Patent Application
20100169952
Embodiments of the present invention relate generally to network service provision technology and, more particularly, relate to a method, apparatus, and computer program product for providing an adaptive authentication session validity time period.
The modern communications era has brought about a tremendous expansion of wireline and wireless networks. Computer networks, television networks, and telephony networks are experiencing an unprecedented technological expansion, fueled by consumer demand. Wireless and mobile networking technologies have addressed related consumer demands, while providing more flexibility and immediacy of information transfer.
Current and future networking technologies continue to facilitate ease of information transfer and convenience to users. However, with the rapid development of communication networks and the corresponding expansion of applications and services accessible via these networks, authentication to each different service or application may be onerous. In this regard, for example, since security is an important consideration to many individuals while utilizing online applications and services, many such applications and services have authentication procedures (e.g., requiring a username and password) that must be followed in order to enable users to have access to the applications and services they desire. This can lead to a relatively large number of passwords and usernames that must be remembered by a user. Alternatively, even if the user can use the same username and password repeatedly, the interruption associated with providing authentication information to many different applications or services within one session with a communication device can be frustrating.
In the context of mobile communication devices, online services are becoming increasingly popular. In this regard, many always on services are becoming popular and services such as instant messaging, voice over Internet Protocol (VoIP), location based services, presence information, social connectivity services, and the like are often employed by users on a nearly continuous basis. Single sign on (SSO) procedures have been developed to provide shared authentication services for multiple services. Thus, using SSO, multiple services may be accessed or utilized with a single authentication sign on. Since different applications and services support different authentication mechanisms, SSO typically involves storage of various different credentials. SSO services can be applied to web based clients and to custom applications (including custom mobile applications) using some form of authentication application programming interface (API).
Authentication APIs may use access tokens that are created with authentication by provision of a username and password. Tokens typically have a fixed validity period after which time they timeout. As such, tokens may need to be refreshed regularly for online services. The fixed validity period of the tokens is used to ensure that users do not remain logged in indefinitely. The tokens may be valid for a group of services, which in the context of Internet service providers may be implemented in different organizations.
An issue that may arise in connection with token usage relates to the impact that session or token validity periods may have on network loading. In this regard, if clients need to refresh authentication tokens every couple hours, the load for token refreshment increases linearly with the increase in the number of clients. For example, ten million clients refreshing tokens every fourth hour may create a nearly constant load of about seven hundred authentications per second. For one hundred million clients, the number of authentications per second would increase ten-fold. Meanwhile, having a longer fixed timeout period for tokens (e.g., two weeks) may be impractical since it may be difficult to revoke tokens over such a long validity period without a specific tracking and revoking mechanism.
Accordingly, it may be desirable to improve SSO procedures relative to session validity mechanisms such as token usage.
A method, apparatus and computer program product are therefore described herein to provide an adaptive authentication session validity time. In particular, a method, apparatus and computer program product are provided that enable adaptation of authentication session validity time to loading conditions.
In one exemplary embodiment, a method of providing an adaptive authentication session validity time is provided. The method may include receiving an indication of load parameters indicative of authentication rate information, determining a value defining a validity period for indicating a period of time during which an authentication session validity object is valid to enable a client device based on the received indication of load parameters, and providing the authentication session validity object to a client device.
In another exemplary embodiment, a computer program product for providing an adaptive authentication session validity time is provided. The computer program product includes at least one computer-readable storage medium having computer-executable program code instructions stored therein. The computer-executable program code instructions may include program code instructions for receiving an indication of load parameters indicative of authentication rate information, determining a value defining a validity period for indicating a period of time during which an authentication session validity object is valid based on the received indication of load parameters, and providing the authentication session validity object to a client device.
In another exemplary embodiment, an apparatus for providing an adaptive authentication session validity time is provided. The apparatus may include a processor configured to receive an indication of load parameters indicative of authentication rate information, determine a value defining a validity period for indicating a period of time during which an authentication session validity object is valid based on the received indication of load parameters, and provide the authentication session validity object to a client device.
In another exemplary embodiment, an apparatus for providing an adaptive authentication session validity time is provided. The apparatus may include means for receiving an indication of load parameters indicative of authentication rate information, means for determining a value defining a validity period for indicating a period of time during which an authentication session validity object is valid based on the received indication of load parameters, and means for providing the authentication session validity object to a client device.
Embodiments of the invention may provide a method, apparatus and computer program product for SSO authentication performance. As a result, for example, mobile terminal users and users of other communication devices may enjoy improved access to network resources with the potential for less negative impact on network capacity.
Having thus described embodiments of the invention in general terms, reference will now be made to the accompanying drawings, which are not necessarily drawn to scale, and wherein:
Some embodiments of the present invention will now be described more fully hereinafter with reference to the accompanying drawings, in which some, but not all embodiments of the invention are shown. Indeed, various embodiments of the invention may be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. Like reference numerals refer to like elements throughout. As used herein, the terms “data,” “content,” “information” and similar terms may be used interchangeably to refer to data capable of being transmitted, received and/or stored in accordance with embodiments of the present invention. Moreover, the term “exemplary” , as used herein, is not provided to convey any qualitative assessment, but instead merely to convey an illustration of an example. Thus, use of any such terms should not be taken to limit the spirit and scope of embodiments of the present invention.
In certain environments, such as when multiple services and/or applications are desired to be made accessible for client usage from a server or other service platform, the SSO procedures described above may generally be employed. However, according to embodiments of the present invention, rather than employing fixed validity periods for defining the validity of an authentication session validity object (e.g., a token) to be a fixed value that may prove to be too long, have too great an impact on resource consumption, or otherwise negatively impact network resources, an adaptive authentication session validity time may be provided.
The user terminal 10 may be any of multiple types of mobile communication and/or computing devices such as, for example, portable digital assistants (PDAs), pagers, mobile televisions, mobile telephones, gaming devices, laptop computers, cameras, camera phones, video recorders, audio/video players, radios, global positioning system (GPS) devices, or any combination of the aforementioned, and other types of voice and text communications systems. While the user terminal 10 may be mobile as indicated by a number of the foregoing examples, the user terminal may be a fixed communication device in other embodiments. The network 30 may include a collection of various different nodes, devices or functions that may be in communication with each other via corresponding wired and/or wireless interfaces. As such, the illustration of
Although not necessary, in some embodiments, the network 30 may be capable of supporting communication in accordance with any one or more of a number of first-generation (1G), second-generation (2G), 2.5G, third-generation (3G), 3.5G, 3.9G, fourth-generation (4G) mobile communication protocols, Long Term Evolution (LTE), and/or the like. Thus, the network 30 may be a cellular network, a mobile network and/or a data network, such as a local area network (LAN), a metropolitan area network (MAN), and/or a wide area network (WAN), e.g., the Internet. In turn, other devices such as processing elements (e.g., personal computers, server computers or the like) may be included in or coupled to the network 30. By directly or indirectly connecting the user terminal 10 and the other devices (e.g., service platform 20, or other mobile terminals or devices such as the communication device 15) to the network 30, the user terminal 10 and/or the other devices may be enabled to communicate with each other, for example, according to numerous communication protocols, to thereby carry out various communication or other functions of the mobile terminal 10 and the other devices, respectively. As such, the user terminal 10 and the other devices may be enabled to communicate with the network 30 and/or each other by any of numerous different access mechanisms. For example, mobile access mechanisms such as wideband code division multiple access (W-CDMA), CDMA2000, global system for mobile communications (GSM), general packet radio service (GPRS) and/or the like may be supported as well as wireless access mechanisms such as wireless LAN (WLAN), Worldwide Interoperability for Microwave Access (WiMAX), WiFi (Wireless Fidelity), ultra-wide band (UWB), Wibree techniques and/or the like and fixed access mechanisms such as digital subscriber line (DSL), cable modems, Ethernet and/or the like.
In an example embodiment, the service platform 20 may be a device or node such as a server or other processing element. The service platform 20 may have any number of functions or associations with various services and/or applications. As such, for example, the service platform 20 may be a platform such as a dedicated server (or server bank) associated with a particular information source or service (e.g., a service associated with sharing music or other media content, a social network, a gaming service, and/or the like), or the service platform 20 may be a backend server associated with one or more other functions or services. As such, the service platform 20 represents a potential host for a plurality of different services or information sources. Moreover, the service platform 20 may, in some cases, be a source for accessing a plurality of different applications and services via a single platform (e.g., Nokia's Ovi service). Access to all of the applications and/or services available via the service platform 20 may be provided after a single sign on (SSO) authentication. In some embodiments, the functionality of the service platform 20 is provided by hardware and/or software components configured to operate in accordance with known techniques for the provision of information to users of communication devices. However, at least some of the functionality provided by the service platform 20 may be data processing and/or service provision functionality provided in accordance with embodiments of the present invention.
In an exemplary embodiment, the service platform 20 may employ an apparatus (e.g., the apparatus of
Referring now to
The processor 70 may be embodied in a number of different ways. For example, the processor 70 may be embodied as various processing means such as a processing element, a coprocessor, a controller or various other processing devices including integrated circuits such as, for example, an ASIC (application specific integrated circuit), an FPGA (field programmable gate array), a hardware accelerator, or the like. In an exemplary embodiment, the processor 70 may be configured to execute instructions stored in the memory device 76 or otherwise accessible to the processor 70. As such, whether configured by hardware or software methods, or by a combination thereof, the processor 70 may represent an entity capable of performing operations according to embodiments of the present invention while configured accordingly. Thus, for example, when the processor 70 is embodied as an ASIC, FPGA or the like, the processor 70 may be specifically configured hardware for conducting the operations described herein. Alternatively, as another example, when the processor 70 is embodied as an executor of software instructions, the instructions may specifically configure the processor 70, which may otherwise be a general purpose processing element if not for the specific configuration provided by the instructions, to perform the algorithms and operations described herein. However, in some cases, the processor 70 may be a processor of a specific device (e.g., a mobile terminal) adapted for employing embodiments of the present invention by further configuration of the processor 70 by instructions for performing the algorithms and operations described herein.
Meanwhile, the communication interface 74 may be any means such as a device or circuitry embodied in either hardware, software, or a combination of hardware and software that is configured to receive and/or transmit data from/to a network and/or any other device or module in communication with the apparatus. In this regard, the communication interface 74 may include, for example, an antenna (or multiple antennas) and supporting hardware and/or software for enabling communications with a wireless communication network. In fixed environments, the communication interface 74 may alternatively or also support wired communication. As such, the communication interface 74 may include a communication modem and/or other hardware/software for supporting communication via cable, digital subscriber line (DSL), universal serial bus (USB), Ethernet or other mechanisms.
The user interface 72 may be in communication with the processor 70 to receive an indication of a user input at the user interface 72 and/or to provide an audible, visual, mechanical or other output to the user. As such, the user interface 72 may include, for example, a keyboard, a mouse, a joystick, a display, a touch screen, a microphone, a speaker, or other input/output mechanisms. In an exemplary embodiment in which the apparatus is embodied as a server or some other network devices, the user interface 72 may be limited, or eliminated.
In an exemplary embodiment, the processor 70 may be embodied as, include or otherwise control a load determiner 80, an adaptive session validity period determiner (or period determiner 82) and an authentication agent 84. The load determiner 80, the period determiner 82 and the authentication agent 84 may each be any means such as a device or circuitry embodied in hardware, software or a combination of hardware and software that is configured to perform corresponding functions of the load determiner 80, the period determiner 82 and the authentication agent 84, respectively.
In an exemplary embodiment, the load determiner 80 may be configured to measure load parameters at the service platform 20 (or in some cases more specifically at the authentication agent 84). The load parameters measured may be communicated to the period determiner 82 for further processing and, in some cases, may also be stored at a location (e.g., the memory device 76 as load history information 86). The load parameters measured by the load determiner 80 may include any of a number of parameters such as bandwidth parameters, requests associated with particular clients and/or services, and the like. However, in an exemplary embodiment, the load determiner 80 may be configured to at least monitor authentication rate information. In particular, in an exemplary embodiment, the load determiner 80 is an agent used to determine the rate (e.g., measured in authentications per second) at which re-authentications are processed by the authentication agent 84.
The authentication agent 84 may be configured to receive authentication and re-authentication requests from client devices (e.g., the user terminal 10) in relation to accessing services including resources and applications associated with or otherwise provided by the service platform 20. In response to proper authentication of a client device, the client device may be issued an authentication session validity object (e.g., a token) with a given validity period defining the time for which the token is valid. After expiration of the validity period, the client device may request re-authentication, which may also be handled by the authentication agent 84. The authentication agent 84 may be configured to issue a new token with a validity period that may or may not be the same as the initial validity period defined for the client device. In an exemplary embodiment, the validity period defined for the token may be determined by the period determiner 82.
In an exemplary embodiment, the period determiner 82 may be configured to receive load parameter information from the load determiner 80 and determine a suitable validity period based on the load parameters. In this regard, in some cases, the period determiner 82 may compare rates of re-authentications to particular thresholds to determine whether to decrease the validity period (e.g., make the time period of validity shorter) or whether to increase the validity period (e.g., make the time period of validity longer) based on the re-authentication rate. For example, if the re-authentication rate reaches a high watermark (e.g., a high threshold), the period determiner 82 may be configured to increase the validity period to attempt to reduce the re-authentication rate and correspondingly reduce the consumption of bandwidth and processing resources otherwise expended for re-authentication purpose. Meanwhile, if the re-authentication rate reaches a low watermark (e.g., a low threshold), the period determiner 82 may be configured to decrease the validity period to attempt to increase the re-authentication rate to provide increase authentication control in instances in which the bandwidth and processing resources are available for such re-authentication purposes. In some embodiments, the period determiner 82 may be configured with predefined maximum and/or minimum validity periods that may be provided for token issuance.
In some instances, reductions in validity period may be maintained in place until a high threshold of authentication rate is met, at which time an increase in validity period may be instituted. Similarly, increases in validity period may be maintained in place until a low threshold of authentication rate is met, at which time decrease in validity period may be instituted. The period determiner 82 may also be configured to modify validity periods for tokens to be issued in response to other stimuli as well. For example, instead of basing validity period modifications solely on the rates of authentication or re-authentication, the period determiner 82 could base modification determinations on percentages of change or the rate of change of the authentication or re-authentication rates. Furthermore, a magnitude of the change in validity period may be either a predetermined increment or may be varied based on the rate of change of the authentication rates measured, or other historical or real-time factors.
In an exemplary embodiment, the period determiner 82 may be further configured to set validity period values in consideration of predictive factors. For example, the load history information 86 may be accessed by the period determiner 82 in order to predict a validity period for expected conditions over a given future period of time. As such, for example, the period determiner 82 may be configured to determine patterns in re-authentication rates at various different times of the day, on various calendar days, on various days of the week, etc. The patterns may be indicative of periods that can be expected to have relatively high or low re-authentication rates associated therewith. During expected periods of high re-authentication rates based on historical statistics (e.g., from the load history information 86), the period determiner 82 may preemptively increase the validity period to reduce re-authentication rates. Meanwhile, during expected periods of low re-authentication rates based on historical statistics (e.g., from the load history information 86), the period determiner 82 may preemptively decrease the validity period to increase re-authentication rates. In some embodiments, the period determiner 82 may be configured to employ both predictive techniques and reactive techniques to balance re-authentication rates based on predictive and actual data. Thus, unpredictable peaks may also be handled in embodiments that employ predictive techniques.
Embodiments of the present invention may apply token session validity periods on a global or per service basis. Accordingly, in at least some embodiments, authentication services provided by the authentication agent 84 may be guided by a determination from the period determiner 82 as to a validity period to be applied to issued tokens in order to mitigate peaks and valleys in authentication rates. Some embodiments therefore provide overload protection based on historical and/or current load conditions.
Although embodiments of the present invention have been described in which the validity period is increased when the re-authentication rate reaches a high watermark and decreased when the re-authentication rate reaches a low watermark, the period determiner 82 of other embodiments may be configured to similarly adjust the validity period at re-authentication rates between the high and low watermarks. In this regard, a neutral level or region may be defined between the high and low watermarks representing a re-authentication rate or range of re-authentication rates that is desired. As the load determiner 80 determines that the re-authentication rate exceeds the neutral level or region, the period determiner 82 of one embodiment may be configured to begin increasing the validity period even though the re-authentication rate has not yet reached the high watermark in an effort to reduce the re-authentication rate before it reaches the high watermark. In this regard, the period determiner 82 need not always increase the validity period by equal amounts. Instead, in this embodiment, the period determiner 82 may increase the validity period by greater amounts as the re-authentication rate continues to climb toward the high watermark with the greatest increase in the validity period occurring when the re-authentication rate reaches the high watermark. Conversely, as the load determiner 80 determines that the re-authentication rate falls below the neutral level or region, the period determiner 82 of one embodiment may be configured to begin decreasing the validity period even though the re-authentication rate has not yet reached the low watermark in an effort to increase the re-authentication rate before it reaches the low watermark. As before, the period determiner 82 need not always decrease the validity period by equal amounts. Instead, in this embodiment, the period determiner 82 may decrease the validity period by greater amounts as the re-authentication rate continues to fall toward the low watermark with the greatest increase in the validity period occurring when the re-authentication rate reaches the low watermark.
Additionally, although embodiments of the present invention have been described in which the validity period of all tokens issued at one period of time are the same, other embodiments of the present invention may be configured to control the re-authentication rate by altering the percentage of tokens that are issued with longer or shorter validity periods. In this regard, instead of uniformly increasing the validity period for all tokens upon reaching the high watermark, other embodiments of the present invention may increase the percentage of tokens having a longer validity period upon reaching the high watermark, even though all tokens that are issued do not have the longer validity period. Conversely, instead of uniformly decreasing the validity period for all tokens upon reaching the low watermark, other embodiments of the present invention may increase the percentage of tokens having a shorter validity period upon reaching the low watermark, even though all tokens that are issued do not have the shorter validity period. Similarly, at re-authentication rates between the high and low watermarks, the percentage of tokens that are issued with a longer validity period may be increased as the re-authentication rate climbs toward the high watermark and may be decreased as the re-authentication rate falls toward the low watermark. By controlling the percentages of the tokens for which the validity period is adjusted as well as the size of the adjustment, embodiments of the present invention may provide even more granular control over the re-authentication rate.
Accordingly, blocks or steps of the flowchart support combinations of means for performing the specified functions, combinations of steps for performing the specified functions and program instruction means for performing the specified functions. It will also be understood that one or more blocks or steps of the flowchart, and combinations of blocks or steps in the flowchart, can be implemented by special purpose hardware-based computer systems which perform the specified functions or steps, or combinations of special purpose hardware and computer instructions.
In this regard, one embodiment of a method for providing adaptive authentication session validity times as provided in
In some embodiments, the operations described above may be modified. Such modifications may be performed in any order and/or in combination with each other in various alternative embodiments. As such, for example, receiving the indication of load parameters may include receiving re-authentication rate information associated with devices requesting issuance of a subsequent authentication session validity object. In some cases, receiving the indication of load parameters may include receiving an indication that an authentication rate has reached a threshold value. In an exemplary embodiment, determining the value may include selecting a modified validity period that increases the value in response to an upper limit threshold value being reached and decreases the value in response to a lower limit threshold value being reached. In some situations, receiving the indication of load parameters may include receiving historical data on past authentication rate information. In an exemplary embodiment, determining the value may include selecting the value to mitigate predicted peaks and valleys in authentication rates based on the historical data.
In an exemplary embodiment, an apparatus for performing the method of
Many modifications and other embodiments of the inventions set forth herein will come to mind to one skilled in the art to which these inventions pertain having the benefit of the teachings presented in the foregoing descriptions and the associated drawings. Therefore, it is to be understood that the inventions are not to be limited to the specific embodiments disclosed and that modifications and other embodiments are intended to be included within the scope of the appended claims. Moreover, although the foregoing descriptions and the associated drawings describe exemplary embodiments in the context of certain exemplary combinations of elements and/or functions, it should be appreciated that different combinations of elements and/or functions may be provided by alternative embodiments without departing from the scope of the appended claims. In this regard, for example, different combinations of elements and/or functions than those explicitly described above are also contemplated as may be set forth in some of the appended claims. Although specific terms are employed herein, they are used in a generic and descriptive sense only and not for purposes of limitation.
