Method and apparatus for session management and user authentication

• US 6,223,289 B1
• Filed: 04/20/1998
• Issued: 04/24/2001
• Est. Priority Date: 04/20/1998
• Status: Expired due to Term

• Current Assignee: Oracle America, Inc. (Oracle Corporation)
• Original Assignee: Sun Microsystems Incorporated (Oracle Corporation)
• Inventors: Hanko, James G., Northcutt, J. Duane, Ruberg, Alan T., Butcher, Lawrence L., Wall, Gerard A.
• Primary Examiner(s): Black, Thomas G.
• Assistant Examiner(s): CHEUNG, MARY DA ZHI WANG
• Application Number:
  US09/063,339
• Time in Patent Office: 1,100 Days
• Field of Search: 713/201, 713/200, 709/200, 709/201, 709/203, 709/217, 709/218, 709/219, 709/220, 709/221, 709/222, 709/223, 709/227, 709/228, 709/229
• US Class Current: 726/16
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231

Abstract

Authentication and session management can be used with a system architecture that partitions functionality between a human interface device (HID) and a computational service provider such as a server. An authentication manager executing on a server interacts with the HID to validate the user when the user connects to the system via the HID. A session manager executing on a server manages services running on computers providing computational services on behalf of the user. The session manager notifies each service in a session that the user is attached to the system using a given HID. A service can direct display output to the HID while the user is attached to the system. When a user detaches from the system, each of the service'"'"'s executing for the user is notified via the authentication manager and the session manager. Upon notification that the user is detached from the system, a service can continue to execute while stopping its display to the HID.

Claims

1. In a computer system, a method of sessions comprising:

initiating a persistent session on behalf of a user;

maintaining information for said persistent session associated with said user;

initiating at least one service in said persistent session, said at least one service capable of execution while said user is connected, disconnected, and reconnected to said persistent session;

notifying said at least one service when said user connects to a human interface device of said computer system, when said user disconnects from said human interface device, and when said user reconnects to said human interface device;

said at least one service directing its output to said human interface device while said user is connected to said human interface device.

2. The method of claim 1 wherein said information maintained for said persistent session comprises an identification of said at least one service associated with said persistent session.

3. The method of claim 2 wherein said information maintained for said persistent session identifies whether said at least one service is active and whether said at least one service is a required service of said persistent session.

4. The method of claim 3 wherein said at least one service is initiated upon user connection to said system when said at least one service is a required service.

5. The method of claim 1 wherein said information maintained for said persistent session comprises a user identification and authentication information.

6. The method of claim 1 further comprising:

said at least one service discontinuing the transmission of output to said human interface device when said user disconnects from said human interface device, continuing to execute said service while said user is disconnected from said system.

7. The method of claim 1 further comprising:

authenticating said user using said persistent session information.

8. A system comprising:

a persistent session for a user;

a service executable in said computer system;

a network terminal capable of receiving output from and transmitting input to said service;

a session manager configured to notify said service when said user is connected to said network terminal, when said user is disconnected from said network terminal, and when said user is reconnected to said session via said network terminal;

said service configured to send output to said network terminal when said user is connected to said network terminal, and when said user is disconnected from said network terminal, said service configured discontinue sending output to said network terminal during execution, while continuing to operate on behalf of said user.

9. The system of claim 8 further comprising:

an authentication manager configured to validate said user of said network terminal at the initiation of a persistent user session.

10. The system of claim 9 wherein said authentication manager is configured to notify said session manager when a valid user reconnects to said network terminal.

11. The system of claim 8 wherein said session manager is configured to send an inquiry to said network terminal to determine whether said user is connected to said network terminal.

12. The system of claim 8 further comprising:

said persistent session associated with said user, said persistent session comprising said service.

13. The system of claim 8 further comprising:

at least one persistent session associated with said user wherein each persistent session comprises a plurality of services.

14. A computer program product comprising:

a computer usable medium having computer readable program code embodied therein for session management and user authentication comprising;

computer readable program code configured to cause a computer to authenticate a user to a computer system using one-way authentication;

computer readable program code configured to cause a computer to initiate a persistent session for said user;

computer readable program code configured to cause a computer to maintain information for said persistent session associated with a user;

computer readable program code configured to cause a computer to initiate at least one service in said persistent session, said at least one service capable of execution while said user is disconnected from said persistent session;

computer readable program code configured to cause a computer to notify said at least one service when said user connects to a human interface device of said computer system and when said user disconnects from said human interface device;

computer readable program code configured to cause a computer to direct output of said service to said human interface device while said user is connected to said human interface device.

15. The computer program product of claim 14 wherein said information maintained for said persistent session comprises an identification of said at least one service associated with said persistent session.

16. The computer program product of claim 15 wherein said information maintained for said persistent session identifies whether said at least one service is active and whether said at least one service is a required service of said persistent session.

17. The computer program product of claim 16 wherein said at least one service is initiated upon user connection to said system when said at least one service is a required service.

18. The computer program product of claim 14 wherein said information maintained for said persistent session comprises a user identification and authentication information.

19. The computer program product of claim 14 further comprising:

computer readable program code configured to cause said at least one service to discontinue the transmission of output to said human interface device when said user disconnects from said human interface device, continuing said service while said user is unattached from said system.

20. The computer program product of claim 14 further comprising:

computer readable program code configured to cause a computer to authenticate said user using said persistent session information.