Patent ID: 8261087

Claim:
A method of authenticating a user with respect to a web server in the context of a web browsing session, the user operating a personal computer connected to the internet and communicating with said web server by means of a web browser capable of managing and storing cookies, which method provides greater security than the use of easily memorized passwords without requiring the user to maintain a physical object comprising: storing a cookie in the personal computer, the cookie including an authentication key, the authentication key stored in the cookie in an encrypted form, encrypted under a key dependent on a password known only to the user, the authentication key also known to the web server and associated in the web server with the user; the browser receiving from the web server a web page containing an embedded applet in response to an access request directed to the web page, the applet embedded in the web page requiring the user to enter the password and verifying the presence of the cookie on the personal computer; the applet, if said cookie is present, decrypting, using the password, the encrypted authentication key stored in the cookie, and employing the decrypted authentication key for authenticating the user to the server and/or signing data transmitted to the server; wherein the applet, if said cookie is not present, requests that the user enter a migration secret known to both the user and the web server, uses the migration secret to obtain from the web server the authentication key associated with the user, and stores the obtained authentication key in the cookie on the personal computer encrypted using the password.