Abstract: An identification and authentication scheme maintains control relationships among identities in order to allow a user to dynamically grant or deny permission for a technical support representative to access the user's data, while allowing the user to retain ultimate control over access to the data. Interactions entered by the representative can be distinguished from those entered by the user, while execution paths for representative-entered interactions are configured so that, to an application, the representative-entered transactions appear substantially identical to user-entered transactions. Technical support representatives are thereby able to duplicate users' problems to enable diagnosis and resolution of problems without requiring users to reveal their passwords or login credentials.

Abstract: An access site allows a client application to access a server application on behalf of a subscriber who has an account at the client site. A client application registers with the access site and receives a certificate for the client application. A subscriber is directed to the access site upon an indication that she would like to use the features of the client application that integrate with the server application. The subscriber specifies access rights to the access site, and issues a validation token in association with the specified access rights. When the client site needs the server application to process subscriber data, it forwards the validation token to the access site, using the certificate. The access site validates this information, and where appropriate the server application processes the subscriber data and returns the results to the client application.

Abstract: An access site allows a client application to access a server application on behalf of a subscriber who has an account at the client site. A client application registers with the access site and receives a certificate for the client application. A subscriber is directed to the access site upon an indication that she would like to use the features of the client application that integrate with the server application. The subscriber specifies access rights to the access site, and issues a validation token in association with the specified access rights. When the client site needs the server application to process subscriber data, it forwards the validation token to the access site, using the certificate. The access site validates this information, and where appropriate the server application processes the subscriber data and returns the results to the client application.