MODIFYING A USER SESSION LIFECYCLE IN A CLOUD BROKER ENVIRONMENT

• US 20170339176A1
• Filed: 05/23/2016
• Published: 11/23/2017
• Est. Priority Date: 05/23/2016
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Backer, Shahnawaz, Hockings, Christopher J., Pranam, Codur S., Satyanarayana, Rohit U.
• Granted Patent: US 10,291,636 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/143 Termination or inactivation of sessions, e.g. event-controlled end of session
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34

Abstract

A method for modifying a user session lifecycle is provided. The method may include verifying a user session on a cloud service provider is valid. The method may also include monitoring a plurality of user behaviors exhibited during the verified user session. The method may further include determining a plurality of session data within an identity provider should be updated based on the monitored plurality of user behaviors and a policy within a database. The method may also include modifying the determined plurality of session data.

Claims

1. A processor-implemented method for modifying a user session lifecycle, the method comprising:

verifying, by a processor, a user session on a cloud service provider is valid;

monitoring a plurality of user behaviors exhibited during the verified user session;

determining a plurality of session data within an identity provider should be updated based on the monitored plurality of user behaviors and a policy within a database; and

modifying the determined plurality of session data.

2. The method of claim 1, wherein the plurality of user behaviors is selected from a group consisting of a plurality of personal identifiable information, a plurality of user activity data, a plurality of operational data detailing a plurality of operations performed by a user, a resource being accessed by the user, a plurality of user anomaly data, a device geographic location, and a device management status.

3. The method of claim 1, wherein determining the plurality of session data within the identity provider should be updated further comprises:

analyzing the monitored plurality of user behaviors; and

determining the cloud service provider has an associated risk level for a plurality of malware or a plurality of third party attacks below a preconfigured threshold based on the analyzed plurality of user behaviors.

4. The method of claim 1, wherein monitoring the plurality of user behaviors utilizes a reputation service and a threat alert system.

5. The method of claim 1, wherein the determined plurality of session data is selected from a group consisting of a user inactivity timeout policy and a user session limit timeout policy.

6. The method of claim 1, wherein modifying the determined plurality of session data is selected from a group consisting of extending the verified user session and terminating the verified user session.

7. The method of claim 1, wherein modifying the determined plurality of session data further comprises:

transmitting a notification to the identity provider detailing a plurality of modification information to update the determined plurality of session data, wherein the plurality of modification information is selected from a group consisting of a session termination, a session lifetime extension, and a session re-authorization; and

modifying, by the identity provider, the determined plurality of session data based the transmitted notification.

8. A computer system for modifying a user session lifecycle, the computer system comprising:

one or more processors, one or more computer-readable memories, one or more computer-readable tangible storage medium, and program instructions stored on at least one of the one or more tangible storage medium for execution by at least one of the one or more processors via at least one of the one or more memories, wherein the computer system is capable of performing a method comprising;

verifying a user session on a cloud service provider is valid;

monitoring a plurality of user behaviors exhibited during the verified user session;

determining a plurality of session data within an identity provider should be updated based on the monitored plurality of user behaviors and a policy within a database; and

modifying the determined plurality of session data.

9. The computer system of claim 8, wherein the plurality of user behaviors is selected from a group consisting of a plurality of personal identifiable information, a plurality of user activity data, a plurality of operational data detailing a plurality of operations performed by a user, a resource being accessed by the user, a plurality of user anomaly data, a device geographic location, and a device management status.

10. The computer system of claim 8, wherein determining the plurality of session data within the identity provider should be updated further comprises:

analyzing the monitored plurality of user behaviors; and

determining the cloud service provider has an associated risk level for a plurality of malware or a plurality of third party attacks below a preconfigured threshold based on the analyzed plurality of user behaviors.

11. The computer system of claim 8, wherein monitoring the plurality of user behaviors utilizes a reputation service and a threat alert system.

12. The computer system of claim 8, wherein the determined plurality of session data is selected from a group consisting of a user inactivity timeout policy and a user session limit timeout policy.

13. The computer system of claim 8, wherein modifying the determined plurality of session data is selected from a group consisting of extending the verified user session and terminating the verified user session.

14. The computer system of claim 8, wherein modifying the determined plurality of session data further comprises:

transmitting a notification to the identity provider detailing a plurality of modification information to update the determined plurality of session data, wherein the plurality of modification information is selected from a group consisting of a session termination, a session lifetime extension, or a session re-authorization; and

modifying, by the identity provider, the determined plurality of session data based the transmitted notification.

15. A computer program product for modifying a user session lifecycle, the computer program product comprising:

one or more computer-readable tangible storage medium and program instructions stored on at least one of the one or more tangible storage medium, the program instructions executable by a processor, the program instructions comprising;

program instructions to verify a user session on a cloud service provider is valid;

program instructions to monitor a plurality of user behaviors exhibited during the verified user session;

program instructions to determine a plurality of session data within an identity provider should be updated based on the monitored plurality of user behaviors and a policy within a database; and

program instructions to modify the determined plurality of session data.

16. The computer program product of claim 15, wherein the plurality of user behaviors is selected from a group consisting of a plurality of personal identifiable information, a plurality of user activity data, a plurality of operational data detailing a plurality of operations performed by a user, a resource being accessed by the user, a plurality of user anomaly data, a device geographic location, and a device management status.

17. The computer program product of claim 15, wherein determining the plurality of session data within the identity provider should be updated further comprises:

program instructions to analyze the monitored plurality of user behaviors; and

program instructions to determine the cloud service provider has an associated risk level for a plurality of malware or a plurality of third party attacks below a preconfigured threshold based on the analyzed plurality of user behaviors.

18. The computer program product of claim 15, wherein monitoring the plurality of user behaviors utilizes a reputation service and a threat alert system.

19. The computer program product of claim 15, wherein the determined plurality of session data is selected from a group consisting of a user inactivity timeout policy and a user session limit timeout policy.

20. The computer program product of claim 15, wherein modifying the determined plurality of session data is selected from a group consisting of extending the verified user session and terminating the verified user session.