System and Method of Proxy Authentication in a Secured Network

A computer-readable medium having stored thereon a data structure containing information for proxy authorization, comprising:

• a first data field containing an identification of a user of a secured network;
• a second data field containing an identification of a security principal of the secured network authorized to act as proxy of user;
• a third data field containing data identifying a duration of proxy authorization;
• a fourth data field containing data specifying a restriction on the proxy authorization.

A method implemented at least in part by a computing device comprising:

• submitting a proxy request to a trusted security server, the proxy request identifying a user and a target service that the client intends to access on behalf of the user;
• receiving from the trusted security server a session key encrypted with a shared secret key shared by the client and the trusted security server and a ticket for accessing the target service;
• decrypting the session key with the shared secret key;
• constructing an authenticator encrypted with the session key;
• presenting the authenticator and the ticket to the target service for authentication of the client for access of the target service on behalf of the user.