Patent ID: 8578467

Claim:
A method of authenticating a network client to a computer server, the network client being configured to communicate with the computer server over a network and to communicate with a token manager, the token manager being configured to receive data originating from a hardware token interfaced with the token manager, the method comprising: one of the token manager and the network client receiving a session token from the computer server; the one of the token manager and the network client generating a credential associated with the token manager, and transmitting the credential to the computer server, wherein the token manager is configured with a parent digital certificate associated with the token manager, the parent digital certificate comprising a public encryption key, and wherein the credential generating comprises: the one of the token manager and the network client generating the credential from the parent digital certificate; the one of the token manager and the network client generating a child digital certificate from the parent digital certificate and signing the child digital certificate with a private encryption key uniquely associated with the public encryption key, the private encryption key and the public encryption key comprising an asymmetric encryption key pair; and the one of the token manager and the network client incorporating the session token into the child digital certificate; and the network client receiving an authentication payload from the computer server in accordance with a validity of the credential and the data of the hardware token, the authentication payload facilitating authentication of the network client to the computer server.