Patent ID: 8800013

Claim:
A method of operating an authentication provisioning unit for authenticating a user to a service provider, the method comprising: in a first stage of the method: a) receiving credentials from a user; b) determining whether the credentials received from the user represent a valid logon; and if that determination is positive, then c) generating at least one network address comprising a domain address and at least one instance parameter, the instance parameter uniquely identifying the user and the instance of generation of the network address; d) providing the network address to the user; e) receiving a parameter from a service provider; f) determining whether the received parameter indicates a valid attempt to log on to the service provider by checking that the received parameter matches an instance parameter that has previously been provided to a user and that has not previously been received from a service provider; and if that determination is positive, signalling to the service provider over a secure channel a message indicating that the received parameter represents a valid logon attempt, the message including credentials of the user to whom the instance parameter that matches the received parameter had been issued, wherein a positive determination at step (f) indicates that the parameter received from the service provider is based on the network address provided to the user, wherein the domain address is a single-use address of the service provider in order that the user is able to access the service provider by the domain address in the absence of redirection and confirm authentication by the instance parameter, and wherein the network address is provided to the user over a secure channel.