Patent ID: 8776199

Claim:
A method of authentication between a client and a server including a shared secret, said client and server being coupled to a data communication network, said client including a computer system having a client display and a user interface selection device, the method comprising: delivering a plurality of data to the client for rendering on the client display; selecting, in response to a user accessing the client, at least two pieces of data from the delivered plurality of data via the user interface selection device; associating the selected two pieces of data with an authentication token as the shared secret; delivering, by the server, configuration data to the client by writing a cookie that contains a user identifier and an encrypted random number to a subdirectory off the web root, wherein the cookie is sent in response to a request to the subdirectory off the web root; maintaining, by the server, an association between the authentication token and the configuration data; receiving, at the server, a request from the client for content via the user interface selection device, the request comprising the configuration data associated with the authentication token; obtaining, from a memory area accessible to the server, the authentication token associated with the received configuration data in response to the received request; storing, at the server, the authentication token in a file conforming to a predetermined data size; modifying the requested content to include the obtained authentication token; and delivering the requested content to the client with the file as the shared secret, wherein the client authenticates the server with the authentication token.