The sample Sorbet application consists of a client, application server, and security server as shown in Figure 1 . At startup, the client and server each register interceptor factories. The client then makes an initial call to the application server. This call causes the client interceptor factory to create a client interceptor. The client interceptor initiates a series of steps to authenticate to the security service and receive a valid session object, as shown in Figure 2 and described below.
Bracketed numbers correspond to numbered transactions in the figure.
Figure 1 . If the response sent to the security service fails the verification test, no session is created and an exception is thrown on the client. Assuming client authentication is successful, both the session object and the client now use the same seed to start tandem PRNGs to provide a synchronous step operation. Once the client interceptor is initialized, the client can begin making calls to the application service. The first call to the application service causes the server interceptor factory to create a sever interceptor.