Logout From Multiple Network Sites

• US 20130198818A1
• Filed: 02/01/2012
• Published: 08/01/2013
• Est. Priority Date: 02/01/2012
• Status: Active Grant

• Current Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Original Assignee: Amazon Technologies, Inc. (Amazon.com, Inc.)
• Inventors: Hitchcock, Daniel W., Campbell, Brad Lee
• Granted Patent: US 8,863,250 B2
• Time in Patent Office: Days
• US Class Current: 726/5
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

Disclosed are various embodiments for logging out from multiple network sites using an authentication client that manages sessions for the network sites. Account data is maintained for multiple accounts of a user for multiple network sites. The account data includes a respective security credential for each of the accounts. An authentication client automatically authenticates with multiple authentication services corresponding to multiple network sites using multiple accounts in response to the user accessing each network site. A respective session is established for each network site. A logout is performed by ending each one of the sessions.

Claims

1. A non-transitory computer-readable medium embodying a program executable in a computing device, the program comprising:

code that obtains account data for a plurality of accounts of a user for a plurality of network sites from an authentication management service over a network, the account data including a respective security credential for each of the accounts;

code that automatically authenticates with a plurality of authentication services corresponding to a plurality of the network sites using a respective plurality of the accounts in response to the user accessing each one of the plurality of the network sites, wherein a respective session is established for each of the network sites;

code that determines that a logout is to be performed based at least in part on at least one of a user logout indication or an expiration of a predetermined period of user inactivity; and

code that performs the logout by ending each one of the sessions, the code that performs the logout being further configured to;

automatically send a respective logout indication to each one of the authentication services;

automatically flush data relating to the sessions in the computing device; and

automatically flush the account data from the computing device.

2. The non-transitory computer-readable medium of claim 1, wherein the data relating to the sessions includes a plurality of session cookies stored by a browser application executed in the computing device.

3. The non-transitory computer-readable medium of claim 1, wherein the program is configured to decrypt the account data using a master security credential obtained from the user.

4. A system, comprising:

a computing device; and

an authentication client executable in the computing device, the authentication client comprising;

logic that maintains account data for a plurality of accounts of a user for a plurality of network sites, the account data including a respective security credential for each of the accounts;

logic that automatically authenticates with a plurality of authentication services corresponding to a plurality of the network sites using a respective plurality of the accounts in response to the user accessing each one of the plurality of the network sites, wherein a respective session is established for each of the network sites;

logic that determines that a logout is to be performed; and

logic that performs the logout by ending each one of the sessions.

5. The system of claim 4, wherein the logic that performs the logout is configured to automatically send a respective logout indication to each one of the authentication services.

6. The system of claim 4, wherein the logic that performs the logout is configured to automatically flush data relating to the sessions in the computing device.

7. The system of claim 6, wherein the data relating to the sessions includes a plurality of session cookies.

8. The system of claim 4, wherein the user accesses each one of the plurality of the network sites by way of a browser application executed in the computing device.

9. The system of claim 4, wherein the logic that determines that the logout is to be performed is configured to obtain a single logout request from the user.

10. The system of claim 4, wherein the logic that determines that the logout is to be performed is configured to obtain a switch user request from the user.

11. The system of claim 4, wherein the logic that determines that the logout is to be performed is configured to determine whether a predetermined period of user inactivity has been met.

12. The system of claim 4, wherein the logic that determines that the logout is to be performed is configured to determine whether the user has logged out of an operating system account.

13. The system of claim 4, wherein the authentication client is configured to download the account data in an encrypted form from an authentication management service.

14. The system of claim 13, wherein the authentication client is configured to decrypt the account data using a master security credential obtained from the user.

15. A method, comprising the steps of:

obtaining, in a computing device, account data for a plurality of accounts of a user for a plurality of network sites from an authentication management service over a network, the account data including a respective security credential for each of the accounts;

automatically authenticating, in the computing device, with a plurality of authentication services corresponding to a plurality of the network sites using a respective plurality of the accounts in response to the user accessing each one of the plurality of the network sites, wherein a respective session is established for each of the network sites;

determining, in the computing device, that a logout is to be performed; and

performing, in the computing device, the logout by ending each one of the sessions.

16. The method of claim 15, further comprising the step of decrypting, in the computing device, the account data using a master security credential obtained from the user.

17. The method of claim 15, further comprising the step of decrypting, in the computing device, the account data using a master security credential stored in a computer-readable medium in the computing device.

18. The method of claim 15, wherein the performing step further comprises the step of automatically sending, in the computing device, a respective logout indication to each one of the authentication services.

19. The method of claim 15, wherein the performing step further comprises the step of automatically flushing data relating to the sessions in the computing device.

20. The method of claim 15, wherein the performing step further comprises the step of automatically flushing the account data from the computing device.