Patent ID: 8627088

Claim:
An interactive, computer implemented method for execution by server-side computer resources in a client-server system to authenticate a server to a user at a client platform, comprising: storing data defining a graphical representation of a frame of reference adapted for rendering on a display, the frame of reference including a number of pre-defined locations in the frame of reference having coordinates on the frame of reference; storing a data set associated with the user in a memory accessible using server-side computer resources, the data set including at least a first shared secret identifying a server path, the server path including a plurality of the pre-defined locations on the frame of reference; receiving via data communication, a user identifier from the client platform and initiating a current session; presenting via data communications to the client platform a current session instance of the graphical representation of the frame of reference for the current session, the current session instance having characters in the number of pre-defined locations according to a pattern different than used in other sessions with the client; sharing between the client platform and the server a challenge for use in the current session identifying a random subset of the plurality of the pre-defined locations in the server path; and sharing between the client platform and the server a response distinct from the challenge including characters that match the characters positioned in the random subset of the plurality of the pre-defined locations in the server path, wherein the response for use in the current session is produced by the server and delivered to the client platform; whereby the user at the client platform is capable of verifying that the server has access to the first shared secret identifying the server path.