Killing login-based sessions with a single action

• US 7,743,153 B2
• Filed: 01/18/2006
• Issued: 06/22/2010
• Est. Priority Date: 01/18/2006
• Status: Active Grant

• Current Assignee: X Corp. (f/k/a Twitter, Inc.) (X Holdings Corp.)
• Original Assignee: International Business Machines Corporation
• Inventors: Hall, Kylene J., Shieh, Johnny M.
• Primary Examiner(s): Vaughn, Jr.; William C
• Assistant Examiner(s): Gorney; Boris
• Application Number:
  US11/334,670
• Publication Number:
  US 20070169175A1
• Time in Patent Office: 1,616 Days
• Field of Search: 709/228, 709/229, 709/227, 713/164, 713/185
• US Class Current: 709/227
• CPC Class Codes: H04L 63/0807 using tickets, e.g. Kerberos cryptographic mechanisms or cryptographic arrangements for entity authentication using tickets or tokens H04L9/3213
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/142 Managing session states for stateless protocols; Signalling session states; State transitions; Keeping-state mechanisms
• CPC Class Codes: H04L 67/146 Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding

Abstract

A method, system, and program are provided for killing login-based sessions with a single action. In addition to issuing a session token to a client system upon login by a user to a network service, a personal token is issued to the client system. The personal token is executable at the client system to trigger accesses to a personal session controller and to automatically disallow the session token if the personal session controller indicates that the personal token is deactivated. The personal session controller enables an interface through which a user is enabled select to deactivate all active personal tokens with a single action, such that a user manages killing login-based sessions independent of the server system authorizing each login-based session and independent of the client system to which the login-based session was authorized.

Claims

1. A method for user-specified management of a plurality of separate login-based sessions via a network, wherein each said separate log in-based session is enabled by a separate session token issued to a separate client system from among a plurality of client systems from which a particular user logs in, wherein a separate server system from among a plurality of server systems authorizing each said separate login-based session issues each said separate session token to each separate client system from among said plurality of client systems to authorize access by said particular user to each said at least one server system, comprising:

responsive to detecting, at a personal session controller, authorization for each said separate login-based session for said particular user, separately issuing from said personal session controller a separate personal token to each said separate client system, wherein each said separate personal token comprises an executable script that when passed to each said separate client system executes on each separate client system to trigger each said separate client system to access said personal session controller via said network to request a status of said separate personal token while a date is less than an expiration date set in each said separate personal token and automatically disallows an associated separate session token at a particular client system if said personal session controller indicates said separate personal token status is deactivated or said date meets said expiration date; and

enabling, by said personal session controller, an interface providing a selectable option for said particular user to direct said personal session controller to deactivate all of said separate personal tokens with a single action, such that said particular user accesses said personal session controller to manage each said separate login-based session independent of each said server system authorizing each said separate login-based session.

2. The method according to claim 1, further comprising:

responsive to detecting, at a login controller of a particular server system from among said plurality of server systems, a login request for said particular user from a particular client system from among said plurality of client systems, detecting a network address of said personal session controller from among a plurality of personal session controllers, wherein said personal session controller is specified for said particular user in a profile for said particular user comprising a login identifier and password for logging into said login controller and said network address; and

responsive to said login controller issuing a particular session token to said particular client system to authorize a particular login-based session, notifying said personal session controller at said network address of said authorization of said particular login-based session.

3. The method according to claim 1, further comprising:

responsive to detecting a login identifier for said particular user from a particular client system from among said plurality of client systems is one from among a travel login identifier and a regular login identifier with a personal token option selected, triggering said personal session controller to issue said separate personal token to said particular client system.

4. The method according to claim 1, wherein separately issuing from said personal session controller a separate personal token to each said separate client system further comprises:

separately issuing each said separate personal token with at least one expiration rule specified from a selection of expiration settings for said particular user, wherein each said separate personal token monitors at a receiving client system whether said expiration rule is triggered and automatically disallows said associated separate token at each receiving client system if said expiration rule is triggered.

5. The method according to claim 1, wherein separately issuing from said personal session controller a separate personal token to each said separate client system further comprises:

separately issuing each said separate personal token with at least one destruction setting specified from a selection of destruction settings for said particular user, wherein responsive to a separate executable script of each said separate personal token executing on each separate client system detecting said status as deactivated, said separate executable script of said separate personal token performs said destruction settings at each separate client system comprising closing all window open in association with said associated separate session token, destroying said associated separate session token, disallowing said separate personal token, and destroying said separate personal token.

6. The method according to claim 1, wherein enabling said particular user to access said personal session controller and to select to deactivate all of said separate personal tokens with a single action, further comprises:

detecting a login request by said particular user from a particular client system from among said plurality of client systems to said personal session controller;

authorizing said particular user for login to said personal session controller; and

issuing said particular user at said particular client system a particular session token for authorizing a login-based session between said particular client system and said personal session controller and issuing a particular personal session token for enabling user specified disallowance of said particular session token.

7. The method according to claim 6, further comprising:

responsive to logging said particular user in at said particular client system, monitoring said particular client system for at least one additional session token received at said particular client system from at least one other server system; and

responsive to detecting said additional session token received at said particular client system, automatically issuing an additional personal token to said particular client system for enabling user specified disallowance of said additional session token through said personal session controller.

8. A system for user-specified management of at least one separate login-based session via a network, comprising:

a plurality of server systems each comprising at least one processor for authorizing a plurality of separate login-based sessions via a network by issuing a separate session token via said network to each client system from among a plurality of client systems from which a particular user logs in to authorize access by said particular user to each said at least one server system;

a personal session controller comprising at least one processor communicatively connected to said network, responsive to detecting authorization for each said separate login-based session for said particular user, for separately issuing from said personal session controller a separate personal token to each said separate client system, wherein each said separate personal token comprises an executable script that when passed to each said separate client system executes on each separate client system to trigger each said separate client system to access said personal session controller via said network to request a status of said separate personal token while a date is less than an expiration date set in each said separate personal token and automatically disallows an associated separate session token at a particular client system if said personal session controller indicates said separate personal token status is deactivated or said date meets said expiration date; and

said personal session controller for enabling an interface providing a selectable option for said particular user to direct said personal session controller to deactivate all of said separate personal tokens with a single action, such that said particular user accesses said personal session controller to manage each said separate login-based session independent of each said server system authorizing each said separate login-based session.

9. The system according to claim 8, further comprising:

a login controller communicatively connected to said network, wherein said login controller further comprises;

means, responsive to detecting, at a login controller of a particular server system from among said plurality of server systems, a login request for said particular user from a particular client system from among said plurality of client systems, for detecting a network address of said personal session controller from among a plurality of personal session controllers, wherein said personal session controller is specified for said particular user in a profile for said particular user comprising a login identifier and password for logging into said login controller and said network address; and

means, responsive to said login controller issuing a particular session token to said particular client system to authorize a particular login-based session, for notifying said personal session controller at said network address of said authorization of said particular login-based session.

10. The system according to claim 8, said personal session controller further comprising:

means, responsive to detecting a login identifier for said particular user from a particular client system from among said plurality of client systems is one from among a travel login identifier and a regular login identifier with a personal token option selected, for triggering issue of said separate personal token to said particular client system.

11. The system according to claim 8, said personal session controller further comprising:

means for separately issuing each said separate personal token with at least one expiration rule specified from a selection of expiration settings for said particular user, wherein each said separate personal token monitors at a receiving client system whether said expiration rule is triggered and automatically disallows said associated separate token at each receiving client system if said expiration rule is triggered.

12. The system according to claim 8, said personal session controller further comprising:

means for separately issuing each said separate personal token with at least one destruction setting specified from a selection of destruction settings for said particular user, wherein responsive to a separate executable script of each said separate personal token executing on each separate client system detecting said status as deactivated, said separate executable script of said separate personal token performs said destruction settings at each separate client system comprising closing all window open in association with said associated separate session token, destroying said associated separate session token, disallowing said separate personal token, and destroying said separate personal token.

13. The system according to claim 8, said personal session controller further comprising:

a login controller for detecting a login request by said particular user from a particular client system from among said plurality of client systems to said personal session controller, authorizing said particular user for login to said personal session controller, and issuing said particular user at said particular client system a particular session token for authorizing a login-based session between said particular client system and said personal session controller and issuing a particular personal session token for enabling user specified disallowance of said particular session token.

14. The system according to claim 13, said personal session controller further comprising:

means, responsive to logging said particular user in at said particular client system, for monitoring said particular client system for at least one additional session token received at said particular client system from at least one other server system; and

means, responsive to detecting said additional session token received at said particular client system, for automatically issuing an additional personal token to said particular client system for enabling user specified disallowance of said additional session token through said personal session controller.

15. A computer executable program product for user-specified management of at least one separate login-based session via a network, said computer executable program product embodied in a computer-readable storage medium and comprising computer-executable instructions which cause a computer to perform the steps of:

authorizing, by a plurality of server systems a plurality of separate login-based sessions via a network by issuing a separate session token via said network to each client system from among a plurality of client systems from which a particular user logs in to authorize access by said particular user to each said at least one server system;

responsive to detecting, at a personal session controller, authorization for each said separate login-based session for said particular user, separately issuing from said personal session controller a separate personal token to each said separate client system, wherein each said separate personal token comprises an executable script that when passed to each said separate client system executes on each separate client system to trigger each said separate client system to access said personal session controller via said network to request a status of said separate personal token while a date is less than an expiration date set in each said separate personal token and automatically disallows an associated separate session token at a particular client system if said personal session controller indicates said separate personal token status is deactivated or said date meets said expiration date; and

enabling an interface providing a selectable option for said particular user to direct said personal session controller to deactivate all of said separate personal tokens at said personal session controller with a single action, such that said particular user accesses said personal session controller to manage each said separate login-based session independent of each said server system authorizing each said separate login-based session.

16. The program product according to claim 15, further comprising:

responsive to detecting, at a login controller of a particular server system from among said plurality of server systems, a login request for said particular user from a particular client system from among said plurality of client systems, detecting a network address of said personal session controller from among a plurality of personal session controllers, wherein said personal session controller is specified for said particular user in a profile for said particular user comprising a login identifier and password for logging into said login controller and said network address; and

responsive to said login controller issuing a particular session token to said particular client system to authorize a particular login-based session, notifying said personal session controller at said network address of said authorization of said particular login-based session.

17. The program product according to claim 15, further comprising:

responsive to detecting a login identifier for said particular user from a particular client system from among said plurality of client systems is one from among a travel login identifier and a regular login identifier with a personal token option selected, triggering issue of said separate personal token to said particular client system.

18. The program product according to claim 15, wherein separately issuing a separate personal token to each said separate client system further comprises:

separately issuing each said separate personal token with at least one expiration rule specified from a selection of expiration settings for said particular user, wherein each said separate personal token monitors at a receiving client system whether said expiration rule is triggered and automatically disallows said associated separate token at each receiving client system if said expiration rule is triggered.

19. The program product according to claim 15, wherein separately issuing from said personal session controller a separate personal token to each said separate client system further comprises:

separately issuing each said separate personal token with at least one destruction setting specified from a selection of destruction settings for said particular user, wherein responsive to a separate executable script of each said separate personal token executing on each separate client system detecting said status as deactivated, said separate executable script of said separate personal token performs said destruction settings at each separate client system comprising closing all window open in association with said associated separate session token, destroying said associated separate session token, disallowing said separate personal token, and destroying said separate personal token.

20. The program product according to claim 15, wherein enabling said particular user to access said personal session controller and to select to deactivate all of said separate personal tokens with a single action, further comprises:

detecting a login request by said particular user from a particular client system from among said plurality of client systems to said personal session controller;

authorizing said particular user for login to said personal session controller; and

issuing said particular user at said particular client system a particular session token for authorizing a login-based session between said particular client system and said personal session controller and issuing a particular personal session token for enabling user specified disallowance of said particular session token.