System and method for single sign-on session management without central server

• US 9,185,105 B2
• Filed: 05/04/2011
• Issued: 11/10/2015
• Est. Priority Date: 02/19/2002
• Status: Active Grant

• Current Assignee: JP Morgan Chase Bank, N.A. (JP Morgan Chase & Co)
• Original Assignee: JP Morgan Chase Bank, N.A. (JP Morgan Chase & Co)
• Inventors: Miller, Lawrence R., Skingle, Bruce J.
• Primary Examiner(s): Zeender, Ryan
• Assistant Examiner(s): Racic, Milena
• Application Number:
  US13/100,387
• Publication Number:
  US 20110209210A1
• Time in Patent Office: 1,651 Days
• Field of Search: 726/5, 726/17, 726/18, 709/203, 709/225, 709/227, 709/229
• US Class Current: 1/1
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 65/1101 Session protocols

Abstract

A method and system for single sign-on session management. Functions of session management and client log-in, normally handled by separate system servers, are incorporated as plug-in modules on individual web content servers. In this manner, network traffic to grant and validate client user credentials is reduced or minimized.

Claims

1. A computer-implemented method for single sign-on session management, the method comprising:

receiving by a first plug-in module residing on a first processor controlled web server, a request to grant a client browser access to a protected resource accessible from the first processor controlled web server, the request comprising a session credential associated with a decryption key, the session credential including at least a session start timestamp and a maximum session idle time for a session initiated prior to the request and in response to authentication of the customer browser at a second plug-in module of another web server for access to another of the protected resources;

decrypting the session credential using the decryption key and checking for validity of the session credential with the first plug-in module;

granting the request if the session credential is validated and updating a time value of the session credential; and

when the session credential is not validated, establishing a new session credential at the plug-in module located on the first processor controlled web server,

wherein each of the first plug-in module and the second plug-in module are configured to establish and validate session credentials independently without redirecting the customer browser to a central sign-on server.

2. The method according to claim 1, wherein the session credential is contained within a token transferrable between servers.

3. The method according to claim 2, wherein the token is a cryptographically generated cookie.

4. The method according to claim 2, wherein the token is held by the client browser.

5. The method according to claim 1, wherein the validation of the session credential occurs entirely within the processor-controlled web server and comprises decrypting a cryptographically generated cookie.

6. A computer-implemented system for single sign-on session management, the system comprising:

multiple protected web resources;

at least a first and a second plug-in modules residing between the multiple protected web resources and a client browser, each of the first and the second plug-in modules residing on a corresponding first and second processor controlled servers, and the first and the second plug-in modules further configured to;

receive, at the first plug-in module residing on the first processor controlled server, a first request to grant the client browser access to a first protected resource;

receive, at the first plug-in module, credentials of the client browser;

determine, at the first plug-in module, whether the client browser is authenticated and authorized;

grant the first request and initiate creation of session credentials if the client browser is authenticated and authorized at the first plug-in module;

provide the client browser with a cryptographically generated cookie including the session credentials;

receive, at the second plug-in module residing on the second processor controlled server, a second request from the client browser for a second resource from the multiple protected resources, the second request including the cryptographically generated cookie;

decrypt the cryptographically generated cookie using a key and checking for validity of the cookie;

grant access to the second resource if the cookie is valid and update a time value of the session credential to be included in a new cryptographically generated cookie for the client browser; and

log the client browser in via the second plug-in module if the cookie is not valid,

wherein each of the first plug-in module and the second plug-in module are configured to create and validate session credentials independently without redirecting the customer browser to a central sign-on server.

7. The system according to claim 6, wherein each of the first and the second plug-in modules includes a log-in plug-in module and a session management plug-in module.

8. The system according to claim 7, wherein each of the plug in modules validates the session credential entirely within the server receiving the request.

9. The system of claim 6, further comprising a list of authorized users from a global repository, wherein determining whether the client browser is authenticated and authorized comprises comparing the client browser with the list.

10. The system of claim 6, wherein the second processor controlled server is further configured to update a time value within the session credential at the second plug-in module.

11. The system of claim 10, wherein the time value is a session timeout value.

12. The system of claim 10, wherein the time value is a maximum idle time value.

13. The system of claim 6, wherein the second processor controlled server is further configured to update a time value within the session credential in conjunction with granting access to the second protected resource.

14. The system according to claim 6, wherein the processor controlled server is further configured to:

check for presence of a session credential; and

if a session credential is not present, establish the session credential.