Protected authorization for untrusted clients

A computer readable device comprising computer executable instructions that, when executed via a processing unit, perform a method, comprising:

• responsive to sending a request to validate a client to a validation server, receiving a signed genuine ticket with a public key based upon validation of the client from the validation server;
• responsive to sending a request to consume data or one or more services to a service provider server, receiving a session ID from the service provider server, the service provider server different than the validation server, the client different than the service provider server and the validation server;
• signing the session ID with at least one of a client signature using a private key or a lockbox signature using a licensing service lockbox private key to create a signed session ID;
• sending to the service provider server an authorization response comprising the signed genuine ticket and the signed session ID;
• and
• receiving an authorization from the service provider server based upon the service provider server authorizing the signed genuine ticket.

A system, comprising:

• one or more processing units;
• and
• memory comprising instructions that when executed by at least one of the one or more processing units perform operations, comprising:
• maintaining a private key and a signed genuine ticket based upon validation of a client from a validation server, the signed genuine ticket comprising a validation server signature of the validation server but not a signature of the client, the validation server signature indicating that the validation server validated the client;
• receiving a session ID from a service provider server;
• signing the session ID with at least one of a client signature using the private key or a lockbox signature using a licensing service lockbox private key to create a signed session ID;
• sending to the service provider server an authorization response comprising the signed session ID and the signed genuine ticket;
• receiving an authorization from the service provider server based upon the service provider server authorizing at least one of the client signature, the lockbox signature, the signed session ID, or the signed genuine ticket;
• receiving a second session ID from the service provider server;
• signing the second session ID to create a signed second session ID;
• sending to the service provider server a second authorization response comprising the signed second session ID and the signed genuine ticket;
• and
• receiving a second authorization from the service provider server.