Patent ID: 7660422

Claim:
A method, comprising: receiving, by an authentication server, authentication information of a user; encrypting, by the authentication server, a first ticket including the authentication information with a first key of a first affiliated server, the first affiliated server having first authentication requirements; encrypting, by the authentication server, a second ticket including the authentication information with a second key of a second affiliated server, the second affiliated server having second authentication requirements that are different from the first authentication requirements; providing, by the authentication server, the first ticket to the first affiliated server to authenticate the user to the first affiliated server; providing, by the authentication server, the second ticket to the second affiliated server to authenticate the user to the second affiliated server; refreshing the authentication information of the user, wherein the first ticket and the second ticket each include: (1) a first timestamp corresponding to when the user last manually entered the authentication information and (2) a second timestamp corresponding to when the authentication server last refreshed the authentication information of the user; generating a third key to replace the first key as a current key for the first affiliated server, the first key and the third key being concurrently valid for the first affiliated server for a coexistence period, wherein the first key and the second key each include key data and executable code for decrypting the first ticket and the second ticket, respectively; encrypting the first ticket with the third key; and providing the first ticket encrypted with the third key to the first affiliated server to re-authenticate the user to the first affiliated server without requiring the user to reenter the authentication information to the authentication server.