HIERARCHICAL CRITERIA-BASED TIMEOUT PROTOCOLS

• US 20140047113A1
• Filed: 08/09/2012
• Published: 02/13/2014
• Est. Priority Date: 08/09/2012
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: Koottayi, Vipin, SUBRAMANYA, RAMYA, Balakrishnan, Aarathi
• Granted Patent: US 9,596,328 B2
• Time in Patent Office: Days
• US Class Current: 709/225
• CPC Class Codes: H04L 69/28 Timers or timing mechanisms used in protocols

Abstract

A method of applying a timeout protocol by an access manager to a plurality of resources may include storing the timeout protocol comprising at least one criterion, and receiving a request for a first resource. Each of the resources can be segregated into separate application domains, the first resource can be associated with a first attribute, and the first attribute can be assigned a first value. The method may also include determining that the first value satisfies the at least one criterion, associating the timeout protocol with the first resource, and associating the timeout protocol with each resource that is associated with the first attribute assigned a value that satisfies the at least one criterion. The method may further include granting access to the first resource according to the timeout protocol.

Claims

1. A method of applying a timeout protocol by an access manager to a plurality of resources that are spread across a plurality of separate application domains, the method comprising:

storing the timeout protocol, wherein the timeout protocol comprises at least one criterion;

receiving a request for a first resource in the plurality of resources, wherein;

each of the plurality of resources is segregated into at least one of the plurality of separate application domains;

the first resource is associated with a first attribute; and

the first attribute is assigned a first value;

determining that the first value satisfies the at least one criterion;

associating the timeout protocol with the first resource;

associating the timeout protocol with each resource in the plurality of resources that;

is associated with the first attribute, and

has the first attribute is assigned a value that satisfies the at least one criterion; and

granting access to the first resource according to the timeout protocol.

2. The method of claim 1, wherein the timeout protocol comprises:

a session length;

an idle timeout; and

a number of sessions per user.

3. The method of claim 1, wherein the first attribute comprises a security attribute that is used only with timeout protocols.

4. The method of claim 3, wherein the security attribute can be assigned values comprising:

high, medium, and low.

5. The method of claim 1, further comprising:

storing a global timeout protocol;

receiving a second request for a second resource in the plurality of resources that is associated with the first attribute, wherein the first attribute is assigned a second value;

determining that the second value does not satisfy the at least one criterion; and

granting access to the second resource according to the global timeout protocol.

6. The method of claim 1, further comprising:

storing an authentication policy, wherein the authentication policy comprises a policy timeout protocol;

receiving a second request for a second resource in the plurality of resources that is associated with the first attribute, wherein the first attribute is assigned a second value;

determining that the second value does not satisfy the at least one criterion;

determining that the second resource is associated with the authentication policy; and

granting access to the second resource according to the policy timeout protocol.

7. The method of claim 6, wherein the authentication policy is applied to an entire application domain that comprises the first resource.

8. The method of claim 1, wherein the first attribute is:

user-defined, and

not associated with all of the plurality of resources.

9. A computer-readable memory having stored thereon a sequence of instructions which, when executed by one or more processors, causes the one or more processors to apply a timeout protocol by an access manager to a plurality of resources that are spread across a plurality of separate application domains by:

storing the timeout protocol, wherein the timeout protocol comprises at least one criterion;

receiving a request for a first resource in the plurality of resources, wherein;

each of the plurality of resources is segregated into at least one of the plurality of separate application domains;

the first resource is associated with a first attribute; and

the first attribute is assigned a first value;

determining that the first value satisfies the at least one criterion;

associating the timeout protocol with the first resource;

associating the timeout protocol with each resource in the plurality of resources that;

is associated with the first attribute, and

has the first attribute is assigned a value that satisfies the at least one criterion; and

granting access to the first resource according to the timeout protocol.

10. The computer-readable memory according to claim 9, wherein the timeout protocol comprises:

a session length;

an idle timeout; and

a number of sessions per user.

11. The computer-readable memory according to claim 9, wherein the first attribute comprises a security attribute that is used only with timeout protocols.

12. The computer-readable memory according to claim 9, wherein the security attribute can be assigned values comprising:

high, medium, and low.

13. The computer-readable memory according to claim 9, wherein the instructions further cause the one or more processors to apply a timeout protocol by an access manager to a plurality of resources that are spread across a plurality of separate application domains by:

storing a global timeout protocol;

receiving a second request for a second resource in the plurality of resources that is associated with the first attribute, wherein the first attribute is assigned a second value;

determining that the second value does not satisfy the at least one criterion; and

granting access to the second resource according to the global timeout protocol.

14. The computer-readable memory according to claim 9, wherein the instructions further cause the one or more processors to apply a timeout protocol by an access manager to a plurality of resources that are spread across a plurality of separate application domains by:

storing an authentication policy, wherein the authentication policy comprises a policy timeout protocol;

receiving a second request for a second resource in the plurality of resources that is associated with the first attribute, wherein the first attribute is assigned a second value;

determining that the second value does not satisfy the at least one criterion;

determining that the second resource is associated with the authentication policy; and

granting access to the second resource according to the policy timeout protocol.

15. The computer-readable memory according to claim 9, wherein the authentication policy is applied to an entire application domain that comprises the first resource.

16. The computer-readable memory according to claim 9, wherein the first attribute is:

user-defined, and

not associated with all of the plurality of resources.

17. A system comprising:

one or more processors; and

a memory communicatively coupled with and readable by the one or more processors and having stored therein a sequence of instructions which, when executed by the one or more processors, cause the one or more processors to apply a timeout protocol by an access manager to a plurality of resources that are spread across a plurality of separate application domains by;

storing the timeout protocol, wherein the timeout protocol comprises at least one criterion;

receiving a request for a first resource in the plurality of resources, wherein;

each of the plurality of resources is segregated into at least one of the plurality of separate application domains;

the first resource is associated with a first attribute; and

the first attribute is assigned a first value;

determining that the first value satisfies the at least one criterion;

associating the timeout protocol with the first resource;

associating the timeout protocol with each resource in the plurality of resources that;

is associated with the first attribute, and

has the first attribute is assigned a value that satisfies the at least one criterion; and

granting access to the first resource according to the timeout protocol.

18. The system of claim 17 wherein the instructions further cause the one or more processors to apply a timeout protocol by an access manager to a plurality of resources that are spread across a plurality of separate application domains by:

storing an authentication policy, wherein the authentication policy comprises a policy timeout protocol;

receiving a second request for a second resource in the plurality of resources that is associated with the first attribute, wherein the first attribute is assigned a second value;

determining that the second value does not satisfy the at least one criterion;

determining that the second resource is associated with the authentication policy; and

granting access to the second resource according to the policy timeout protocol.

19. The system of claim 17 wherein the timeout protocol comprises:

a session length;

an idle timeout; and

a number of sessions per user.

20. The system of claim 17 wherein the first attribute comprises a security attribute that is used only with timeout protocols.