Patent ID: 8024560

Claim:
A method comprising: receiving a first authenticated request encrypted by a first encryption key for communicating with a second client sent from a first client to a reference monitor; transmitting a session certificate with a third encryption key from the reference monitor to the first client upon verifying the first encryption key, wherein the session certificate includes an encrypted permit identifier in accordance with a policy table in the reference monitor, wherein the permit identifier corresponds to an entry containing the session key in a table stored within the reference monitor; encrypting data with the third encryption key at the first client; transmitting the session certificate and the data from the first client to the second client; transmitting a second authenticated request encrypted by a second encryption key for communicating with the first client with the session certificate sent from the second client to the reference monitor; upon verifying the second authenticated request utilizing the second encryption key, decrypting the encrypted permit identifier at the reference monitor based on the session certificate transmitted from the second client to the reference monitor; transmitting an authenticated response with the third encryption key as an encrypted session key from the reference monitor to the second client; and decrypting encrypted data sent from the first client to the second client in response to the third encryption key.