Patent ID: 8756674

Claim:
A method of authenticating a network client to a relying party computer via a computer server, the network client being configured to communicate with the relying party computer and the computer server, the network client being further configured to communicate with a token manager, the token manager being configured to communicate with a hardware token interfaced with the token manager, the method comprising: the computer server receiving via a first communications channel a transaction code from the token manager, and receiving a transaction pointer from the relying party computer via a second communications channel distinct from the first communications channel, the transaction pointer being based on the transaction code and unpredictable by the computer server prior to receiving the transaction code; the computer server transmitting a session token to the token manager, wherein the token manager is configured with a digital certificate associated with the token manager; the computer server receiving a credential from the token manager; and the computer server transmitting an authorization signal to the relying party computer in accordance with a correlation between the transaction code and the transaction pointer, the transmitting an authorization signal comprising the computer server determining a correlation between the transmitted session token and the credential, and transmitting the authorization signal in accordance with an outcome of the session token correlation, the determining the correlation between the transmitted session token and the credential comprises the computer server verifying that the credential was generated from the digital certificate and is associated with the computer server, the authorization signal facilitating authentication of the network client to the relying party computer.