Abstract: A batch job system may create a second set of credentials for a user and associate the second set of credentials with the user in an authentication server. The second set of credentials may allow computers running the batch jobs to have user-level authentication for execution and reporting of results. The second set of credentials may be a single sign on type of credential, and may consist of a virtual smartcard that each worker computer may use for authentication. In some embodiments, authentication requests may be routed to a virtual or physical Hardware Security Module.

Abstract: A trusted display (18) of a trusted authorization device (TAD) (10) displays on a trusted display (18) first information about a transaction to be authorized by a user (14) using a trusted keypad (20). The TAD (10) generates (208) a random number (R); generates (1210) second information from the first information, the random number (R) and a first identification code (TADID-A) of the TAD (10); generates (212) a signature of the second information using a first encryption process; egnerates (216) a set of session keys (Ks1, Ks2, Ks3) by a second encryption process responsive to the random number (R) and a set of stored working keys (Kw1, Kw2, Kw3); and generates (218) third information by encrypting the second information and the signature using a third encryption process responsive to the set of session keys (Ks1, Ks2, Ks3).