Abstract: A method and system for automatically authenticating a user to applications in a network environment. After an initial authentication procedure, the user's identity is mapped into a network credential which includes the user's role, and which is formed into a cookie. To gain access to an application requiring authentication, the cookie is provided to a script, and the information contained in the cookie is used to obtain authentication data required by the desired application.

Abstract: A data processing system has a security infrastructure, including a first cryptographic support facility, a security service for user data, including a further cryptographic support facility, and a number of cryptographic algorithms, usable by said cryptographic support facilities. In order to protect against a user replacing weak algorithms intended for the protection of data with strong algorithms intended for use by the security infrastructure, a challenge/response mechanism is provided, which enables the cryptographic support facilities to verify authenticity of the algorithms. The challenge/response mechanism is as follows. First, the cryptographic support facility sends a challenge to the algorithm. The algorithm then generates a response by applying a cryptographic function to the challenge, and returns the response to the cryptographic support facility. The cryptographic support facility then checks whether the response has an expected value.

Abstract: A data processing system includes a number of applications, each of which has a cryptographic support facility (CSF) for securely managing cryptographic keys and performing cryptographic operations on behalf of the application. Each key has a 2-byte tag which is enciphered along with the key whenever the key is made available outside the CSF, to prevent unauthorized modification of the tag. Each tag indicates whether the key may be used as a basis for deriving data protection keys, whether keys derived from this key should be subject to cryptographic control policies, and whether the key should be subject to cryptographic control policies prior to use. Whenever the CSF is invoked to use a key, it enforces any restrictions imposed by the associated tag.

Abstract: A cryptographic services facility uses object-oriented techniques to allow a user to interface with the facility in an algorithm-independent manner. The facility stores algorithm objects which specify algorithm attributes, and context type objects which specify user context attributes such as intended algorithm, intended use, key size and default key. In response to a "create context" request from a user, the context type objects are searched to find a context type that meets the user's requirements, and this is used to create a new context instance. In response to "create context type" requests from the system administrator, a context type factory object searches for an algorithm object that provides a required level of protection and uses this to create a new context type which is then available to users.