Patent ID: 7698736

Claim:
A method of authenticating a client, comprising: receiving a pre-nonce token and a common nonce that has been signed by a client at a back-end server of a plurality of back-end servers from a middle tier server that is impersonating the client, wherein: the pre-nonce token comprises a combination of pre-nonce contributions from the plurality of back-end servers; the common nonce is created by hashing the pre-nonce token and is generated from an entity other than the client that the middle tier server is impersonating or the plurality of back-end servers that the middle tier server is to interact with on behalf of the client; authenticating the client based on the received signed common nonce; hashing the pre-nonce token using the same hashing technique used to create the common nonce from the pre-nonce token; and verifying the middle tier server based upon a comparison of the received common nonce and hashed value of the received pre-nonce token.