Method and apparatus to implement secured, layered logout from a computer system

• US 8,549,585 B2
• Filed: 06/14/2010
• Issued: 10/01/2013
• Est. Priority Date: 06/14/2010
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Dhanakshirur, Girish, Garrabrant, Jason, Otte, Andrew, Schoonmaker, Melissa
• Primary Examiner(s): Zand, Kambiz
• Assistant Examiner(s): BAYOU, YONAS A
• Application Number:
  US12/815,177
• Publication Number:
  US 20110307941A1
• Time in Patent Office: 1,205 Days
• Field of Search: 726/4
• US Class Current: 726/4
• CPC Class Codes: H04L 63/105 Multiple levels of security

Abstract

A secure, layered logout of a user session is implemented in a web-based management tool, such as a middleware appliance. A logout strategy is provided to include a set of security levels of varying sensitivity, with each security level having a set of permissions associated therewith and that are enforced upon a timeout. Preferably, each succeeding security level in the set of security levels is reached as time increases from an idle time associated with the user session. Upon expiration of a timeout associated with a security level, the set of permissions associated with the security level are then enforced against at least one managed object while the user session continues. As each next security level is reached, the set of permissions associated with the security level are then enforced (with respect to the managed object or against one or more other managed objects), once again while the user session continues. Each of the objects preferably is managed independently of at least one other object; thus, the layered logout may enforce different permissions with respect to different managed objects while at the time maintaining the user session. If the user takes no action, eventually a timeout associated with a final security level of the set of security levels will occur, at which point the user session is finally terminated.

Claims

1. A method to provide a structured logout from a user session, comprising:

providing a logout strategy to include a set of security levels of varying sensitivity, each security level having a set of permissions associated therewith and that are enforced upon a timeout, and wherein each succeeding security level in the set of security levels is reached as time increases from an idle time associated with the user session;

upon expiration of a timeout associated with a security level, enforcing the set of permissions associated with the security level against at least one managed object while continuing the user session; and

upon expiration of a timeout associated with a final security level of the set of security levels, ending the user session.

2. The method as described in claim 1 wherein the set of permissions associated with the security level are a subset of a set of available permissions that are associated with the at least one managed object.

3. The method as described in claim 1 wherein the timeout associated with the security level has a first length that differs from a timeout associated with at least one other security level.

4. The method as described in claim 1 further including associating a first security level with a first managed object, and a second security level with a second managed object that differs from the first managed object.

5. The method as described in claim 4 wherein each of the first and second security levels have differing sets of permissions so that expiration of a timeout associated with the first security level enforces a first set of permissions against the first managed object and expiration of a timeout associated with the second security level enforces a second set of permissions against the second managed object.

6. The method as described in claim 1 further including issuing a notification upon expiration of a timeout associated with a security level.

8. The method as described in claim 1 wherein the managed object is an object that is managed during the user session independently of at least one other managed object.

7. The method as described in clam 1 further including logging in to the user session in a trusted manner.

9. Apparatus to provide a structured logout from a user session, comprising:

a processor;

computer memory holding computer program instructions that when executed by the processor perform a method comprising;

providing a logout strategy to include a set of security levels of varying sensitivity, each security level having a set of permissions associated therewith and that are enforced upon a timeout, and wherein each succeeding security level in the set of security levels is reached as time increases from an idle time associated with the user session;

upon expiration of a timeout associated with a security level, enforcing the set of permissions associated with the security level against at least one managed object while continuing the user session; and

upon expiration of a timeout associated with a final security level of the set of security levels, ending the user session.

10. The apparatus as described in claim 9 wherein the set of permissions associated with the security level are a subset of a set of available permissions that are associated with the at least one managed object.

11. The apparatus as described in claim 9 wherein the timeout associated with the security level has a first length that differs from a timeout associated with at least one other security level.

12. The apparatus as described in claim 9 further including associating a first security level with a first managed object, and a second security level with a second managed object that differs from the first managed object.

13. The apparatus as described in claim 12 wherein each of the first and second security levels have differing sets of permissions so that expiration of a timeout associated with the first security level enforces a first set of permissions against the first managed object and expiration of a timeout associated with the second security level enforces a second set of permissions against the second managed object.

14. The apparatus as described in claim 9 wherein the method further includes issuing a notification upon expiration of a timeout associated with a security level.

16. The apparatus as described in claim 9 wherein the managed object is an object that is managed during the user session independently of at least one other managed object.

15. The apparatus as described in clam 9 wherein the method further includes logging in to the user session in a trusted manner.

17. A computer program product in a non-transitory computer readable medium for use in a data processing system to provide a structured logout from a user session, the computer program product holding computer program instructions which, when executed by the data processing system, perform a method comprising:

providing a logout strategy to include a set of security levels of varying sensitivity, each security level having a set of permissions associated therewith and that are enforced upon a timeout, and wherein each succeeding security level in the set of security levels is reached as time increases from an idle time associated with the user session;

upon expiration of a timeout associated with a security level, enforcing the set of permissions associated with the security level against at least one managed object while continuing the user session; and

upon expiration of a timeout associated with a final security level of the set of security levels, ending the user session.

18. The computer program product as described in claim 17 wherein the set of permissions associated with the security level are a subset of a set of available permissions that are associated with the at least one managed object.

19. The computer program product as described in claim 17 wherein the timeout associated with the security level has a first length that differs from a timeout associated with at least one other security level.

20. The computer program product as described in claim 17 further including associating a first security level with a first managed object, and a second security level with a second managed object that differs from the first managed object.

21. The computer program product as described in claim 20 wherein each of the first and second security levels have differing sets of permissions so that expiration of a timeout associated with the first security level enforces a first set of permissions against the first managed object and expiration of a timeout associated with the second security level enforces a second set of permissions against the second managed object.

22. The computer program product as described in claim 17 wherein the method further includes issuing a notification upon expiration of a timeout associated with a security level.

23. The computer program product as described in claim 17 wherein the method further includes logging in to the user session in a trusted manner.

24. The computer program product as described in claim 17 wherein the managed object is an object that is managed during the user session independently of at least one other managed object.

25. The computer program product as described in claim 17, wherein the computer program instructions are stored in the computer readable medium in the data processing system, wherein the computer program instructions were downloaded over a network from a remote data processing system.

26. The computer program product as described in claim 17, wherein the computer program instructions are stored in the computer readable medium in the data processing system, wherein the computer program instructions are downloaded over a network to a remote data processing system for use in a computer readable medium with the remote system.