Patent ID: 8181010

Claim:
A computer implemented method for authenticating a request to access a protected network resource, comprising: receiving the request to access the protected network resource at a first software object, the request originating from a web browser; permitting access to the protected network resource by the first software object, if the request includes a required authentication token to access the protected network resource; re-directing the request to a distributed software object by the first software object, if the request does not include the required authentication token to access the protected network resource, the distributed software object being protected by a first security layer; translating the re-directed request into a client credentials requirement input call for an authentication service, by the distributed software object; communicating the client credentials requirement input call by the distributed software object across a second security layer to the authentication service using a backchannel that only allows communication through the distributed software object, the first software object being prevented from accessing the authentication service, the authentication service being protected by the second security layer, the second security layer being behind the first security layer, wherein the authentication service resides in a distinct space that is separate from the space where the first software object, the distributed software object and the protected network resource reside; requesting input from the authentication service specifying a required authentication solution by the distributed software object based on the client credentials requirement input call; receiving the input from the authentication service to the distributed software object; and arbitrating an authentication transaction sequence between the web browser and the authentication service based upon the received input, wherein arbitration between the web browser and the authentication service is only through the distributed software object without utilizing the first software object, wherein the arbitration includes, receiving a response with the required authentication solution by the distributed software object using the web browser, the response enabling issuance of a new authentication token by the authentication service to the distributed software object so as to allow the distributed software object to re-direct the web browser to the first software object for accessing the protected network resource.