Authentication Over a Network Using One-Way Tokens

One or more non-transitory computer-accessible memory mediums that store program instructions executable by one or more processors to implement:

• a request token issue unit issuing a first request token to a computer system of an entity in response to receiving authentication information from the computer system of the entity, wherein the computer system of the entity and a first data resource are connected to the token distribution unit over respective secure channels, wherein the computer system of the entity and the first data resource are distributed over two or more locations and interconnected by unsecured channels, wherein the first request token is issued over the secured channel between the computer system of the entity and the token distribution unit, and wherein the first request token is transmitted only between the computer system of the entity and the token distribution unit;
• a one-way authentication token issue unit issuing a first one-way authentication token to the computer system of the entity in response to receiving the first request token from the computer system of the entity;
• a validation unit validating the first one-way authentication token received from the first data resource;
• and
• an invalidation unit invalidating the first one-way authentication token issued by the authentication token issue unit and received with a validation request from the first data resource, wherein the first one-way authentication token travels directly from the token distribution unit to the computer system of the entity, from the computer system of the entity to the first data resource and from the first data resource back to the token distribution unit only once and in the indicated direction, before it is invalidated by the token distribution unit;
• wherein the request token issue unit issues a second request token to the first data resource over the secured channel between the first data resource and the token distribution unit when the validation unit has successfully validated the first one-way authentication token for the first data resource, wherein the second request token is transmitted only between the first data resource and the token distribution unit.

One or more non-transitory computer-accessible memory mediums that store program instructions executable by one or more processors to implement:

• issuing a first request token to a computer system of an entity in response to receiving authentication information from the computer system of the entity, wherein the computer system of the entity and a first data resource are connected to the one or more processors over respective secure channels, wherein the computer system of the entity and the first data resource are distributed over two or more locations and interconnected by unsecured channels, wherein the first request token is issued over the secured channel between the computer system of the entity and the one or more processors, and wherein the first request token is transmitted only between the computer system of the entity and the one or more processors;
• issuing a one-way authentication token to the computer system of the entity in response to receiving the first request token from the computer system of the entity;
• validating the one-way authentication token received from the first data resource;
• and
• invalidating the one-way authentication token received with a validation request from the first data resource, wherein the one-way authentication token travels directly from the one or more processors to the computer system of the entity, from the computer system of the entity to the first data resource and from the first data resource back to the one or more processors only once and in the indicated direction, before it is invalidated by the one or more processors;
• issuing a second request token to the first data resource over the secured channel between the first data resource and the one or more processors when the validation unit has successfully validated the one-way authentication token for the first data resource, wherein the second request token is transmitted only between the first data resource and the one or more processors.

A first data resource comprising one or more processors and one or more memory mediums, wherein the one or more memory mediums comprise program instructions which are executable by the one or more processors to implement:

• an access control unit receiving a first one-way authentication token from a computer system of an entity to gain access to data of the first data resource, wherein the computer system of the entity and the first data resource are connected to a token distribution unit over respective secure channels, wherein the computer system of the entity and the first data resource are distributed over two or more locations and interconnected by unsecured channels, and wherein the first one-way authentication token is received over an unsecured channel between the computer system of the entity and the first data resource;
• a validation request unit sending the received first one-way authentication token to the token distribution unit and obtaining a request token in response;
• and
• a one-way authentication token obtaining unit sending the request token to the token distribution unit to obtain a one-way authentication token for a single access of the first data resource at a second data resource, wherein the request token is transmitted only between the first data resource and the token distribution unit, wherein the one-way authentication token for a single access of the first data resource at the second data resource travels directly from the token distribution unit to the computer system of the entity, from the computer system of the entity to the first data resource, and from the first data resource back to the token distribution unit only once and in the indicated direction before it is invalidated by the token distribution unit.

One or more non-transitory computer-accessible memory mediums that store program instructions executable by one or more processors to implement:

• an access control unit receiving a first one-way authentication token from a computer system of an entity to gain access to data of a first data resource, wherein the computer system of the entity and the first data resource are connected to a token distribution unit over respective secure channels, wherein the computer system of the entity and the first data resource are distributed over two or more locations and interconnected by unsecured channels, and wherein the first one-way authentication token is received over an unsecured channel between the computer system of the entity and the first data resource;
• a validation request unit sending the received first one-way authentication token to the token distribution unit and obtaining a request token in response;
• and
• a one-way authentication token obtaining unit sending the request token to the token distribution unit to obtain a one-way authentication token for a single access of the first data resource at a second data resource, wherein the request token is transmitted only between the first data resource and the token distribution unit, wherein the one-way authentication token for a single access of the first data resource at the second data resource travels directly from the token distribution unit to the computer system of the entity, from the computer system of the entity to the first data resource, and from the first data resource back to the token distribution unit only once and in the indicated direction before it is invalidated by the token distribution unit.

One or more non-transitory computer-accessible memory mediums that store program instructions executable by one or more processors of a first data resource to implement:

• receiving a one-way authentication token from a computer system of an entity to gain access to data of the first data resource, wherein the computer system of the entity and the first data resource are connected to a token distribution unit over respective secure channels, wherein the computer system of the entity and the first data resource are distributed over two or more locations and interconnected by unsecured channels, and wherein the one-way authentication token is received over an unsecured channel between the computer system of the entity and the first data resource;
• sending the received one-way authentication token to the token distribution unit and obtaining a request token in response;
• and
• sending the request token to the token distribution unit to obtain a one-way authentication token for a single access of the first data resource at a second data resource, wherein the request token is transmitted only between the first data resource and the token distribution unit, wherein the one-way authentication token for a single access of the first data resource at the second data resource travels directly from the token distribution unit to the computer system of the entity, from the computer system of the entity to the first data resource, and from the first data resource back to the token distribution unit only once and in the indicated direction before it is invalidated by the token distribution unit.