1. A token distribution unit comprising one or more processors and one or more memories, wherein the one or more memories comprise program instructions which are executable by the one or more processors to implement: a request token issue unit issuing a first request token to a computer system of an entity in response to receiving authentication information from the computer system of the entity, wherein the computer system of the entity, a first data resource, and a second data resource are connected to the token distribution unit over respective secured channels, wherein the computer system of the entity, the first data resource, and the second data resource are distributed over separate local or remote locations and interconnected by unsecured channels, wherein the first request token is issued over the secured channel between the computer system of the entity and the token distribution unit, and wherein the first request token is transmitted only over the secured channel between the computer system of the entity and the token distribution unit; a one-way authentication token issue unit issuing a first one-way authentication token to the computer system of the entity in response to receiving the first request token from the computer system of the entity; a validation unit validating the first one-way authentication token received from the first data resource; and an invalidation unit invalidating the first one-way authentication token issued by the authentication token issue unit and received with a validation request from the first data resource, wherein the first one-way authentication token travels directly from the token distribution unit to the computer system of the entity, from the computer system of the entity to the first data resource and from the first data resource back to the token distribution unit only once and in the indicated direction, before being invalidated by the token distribution unit; wherein the request token issue unit issues a second request token to the first data resource over the secured channel between the first data resource and the token distribution unit when the validation unit has successfully validated the first one-way authentication token for the first data resource, wherein the second request token is transmitted only over the secured channel between the first data resource and the token distribution unit, and wherein the second request token is used by the first data resource to obtain a second one-way authentication token from the authentication token issue unit for a single access of the first data resource at the second data resource.