Patent ID: 8302172
Filing Date: 2012-10-30
Classification: H04L

Abstract:
1. A method for allowing a user to securely log on to a host system via an electronic interface, comprising: receiving, at a processor of an application server computer, a user's credentials encrypted with a symmetric key and the symmetric key and a replay prevention ID encrypted with a public key of a public/private key pair of the application server computer from a browser application on a user's computing device via a processor of a web server computer, and passing, using the processor of the application server computer, the symmetric key-encrypted user's credentials and the public key-encrypted symmetric key and replay prevention ID into a tamper-proof physical hardware security module of the application server computer; decrypting, using a microprocessor of the tamper-proof physical hardware security module, internally within the tamper-proof physical hardware security module, the public key-encrypted symmetric key and replay prevention ID with the private key of the public/private key pair, and decrypting, using the microprocessor of the tamper-proof physical hardware security module, internally within the tamper-proof physical hardware security module, the symmetric key-encrypted user's credentials with the decrypted symmetric key; re-encrypting, using the microprocessor of the tamper-proof physical hardware security module, internally within the tamper-proof physical hardware security module, the decrypted user's credentials with a new symmetric key, and passing, using the microprocessor of the tamper-proof physical hardware security module, the re-encrypted user's credentials and decrypted replay prevention ID out of the tamper-proof physical hardware security module; sending, using the processor of the application server computer, the re-encrypted user's credentials to a processor of an authentication server computer for verification; and decrypting, using the processor of the authentication server computer, the re-encrypted user's credentials with the new symmetric key, and verifying, using the processor of the authentication server computer, the decrypted user's credentials.