Patent ID: 8650625
Filing Date: 2014-02-11
Classification: H04L

Abstract:
1. A method for allowing a user to securely log on to a host system via an electronic interface, comprising: receiving, at a processor of an application server computer, a user's personal identification number (PIN) encrypted with a symmetric key and the symmetric key and a replay prevention ID encrypted with a public key of a public/private key pair of the application server computer from a browser application on a user's computing device via a processor of a web server computer, said symmetric key-encrypted user's PIN and public key-encrypted symmetric key and replay prevention ID being encrypted and digitally signed within a single sign-on token; decrypting, using the processor of the application server computer, the single sign-on token and passing, using the processor of the application server computer, the symmetric key-encrypted user's PIN and the public key-encrypted symmetric key and replay prevention ID into a tamper-proof physical hardware security module of the application server computer; decrypting, using a microprocessor of the tamper-proof physical hardware security module, internally within the tamper-proof physical hardware security module, the public key-encrypted symmetric key and replay prevention ID with the private key of the public/private key pair, and decrypting, using the microprocessor of the tamper-proof physical hardware security module, internally within the tamper-proof physical hardware security module, the symmetric key-encrypted user's PIN with the decrypted symmetric key; re-encrypting, using the microprocessor of the tamper-proof physical hardware security module, internally within the tamper-proof physical hardware security module, the decrypted user's PIN with a new symmetric key, and passing, using the microprocessor of the tamper-proof physical hardware security module, the re-encrypted user's PIN and decrypted replay prevention ID out of the tamper-proof physical hardware security module; sending, using the processor of the application server computer, the re-encrypted user's PIN to a processor of an authentication server computer for verification; and decrypting, using the processor of the authentication server computer, the re-encrypted user's PIN with the new symmetric key, and verifying, using the processor of the authentication server computer, the decrypted user's PIN.