Killing login-based sessions with a single action

• US 20070169175A1
• Filed: 01/18/2006
• Published: 07/19/2007
• Est. Priority Date: 01/18/2006
• Status: Active Grant

• Current Assignee: X Corp. (f/k/a Twitter, Inc.) (X Holdings Corp.)
• Original Assignee: International Business Machines Corporation
• Inventors: Shieh, Johnny, Hall, Kylene
• Granted Patent: US 7,743,153 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/142 Managing session states for stateless protocols; Signalling session states; State transitions; Keeping-state mechanisms
• CPC Class Codes: H04L 67/146 Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding

Abstract

A method, system, and program are provided for killing login-based sessions with a single action. In addition to issuing a session token to a client system upon login by a user to a network service, a personal token is issued to the client system. The personal token is executable at the client system to trigger accesses to a personal session controller and to automatically disallow the session token if the personal session controller indicates that the personal token is deactivated. The personal session controller enables an interface through which a user is enabled select to deactivate all active personal tokens with a single action, such that a user manages killing login-based sessions independent of the server system authorizing each login-based session and independent of the client system to which the login-based session was authorized.

Claims

1. A method for user-specified management of at least one separate login-based session via a network, wherein each said separate login-based session is enabled by a separate session token issued to a separate client system from among a plurality of client systems from which a particular user logs in, wherein at least one server system authorizing each said separate login-based session issues each said separate session token, comprising;

responsive to detecting, at a personal session controller, authorization for each said separate login-based session, separately issuing from said personal session controller a separate personal token to each said separate client system, wherein each said separate personal token triggers access to said personal session controller via said network to request a status of said separate personal token and automatically disallows an associated separate session token if said personal session controller indicates said separate personal token status is deactivated; and

enabling, by said personal session controller, an interface providing a selectable option for said particular user to deactivate all of said separate personal tokens with a single action, such that said particular user accesses said personal session controller to manage each said separate login-based session independent of each said server system authorizing each said separate login-based session.

2. The method according to claim 1, further comprising:

responsive to detecting, at a login controller, a login request for said particular user from a particular client system from among said plurality of client systems, detecting a network address of said personal session controller from among a plurality of personal session controllers, wherein said personal session controller is specified for said particular user; and

responsive to said login controller issuing a particular session token to said particular client system to authorize a particular login-based session, triggering said particular session controller with said authorization of said particular login-based session.

3. The method according to claim 1, further comprising:

responsive to detecting a login identifier for said particular user from a particular client system from among said plurality of client systems is one from among a travel login identifier and a regular login identifier with a personal token option selected, triggering said personal session controller to issue said separate personal token to said particular client system.

4. The method according to claim 1, wherein separately issuing from said personal session controller a separate personal token to each said separate client system further comprises:

separately issuing each said separate personal token with at least one expiration rule specified from a selection of expiration settings for said particular user, wherein each said separate personal token monitors at a receiving client system whether said expiration rule is triggered and automatically disallows said associated separate token at each receiving client system if said expiration rule is triggered.

5. The method according to claim 1, wherein separately issuing from said personal session controller a separate personal token to each said separate client system further comprises:

separately issuing each said separate personal token with at least one destruction setting specified from a selection of destruction settings for said particular user, wherein responsive to said each said separate personal token detecting said status as deactivated, said separate personal token performs said destruction settings comprising at least one from among closing all window open in association with said associated separate session token, destroying said associated separate session token, disallowing said separate personal token, and destroying said separate personal token.

6. The method according to claim 1, wherein enabling said particular user to access said personal session controller and to select to deactivate all of said separate personal tokens with a single action, further comprises:

detecting a login request by said particular user from a particular client system from among said plurality of client systems to said personal session controller;

authorizing said particular user for login to said personal session controller; and

issuing said particular user at said particular client system a particular session token for authorizing a login-based session between said particular client system and said personal session controller and issuing a particular personal session token for enabling user specified disallowance of said particular session token.

7. The method according to claim 6, further comprising:

responsive to logging said particular user in at said particular client system, monitoring said particular client system for at least one additional session token received at said particular client system from at least one other server system; and

responsive to detecting said additional session token received at said particular client system, automatically issuing an additional personal token to said particular client system for enabling user specified disallowance of said additional session token through said personal session controller.

8. A system for user-specified management of at least one separate login-based session via a network, wherein each said separate login-based session is enabled by a separate session token issued to a separate client system from among a plurality of client systems from which a particular user logs in, wherein at least one server system authorizing each said separate login-based session issues each said separate session token, comprising;

a personal session controller communicatively connected to said network, wherein said personal session controller further comprises;

means, responsive to detecting authorization for each said separate login-based session, for separately issuing from said personal session controller a separate personal token to each said separate client system, wherein each said separate personal token triggers access to said personal session controller via said network to request a status of said separate personal token and automatically disallows an associated separate session token if said personal session controller indicates said separate personal token status is deactivated; and

means for enabling an interface providing a selectable option for said particular user to deactivate all of said separate personal tokens with a single action, such that said particular user accesses said personal session controller to manage each said separate login-based session independent of each said server system authorizing each said separate login-based session.

9. The system according to claim 8, further comprising:

a login controller communicatively connected to said network, wherein said login controller further comprises;

means, responsive to detecting a login request for said particular user from a particular client system from among said plurality of client systems, for detecting a network address of said personal session controller from among a plurality of personal session controllers, wherein said personal session controller is specified for said particular user; and

means, responsive to said login controller issuing a particular session token to said particular client system to authorize a particular login-based session, for triggering said session controller with said authorization of said particular login-based session.

10. The system according to claim 8, said personal session controller further comprising:

means, responsive to detecting a login identifier for said particular user from a particular client system from among said plurality of client systems is one from among a travel login identifier and a regular login identifier with a personal token option selected, triggering issue of said separate personal token to said particular client system.

11. The system according to claim 8, wherein said means for separately issuing a separate personal token to each said separate client system further comprises:

means for separately issuing each said separate personal token with at least one expiration rule specified from a selection of expiration settings for said particular user, wherein each said separate personal token monitors at a receiving client system whether said expiration rule is triggered and automatically disallows said associated separate token at each receiving client system if said expiration rule is triggered.

12. The system according to claim 8, wherein said means for separately issuing a separate personal token to each said separate client system further comprises:

means for separately issuing each said separate personal token with at least one destruction setting specified from a selection of destruction settings for said particular user, wherein responsive to said each said separate personal token detecting said status as deactivated, said separate personal token performs said destruction settings comprising at least one from among closing all window open in association with said associated separate session token, destroying said associated separate session token, disallowing said separate personal token, and destroying said separate personal token.

13. The system according to claim 8, wherein said means for enabling said particular user to access said personal session controller and to select to deactivate all of said separate personal tokens with a single action, further comprises:

a login controller for detecting a login request by said particular user from a particular client system from among said plurality of client systems to said personal session controller, authorizing said particular user for login to said personal session controller, and issuing said particular user at said particular client system a particular session token for authorizing a login-based session between said particular client system and said personal session controller and issuing a particular personal session token for enabling user specified disallowance of said particular session token.

14. The system according to claim 13, said personal session controller further comprising:

means, responsive to logging said particular user in at said particular client system, for monitoring said particular client system for at least one additional session token received at said particular client system from at least one other server system; and

means, responsive to detecting said additional session token received at said particular client system, for automatically issuing an additional personal token to said particular client system for enabling user specified disallowance of said additional session token through said personal session controller.

15. A program for user-specified management of at least one separate login-based session via a network, said program embodied in a computer-readable medium, said program comprising computer-executable instructions which cause a computer to perform the steps of:

responsive to detecting authorization for each said separate login-based session from at least one server system each issuing a separate session token to a separate client system from among a plurality of client systems from which a particular user logs in, separately issuing a separate personal token to each said separate client system, wherein each said separate personal token triggers access to a personal session controller via said network to request a status of said separate personal token and automatically disallows an associated separate session token if said personal session controller indicates said separate personal token status is deactivated; and

enabling an interface providing a selectable option for said particular user to deactivate all of said separate personal tokens at said personal session controller with a single action.

16. The program according to claim 15, further comprising:

responsive to detecting a login request for said particular user from a particular client system from among said plurality of client systems, detecting a network address of said personal session controller from among a plurality of personal session controllers, wherein said personal session controller is specified for said particular user; and

responsive to issuing a particular session token to said particular client system to authorize a particular login-based session, triggering issue of said separate personal token to said particular client system.

17. The program according to claim 15, further comprising:

responsive to detecting a login identifier for said particular user from a particular client system from among said plurality of client systems is one from among a travel login identifier and a regular login identifier with a personal token option selected, triggering issue of said separate personal token to said particular client system.

18. The program according to claim 15, wherein separately issuing a separate personal token to each said separate client system further comprises:

separately issuing each said separate personal token with at least one expiration rule specified from a selection of expiration settings for said particular user, wherein each said separate personal token monitors at a receiving client system whether said expiration rule is triggered and automatically disallows said associated separate token at each receiving client system if said expiration rule is triggered.

19. The program according to claim 15, wherein separately issuing from said personal session controller a separate personal token to each said separate client system further comprises:

separately issuing each said separate personal token with at least one destruction setting specified from a selection of destruction settings for said particular user, wherein responsive to said each said separate personal token detecting said status as deactivated, said separate personal token performs said destruction settings comprising at least one from among closing all window open in association with said associated separate session token, destroying said associated separate session token, disallowing said separate personal token, and destroying said separate personal token.

20. The program according to claim 15, wherein enabling said particular user to access said personal session controller and to select to deactivate all of said separate personal tokens with a single action, further comprises:

detecting a login request by said particular user from a particular client system from among said plurality of client systems to said personal session controller;

authorizing said particular user for login to said personal session controller; and

issuing said particular user at said particular client system a particular session token for authorizing a login-based session between said particular client system and said personal session controller and issuing a particular personal session token for enabling user specified disallowance of said particular session token.