Security measures for extended sessions

Patent metadata

Field	Value
Publication number	US-11329992-B2
Application number	US-201916654513-A
Country	US
Kind code	B2
Filing date	Oct 16, 2019
Priority date	Oct 16, 2019
Publication date	May 10, 2022
Grant date	May 10, 2022

Abstract

Techniques are provided for security measures for extended sessions. Request data for a request is received from a client computing device to a web server system. The request comprises a session identifier (ID) for a session between an authenticated user and the web server system. It is determined, based on the request data, that the client computing device is a single-user device. It is determined, based on the request data, that the client computing device is not compromised. In response to determining that the client computing device is a single-user device and that the client computing device is not compromised, extension of the session between the authenticated user on the client computing device and the web server system is caused.

First claim

What is claimed is:

1. A computer system comprising:
one or more hardware processors;
at least one memory coupled to the one or more hardware processors and storing one or more instructions which, when executed by the one or more hardware processors, cause the one or more hardware processors to:
receive request data for a request from a client to a web server system, the request comprising a session identifier (ID) for a session between an authenticated user and the web server system;

determine, based on the request data, that the client is a single-user device based on determining that only the authenticated user has logged in to the web server system from the client during a time period;
determine, based on the request data, that the client is not compromised based on an analysis of request data comprising telemetry data received from the client generated by one of a plurality of types of instrumentation code provided to the client based on a type of risk posed by the client;
in response to determining that the client is a single-user device and that the client is not compromised, cause extension of the session between the authenticated user on the client and the web server system by setting a new expiration date for an existing session cookie for the authenticated user at the client or issuing a new session cookie for the authenticated user at the client with a new expiration date.

2. The computer system of claim 1 , wherein the determine that the client is not compromised further comprises at least one additional instruction to determine that the client is not controlled by automated software.

3. The computer system of claim 1 , wherein the one or more instructions, when executed by the one or more hardware processors, cause the one or more hardware processors to:
issue a cookie to the client comprising a device ID, wherein the request data includes the cookie;
store, in association with the device ID, user ID data for any authenticated users that successfully log in to web server system from the client;
wherein the determine that the client is a single-user device further comprises at least one additional instruction to use the device ID in the request data to look up the user ID data associated with the web server system.

4. The computer system of claim 1 , wherein the one or more instructions, when executed by the one or more hardware processors, cause the one or more hardware processors to:
issue a cookie to the client comprising encrypted user ID data for each authenticated user that successfully logs in to the web server system from the client computing device, wherein the request data includes the cookie;
wherein the determine that the client is a single-user device further comprises at least one additional instruction to analyze the encrypted user ID data.

5. A method implemented by a network management system comprising one or more security server devices, web server systems, or client computing devices, the method comprising:
receiving request data for a request from a client to a web server system, the request comprising a session identifier (ID) for a session between an authenticated user and the web server system;
determining, based on the request data, that the client is a single-user device based on determining that only the authenticated user has logged in to the web server system from the client during a time period;
determining, based on the request data, that the client is not compromised based on an analysis of request data comprising telemetry data received from the client generated by one of a plurality of types of instrumentation code provided to the client based on a type of risk posed by the client;
in response to the determining that the client is a single-user device and that the client is not compromised, causing extension of the session between the authenticated user on the client and the web server system by setting a new expiration date for an existing session cookie for the authenticated user at the client or issuing a new session cookie for the authenticated user at the client with a new expiration date.

6. The method of claim 5 , wherein the determining that the client is not compromised further comprises determining that the client is not controlled by automated software.

7. The method of claim 5 , further comprising:
issuing a cookie to the client comprising a device ID, wherein the request data includes the cookie;
storing, in association with the device ID, user ID data for any authenticated users that successfully log in to web server system from the client;
wherein the determining that the client is a single-user device comprises using the device ID in the request data to look up the user ID data associated with the web server system.

8. The method of claim 5 , further comprising:
issuing a cookie to the client comprising encrypted user ID data for each authenticated user that successfully logs in to the web server system from the client, wherein the request data includes the cookie;
wherein the determining that the client is a single-user device further comprises analyzing the encrypted user ID data.

9. A non-transitory computer readable medium having stored thereon instructions comprising executable code which when executed by one or more processors, causes the processors to:
receive request data for a request from a client to a web server system, the request comprising a session identifier (ID) for a session between an authenticated user and the web server system;
determine, based on the request data, that the client is a single-user device based on determining that only the authenticated user has logged in to the web server system from the client during a time period;
determine, based on the request data, that the client is not compromised based on an analysis of request data comprising telemetry data received from the client generated by one of a plurality of types of instrumentation code provided to the client based on a type of risk posed by the client;
in response to determining that the client is a single-user device and that the client is not compromised, cause extension of the session between the authenticated user on the client and the web server system by setting a new expiration date for an existing session cookie for the authenticated user at the client or issuing a new session cookie for the authenticated user at the client with a new expiration date.

10. The non-transitory computer readable medium of claim 9 , wherein the determine that the client is not compromised further comprises at least one additional instruction to determine that the client is not controlled by automated software.

11. The non-transitory computer readable medium of claim 9 , wherein the executable code when executed by the one or more processors further causes the one or more processors to:
issue a cookie to the client comprising a device ID, wherein the request data includes the cookie;
store, in association with the device ID, user ID data for any authenticated users that successfully log in to web server system from the client;
wherein the determine that the client is a single-user device further comprises at least one additional instruction to use the device ID in the request data to look up the user ID data associated with the web server system.

12. The non-transitory computer readable medium of claim 9 , wherein the executable code when executed by the one or more processors further causes the one or more processors to:
issue a cookie to the client comprising encrypted user ID data for each authenticated user that successfully logs in to the web server system from the client computing device, wherein the requ

Assignees

• Shape Security Inc
• F5 Inc

Inventors

• Chen Mengmeng
• Agarwal Sumit
• Zhou Yao

Classifications

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L67/146

  Markers for unambiguous identification of a particular session, e.g. session cookie or URL-encoding · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L67/01

  Protocols · CPC title

• H04L63/108 Primary

  when the policy decisions are valid for a limited amount of time · CPC title