Abstract: A user, by way of a computing device, requests and receives content from a first server at the computing device. An authentication response is also received from the first server at the computing device of the user. The authentication response includes an address of the second server and an executable script. The computing device of the user executes the executable script by issuing a request to the second server for state information corresponding to the user, receiving the state information from the second server; and determining, based on the state information, whether the user is authenticated to the second server. If the user is not authenticated to the second server, the computer device of the user displays a login module that is visually associated with the first server. Such login module collects login information for authenticating the user to the second server.

Abstract: A method of in-line sign in that allows a user to sign into a first server based on a sign-in methodology of a second server is disclosed. The method uses, among other things, a nonce and approved URL list to prevent spoofing and replay attack. Additionally, the method allows error messages that occur during the authentication process to be displayed to the user having the look and feel of the first server, despite using the authentication process of the second server. A method of dual or distributed authentication is also disclosed wherein the user need only to input the login id and password once and wherein the two authentication processes need not exchange the user's password.

Abstract: Scalable session management is achieved by generating a cookie that includes an encrypted session key and encrypted cookie data. The cookie data is encrypted using the session key. The session key is then signed and encrypted using one or more public/private key pairs. The encrypted session key can be decrypted and verified using the same private/public key pair(s). Once verified, the decrypted session key can then be used to decrypt and verify the encrypted cookie data. A first server having the private/public key pair(s) may generate the cookie using a randomly generated session key. A second server having the same private/public key pair(s) may decrypt and verify the cookie even if the session key is not initially installed on the second server. A session key cache may be used to provide session key lookup to save public/private key operations on the servers.

Abstract: A system and method for retrieving certificate of trust information for a certificate validation process. Fetching servers periodically retrieve certificate revocation lists (CRLs) from servers maintained by various certificate issuers. The revoked certificate data included in the retrieved CRLs are stored in a central database. An authentication server receives a request from a client for access to a secure service and initiates a validation process. The authentication server retrieves revoked certificate data from the central database and compares the retrieved revoked certificate data to certificate of trust information received from the client along with the request. The authentication server denies access to the secure information if the certificate of trust information matches revoked certificate data from the central database, allows access if the certificate of trust information does not match revoked certificate data from the central database.

Abstract: Providing services within a network of service providers sharing an authentication service and a set of business rules. A central server receives a first request from a first server to provide a first service to a user via a client without forcing the user to present credentials. In response to the received first request, the central server stores data identifying the first service on the client. The central server further receives a second request from a second server to provide a second service to the user via the client after the user presents the credentials to the second service. After receiving the second request and the presented credentials, the central server allows the user access to the second service. In response to allowing the user access to the second service, the central server further allows the user access to the first service as a result of the stored data.

Abstract: A computerized method and system for routing between network servers. A central database coupled to a central server on a data communication network stores information for identifying locations of a plurality of network servers on the network. Each network server provides at least one service via the network. The central server receives a request from the user for a selected service including a carry through keyword for controlling routing of the user to the selected service. The central server retrieves location information from the central database to identify the location of the network server providing the selected service and attaches the carry through keyword to the retrieved location information. The central server then routes the user with the carry through keyword to the network server, which directs the user to the selected service based on the carry through keyword.