Patent ID: 7958544

Claim:
A computer-implemented method comprising: receiving, at an authentication server system and from an administrator server system, an encryption key that the administrator server has also shared with a credentialing server system, wherein the authentication server system and the credentialing server system are not in direct communication with each other; receiving, at the authentication server system and from a client device, an encrypted session identifier that encodes a password that the credentialing server system has caused to be encrypted for the client device using the encryption key; determining the password, at the authentication server system, by decrypting the session identifier with the encryption key to extract the password without having directly received the encrypted session identifier from the credentialing server system; and authenticating, at the authentication server system, a communication session for the client device using the password, wherein the password is determined by decrypting the session identifier received from the client device, and without receiving the password from another source.