Method and system for single signon for multiple remote sites of a computer network

A method for linking a first network server with a second network server, the method comprising:

• receiving a link request at the second network server, wherein the link request includes:
• information for locating a resource of the second network server;
• a first username for accessing the first network server;
• a second username for accessing the second network server, wherein the second username of the link request is determined from a mapping of valid usernames for the first network server to usernames for the second network server;
• and
• an encrypted component, wherein the encrypted component is formed by applying an encryption process to encrypt information including the first username, the second username and a secret known to each of the first network server and the second network server;
• and
• authenticating the link request, including:
• generating an encryption result by encrypting information including the first username and the second username of the received link request using the encryption process and the secret;
• comparing the encryption result with the encrypted component of the received link request;
• and
• logging the user in to the second network based on the result of comparing the encryption result with the encrypted component of the link request.

A method for redirecting a remote user computer to a second restricted access network resource so that the user of the remote user computer is automatically authenticated on the second network resource, wherein the remote user computer is in communication with a first restricted access network resource and a user of the remote user computer has been authenticated on the first restricted access network resource using a first username and a first password, the method comprising:

• receiving a request from the remote user computer to the first network resource to access the second network resource;
• using the authenticated first username to determine an associated second username that is a valid username for the second network resource;
• generating a link request having a plaintext component including information for locating the second network resource, the first username and the second username and an encrypted component formed by applying an encryption process to encrypt information including the first username, the second username and a secret known to the first network resource and the second network resource;
• returning the link request to the remote user computer;
• and
• redirecting the remote user computer to the second network resource, including communicating authentication information to the remote user computer and removing visible signs of the authentication information from a redirect URL.

A method for automatically authenticating a remote user on a second restricted access network resource wherein the user has a second username, the method comprising the steps of:

• accepting an incoming link request from a remote user computer, wherein the-a remote user computer is in communication with a first restricted access network resource using a first username that has been authenticated on the first network resource using a first password and wherein the link request has a plaintext component including information for locating the second network resource, the first username and the second username and an encrypted component formed by applying an encryption process to encrypt information including the first username and the second username using a secret known to the first network resource and the second network resource;
• generating an encryption result by applying the encryption process to the first username and the second username using the secret;
• comparing the encryption result with the encrypted component of the incoming link request to determine whether the link request is valid;
• determining whether the second network resource has a known translation of the first username and the second username;
• and
• initiating a registration process for registering the user with the second network resource if there is not a known translation of the first username and the second username.