Dynamic distribution of authentication sessions
View Patent ↗This disclosure relates to authenticating and providing transport security over unsecured IP networks to network subscribers. The system includes an authentication service that authenticates network subscribers. The authentication service can dynamically define expiry times for network authentication.
1. A computer-implemented method for management of authentication sessions, the computer-implemented method comprising:
receiving an authentication request for an authentication session, wherein an authentication server receives the authentication request from a telecommunication device;
determining a proposed expiry time for the authentication session, wherein the proposed expiry time is within a first time period;
determining a number of subscribers with expiry times within the first time period;
based on a determination that the number of subscribers in the first time period exceeds a first subscriber threshold,
determining a modified expiry time within a second time period, wherein the number of subscribers with authentication session expiry times within the second time period does not exceed a second subscriber threshold;
generating an authentication token with the second expiry time; and
transmitting the authentication token to the telecommunication device responsive to the authentication request.
2. The computer-implemented method of claim 1 further comprising:
based on a determination that the number of subscribers in the first time period does not exceed a first subscriber threshold, generating an authentication token with the proposed expiry time.
3. The computer-implemented method of claim 1 , wherein the modified expiry time corresponds to a time prior to the proposed expiry time.
4. The computer-implemented method of claim 1 , wherein the modified expiry time corresponds to a time after the proposed expiry time.
5. The computer-implemented method of claim 1 , wherein the first subscriber threshold for the first time period and second subscriber threshold for the second time period are different.
6. The computer-implemented method of claim 1 , wherein the threshold for the first time period and the second time period are equal.
7. A telecommunication system comprising:
an authentication server configured to:
receive an authentication request for an authentication session from a telecommunication device;
determine a first expiry time for the authentication session, wherein the first expiry time is within a first time period;
determine a number of subscribers with authentication session expiry times within the first time period;
based on a determination that the number of subscribers in the first time period exceeds a first subscriber threshold,
determine a second expiry time within a second time period, wherein the number of subscribers with authentication session expiry times within the second time period does not exceed a second subscriber threshold;
generate an authentication token with the second expiry time; and
transmit the authentication token to the telecommunication device responsive to the authentication request.
8. The telecommunication system of claim 7 , wherein the authentication server is configured to communicate with the telecommunication device over a bootstrapping interface.
9. The telecommunication system of claim 7 , wherein the authentication server comprises a bootstrapping service function.
10. The telecommunication system of claim 7 , wherein the first subscriber threshold and the second subscriber threshold are the same.
11. The telecommunication system of claim 7 , wherein the authentication server is further configured to:
analyze historical data related to the distribution of subscriber expiry times; and
determine the second expiry time based, at least in part, the historical data in addition to the number of subscribers with authentication session expiry times within the second time period.
12. The telecommunication system of claim 7 , wherein the first expiry time corresponds to a defined expiry time period.
13. The telecommunication system of claim 12 , wherein the defined expiry time period is twenty-four hours.
14. The telecommunication system of claim 7 , wherein the first time period and the second time period are equal.
15. The telecommunication system of claim 7 , wherein the first subscriber threshold is a maximum number of authentication session expiry times within the first time period.
16. A non-transitory computer-readable medium storing computer-executable instructions that, when executed by one or more computing devices, configure the one or more computing devices to perform operations comprising:
receiving an authentication request for an authentication session from a telecommunication device;
determining a first expiry time for the authentication session, wherein the first expiry time is within a first time period;
determining a number of subscribers with authentication session expiry times within the first time period;
based on a determination that the number of subscribers in the first time period exceeds a first subscriber threshold,
determining a second expiry time within a second time period, wherein the number of subscribers with authentication session expiry times within the second time period does not exceed a second subscriber threshold;
generating an authentication token with the second expiry time; and
transmitting the authentication token to the telecommunication device responsive to the authentication request.
17. The non-transitory computer-readable medium of claim 16 , wherein the modified expiry time corresponds to a time less than the proposed expiry time.
18. The non-transitory computer-readable medium of claim 16 , wherein the modified expiry time corresponds to a time greater than the proposed expiry time.
19. The non-transitory computer-readable medium of claim 16 , wherein the first subscriber threshold for the first time period and the second subscriber threshold for the second time period are different.
20. The non-transitory computer-readable medium of claim 16 further comprising:
analyzing historical data related to the distribution of subscriber expiry times; and
determining the second expiry time based, at least in part, the historical data in addition to the number of subscribers with authentication session expiry times within the second time period.