13 wherein the data in the global data cache comprises user authorization information that is stored in a trusted section of the global data cache.

16. The method of claim 13 wherein the data in the global data cache comprises application data that is stored in a protected section of the global data cache.

17. The method of claim 13 wherein the data in the global data cache comprises application data that is stored in an unprotected section of the global data cache.

18. The method of claim 13 further comprising the step of determining whether a user is authorized to access information stored in the global data cache.

19. The method of claim 18 further comprising the step of providing single sign-on capability for all software applications that access the global data cache.

20. A method for sharing data between first and second software applications during a user session, the method comprising the steps of:

a user providing authorization data to the first software application;

the first software application storing the authorization data in a trusted section of the global data cache, the first software application storing application data in at least one of a protected section and an unprotected section of the global data cache;

the second software application requesting verification that the user is authorized to access the second software application;

reading the authorization data from the trusted area of the global data cache;

determining from the read authorization data whether the user is authorized to access the second software application;

if the user is authorized to access the second software application, allowing the user to access the second software application;

if the user is not authorized to access the data in the global data cache, denying the user access to the second software application; and

invalidating the data in the global data cache corresponding to the user session after the user session terminates.

21. The method of claim 20 wherein the user is authorized to access the protected section of the global data cache if the user has previously supplied authorization information corresponding to the data stored in the protected section.

22. The method of claim 20 wherein the user is authorized to access the unprotected section of the global data cache if the user has a valid session identifier.

23. A program product comprising:

(A) a common session manager that stores data in a global data cache during a user session, that provides access to the data to a plurality of software applications, and that invalidates the data in the global data cache after the user session is terminated; and

(B) computer-readable signal bearing media bearing the common session manager.

24. The program product of claim 23 wherein the computer-readable signal bearing media comprises recordable media.

25. The program product of claim 23 wherein the computer-readable signal bearing media comprises transmission media.

26. The program product of claim 23 wherein the common session manager provides access to the data stored in the global data cache to a plurality of software applications during the user session.

27. The program product of claim 23 wherein the data stored in the global data cache comprises authorization information corresponding to the user session.

28. The program product of claim 23 wherein the global data cache includes a plurality of sections, each section requiring different authorization to access data stored in the corresponding section.

29. The program product of claim 28 wherein the plurality of sections include a trusted section, a protected section, and an unprotected section.

30. The program product of claim 29 wherein the trusted section includes authorization information for the user session.

31. The program product of claim 29 wherein the protected section includes information that may only be accessed if the user provides authorization information corresponding to the information stored in the protected section.

32. The program product of claim 29 wherein the unprotected section includes information that may be accessed by any user that has a valid session identifier.

33. The program product of claim 23 further comprising an authorization mechanism that is called by a software application to determine whether a user is authorized to access the software application.

34. The program product of claim 33 wherein the authorization mechanism provides single sign-on capability for all software applications that access the global data cache.

35. A program product comprising:

(A) a common session manager that stores data in the global data cache during a user session, and that invalidates the data in the global data cache after the user session is terminated, the global data cache comprising;

(A1) a trusted section that includes authorization information for a user session;

(A2) a protected section that includes information that may be accessed only if the user is authorized to access the information stored in the protected section; and

(A3) an unprotected section that includes information that may be accessed by any user that has a valid session identifier;

(B) an authorization mechanism that is called by a software application to determine whether a user is authorized to access the software application, the authorization mechanism providing single sign-on capability for all software applications that access the global data cache; and

(C) computer-readable signal bearing media bearing the common session manager and the authorization mechanism.

36. The program product of claim 35 wherein the computer-readable signal bearing media comprises recordable media.

37. The program product of claim 35 wherein the computer-readable signal bearing media comprises transmission media.