English 
Tiếng ViệtPKCS#11 SESSIONS & AUTHENTICATION
Role, login and concurrency model
The provider defines whether login state is token-wide or session-scoped, how context-specific authentication works and what happens during failover.
01
Authentication model
| Area | Required statement |
|---|---|
| Roles | Security Officer, User and context-specific role support |
| Login scope | Token-wide versus session-specific behavior |
| PIN lifecycle | Initialization, change, retry counter and lockout |
| Step-up | Local PIN, remote approval or context login binding |
| Session expiry | Idle/absolute timeout and re-authentication |
| Pooling | Safe reuse rules and application-server guidance |
02
Concurrency and HA
- RO/RW session limits.
- Multi-thread synchronization requirements.
- Multi-process object visibility.
- Token removal and handle invalidation.
- HA failover and session recreation.
- Long-running signing cancellation behavior.