Patent ID: 7904946

Claim:
A method for secure user authentication using a one-time password, comprising: storing a portion of a secret unique to the user for generating a client-side version of a correct one-time password value on a first client-side computing device responsive to receiving entry of a user's correct PIN value, said client-side version of the correct one-time password value being based at least in part on the entered PIN value and at least in part on both a client-side time incrementor and a client-side event incrementor, wherein the portion of the secret unique to the user stored on the first client-side computing device excludes the user's correct PIN value on which generation of the client-side version of the correct one-time password value is based at least in part and wherein a putative one-time password value is always generated in response to entry of any purported PIN value of the user on the first client-side computing device; storing the complete secret unique to the user for a cryptographic calculation of a server-side version of the correct one-time password value for the user on a server computer, wherein the complete secret unique to the user stored on the server computer comprises the user's correct PIN value and an algorithm for calculating the server-side version of the correct one-time password value based at least in part on the user's correct PIN value and at least in part on both a server-side time incrementor and a server-side event incrementor that are synchronized, respectively, with the client-side time incrementor and the client-side event incrementor; receiving entry on the first client-side computing device of a purported PIN value of the user; dynamically synthesizing a putative one-time password value on the first client-side computing device based at least in part on the purported PIN value of the user, the portion of the secret unique to the user stored on the first client-side computing device that excludes the user's correct PIN value, and both the client-side time incrementor and the client-side event incrementor; receiving entry of the putative one-time password by the server computer during a login attempt from a second client-side computer; cryptographically calculating the server-side version of the correct one-time password value by the server computer based at least in part on the complete secret unique to the user and on both the time incrementor and the event incrementor in response to receiving entry of the putative one-time password value; and allowing the login when the putative one-time password corresponds to the cryptographically calculated server-side version of the correct one-time password value.