Patent ID: 8020197

Claim:
A system comprising: a client; the client including an explicit strong delegation component that is adapted to: provide a temporal certificate and an encrypted temporal private key to a first gateway, the temporal certificate includes a random challenge and a server-issued timestamp and the encrypted temporal private key is encrypted based on at least a public key of the first gateway; strongly authenticate the client to the first gateway by using Transport Layer Security (TLS) as an authentication protocol with the temporal certificate and the encrypted temporal private key stored in USB tokens to produce non-reusable credentials, wherein the temporal certificate includes a temporal public key and the public key of the first gateway, the public key is a non-temporal public key; explicitly delegate to a second gateway a right to authenticate on behalf of the client using the temporal certificate delegated by the client; define a period of time over which the explicit strong delegation is valid; the client is configured to rely on the temporal certificate to provide a mechanism for containing risk to the client, when a private key of the first gateway is compromised, the first gateway public key is revoked, and the temporal certificate that was granted to the first gateway is revoked; the client is configured to rely on the temporal certificate to provide the mechanism for containing risk to the client, wherein: when the private key of the first gateway is not compromised, the first gateway authenticates to the second gateway; and the second gateway authenticates to an end server based on the end server returning acknowledgement of the random challenge and the server-issued timestamp.