Patent ID: 8028331

Claim:
Method for authenticating an entity at a first and a second data resource, the method comprising the following steps: receiving a first request token from a computer system of the entity by a token distribution unit, wherein the computer system of the entity, the first data resource, and the second data resource are connected to the token distribution unit over respective secured channels, wherein the computer system of the entity, the first data resource, and the second data resource are distributed over several locations and interconnected by unsecured channels, wherein the first request token is received over the secured channel between the computer system of the entity and the token distribution unit, wherein the first request token represents a request by the computer system of the entity for a first one-way authentication token, the first request token being a function of authentication information provided by the entity, wherein the first request token is transmitted only between the computer system of the entity and the token distribution unit; sending the first one-way authentication token from the token distribution unit to the computer system of the entity; receiving the first one-way authentication token from the first data resource by the token distribution unit to validate the first one-way authentication token, wherein the first one-way authentication token was sent from the computer system of the entity to the first data resource over an unsecured channel between the computer system of the entity and the first data resource to authenticate the entity at the first data resource; and invalidating the first one-way authentication token, wherein the first one-way authentication token travels from the token distribution unit to the computer system of the entity, from the computer system of the entity to the first data resource, and from the first data resource back to the token distribution unit only once and in the indicated direction before it is invalidated by the token distribution unit; sending a second one-way authentication token from the token distribution unit to the first data resource; sending the second one-way authentication token from the second data resource to the token distribution unit to validate the second one-way authentication token, wherein the second one-way authentication token was sent from the first data resource to the second data resource over the unsecured channel between the first and second data resource to authenticate the entity at the second data resource; and invalidating the second one-way authentication token, wherein the second one-way authentication token travels from the token distribution unit to the first data resource, from the first data resource to the second data resource and from the second data resource back to the token distribution unit only once and in the indicated direction, before it is invalidated by the token distribution unit.