Patent ID: 8776176

Claim:
A computer controlled method for mutually authenticating a first computer and a second computer over a network, the computer controlled method comprising: sending first authentication evidence by said first computer to said second computer, said first authentication evidence used to prove to said second computer that said first computer has access to a first plurality of authentication secrets without exposing said first plurality of authentication secrets, wherein said first authentication evidence comprises a shielded ephemeral public key (m) that is generated using an ephemeral public DH key (X), a hash τ, and a hash γ, in accordance with m=X·γ·τ, wherein τ is computed using a hash of an account identifier (C), an identifier for the first computer (S), and a short-term password (re C,S ), and wherein γ is computed using a hash of C, S, and a long-term password (pw C,S ; and sending second authentication evidence by said second computer to said first computer, said second authentication evidence used to prove to said first computer that said second computer has access to a second plurality of authentication secrets without exposing said second plurality of authentication secrets, said first plurality of authentication secrets related to said second plurality of authentication secrets, whereby said first computer is authenticated to said second computer and said second computer is authenticated to said first computer.