Patent ID: 8707418

Claim:
A method in an access gateway (AG) of registering a client in the AG, wherein the AG is adapted for operation in a system for providing communication between one or more clients and one or more service providers (SP) via the AG and an application-level router (AR); wherein the system comprises the AG, the AR, and an authentication provider(AP); the method comprising: receiving, from the client, a first registration message comprising a global user identifier (GUID) and a public key of the client; wherein the GUID is a uniform resource identifier (URI) on the AP for verifying the identity of a user of the client; issuing a local user identifier (LUID), the LUID being a URI of a resource of the AG that maintains the client's connection to the AG; sending to the AP, via the AR, a second registration message comprising the GUID, the client's public key, and the LUID; receiving from the AP, via the AR, a first authentication challenge message; forwarding the first authentication challenge message to the client; receiving, from the client, a first authentication response to the first authentication challenge message for authentication of the user's identity; forwarding to the AP, via the AR, the first authentication response; receiving, from the AP, via the AR, a result message indicating whether the first authentication response successfully authenticated the identity of the user; in response to the result message indicating that the identity of the user was successfully authenticated, forming an identity certificate comprising the LUID, the client's public key, and the GUID; wherein the identity certificate is encrypted with a private key of the AP.