Cookie based session timeout detection and management

Patent metadata

Field	Value
Publication number	US-10182121-B2
Application number	US-201715859550-A
Country	US
Kind code	B2
Filing date	Dec 31, 2017
Priority date	Apr 19, 2017
Publication date	Jan 15, 2019
Grant date	Jan 15, 2019

Abstract

A method, computer system, and a computer program product for detecting a session status based on a cookie associated with the session is provided. The present invention may include receiving an access request to a specified location associated with a server computer. The present invention may also include determining that the received access request has the cookie corresponding with the specified location. The present invention may also include receiving a last refresh time from the cookie. The present invention may then include determining the session status based on the retrieved last refresh time, a current request time, a refresh interval, and an overdue value.

First claim

What is claimed is:

1. A method for detecting a session status based on a symmetrically encrypted cookie associated with the session, the method comprising:
receiving an access request to a secure website associated with a bank account of a user;
determining that the received access request has the symmetrically encrypted cookie corresponding with the specified location, wherein the symmetrically encrypted cookie contains a unique session identifier, wherein the unique session identifier is a string of numbers;
decrypting the symmetrically encrypted cookie based on a cryptographic key, wherein a server computer for the bank account is the only machine with the cryptographic key needed to decrypt the symmetrically encrypted cookie;
beginning a process for session timeout validation based on determining that decrypting the symmetrically encrypted cookie based on a cryptographic key is successful;
retrieving a last refresh time from the symmetrically encrypted cookie;
querying a current request time;
retrieving, from memory on the server computer for the bank account, a refresh interval value and an overdue value;
determining that the session is valid based on calculating that a difference value corresponding to the current request time and the last refresh time is not greater than or equal to an aggregate value corresponding to the refresh interval value and the overdue value, wherein the refresh interval value is ten and the overdue value is fifteen, and the current request time minus the last refresh time is equal to the refresh interval;
determining that the difference value is greater than or equal to the refresh interval value based on determining that the session is valid;
altering the cookie with an updated last refresh time based on determining that the difference value is greater than or equal to the refresh interval value;
symmetrically encrypting the altered cookie; and
sending the altered cookie to a client computer.

Assignees

• IBM

Inventors

• Carpenter William J
• Ji Hai
• Ji Zi Jian
• Li yuan yuan
• Ma wen bo
• Mi Jia

Classifications

• H04L63/0442

  wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30) · CPC title

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L67/146 Primary

  Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L67/025

  for remote control or remote monitoring of applications · CPC title