Patent ID: 7296149

Claim:
A method of performing user and data authentication over a client ( 22 ) in communication via a first network ( 14 ) with a server infrastructure ( 16 ), the client ( 22 ) having access via a user-controllable card reader ( 24 ) to a smart card ( 26 ) on which confidential user data comprising at least one signature key (K PRIV — AUT — CLIENT , K PRIV — SIG — CLIENT ) is stored, the method comprising the steps of: performing a user authentication step, the user authentication step including displaying by the card reader ( 24 ) an authentication context, controlling the card reader ( 24 ) to request the user for signature approval before permitting access to the smart card and to prevent access to the confidential user data on the smart card until signature approval is received, and, in the case of signature approval, submitting a challenge, if appropriate together with context data, or data derived therefrom, to the smart card ( 26 ) for signing; performing a data authentication step, the data authentication step including displaying by the card reader ( 24 ) the data to be authenticated, controlling the card reader ( 24 ) to request the user for signature approval, and, in the case of signature approval, submitting the data to be authenticated, or data derived therefrom, to the smart card ( 26 ) for signing.