Patent ID: 7895437

Claim:
An article of manufacture for establishing credentials useable to authenticate a user of a communications network using split key asymmetric cryptography, comprising: processor readable storage media; and logic stored on the storage media, wherein the stored logic is configured to be readable by one or more processors associated with an authenticating entity, and thereby cause the one or more processors to operate so as to: receive a first value from the user via the network; generate a first key portion based on the received first value and a second value unknown to the user; split one of a private key and a public key of a user asymmetric crypto-key into the first key portion and a second key portion; store the second key portion of the one key of the user asymmetric crypto-key so as to be accessible only to the authenticating entity; generate a cookie including the second value; transmit the generated cookie to the user; destroy the received first value, the second value, the one key of the user asymmetric crypto-key and the first key portion of the one key of the user asymmetric crypto-key wherein after transmission of the generated cookie and destruction, neither the first value, nor the second value, nor the first key portion of the one key of the user asymmetric crypto-key, nor the one key of the user asymmetric crypto-key is accessible to the authenticating entity, and neither the first key portion of the one key of the user asymmetric crypto-key nor the one key of the user asymmetric crypto-key is accessible to the user; subsequently receive the first value, representing a first user credential, and the second value included in the transmitted cookie, representing a second user credential, from the user; and authenticate the user based on the subsequently received first and second values.