Patent ID: 8060922

Claim:
A method of allowing a user to authenticate to a subscribing site using an authentication service provider while isolating information associated with the user from the authentication service provider, the subscribing site and authentication service provider being network nodes connected to a communications network, comprising: by the authentication service provider, maintaining an association between an authentication code source and information identifying the authentication code source, the authentication code source being an electronic device operative to generate authentication codes to be used when accessing services at the subscribing site, the authentication service provider maintaining no association for authentication purposes between the information identifying the authentication code source and any personal identifying information of the user; by the authentication service provider in response to an activation request from a subscribing site, the activation request including the information identifying the authentication code source, generating a service user identifier associated with (i) the authentication code source as identified by the information identifying the authentication code source in the activation request, and (ii) the subscribing site, and providing the service user identifier to the subscribing site over the communications network; by the subscribing site, creating an association of the service user identifier with the information associated with the user, and isolating the association within the subscribing site; by the subscribing site, receiving an authentication code generated by the authentication code source from the user; by the subscribing site, generating an authentication request and forwarding the authentication request to the authentication service provider over the communications network, the authentication request including the authentication code received from the user along with the service user identifier and information identifying the subscribing site; and by the authentication service provider, in response to receiving the authentication request from the subscribing site, (1) identifying the authentication code source using the service user identifier and the information identifying the subscribing site included in the authentication request, (2) generating an authentication decision for the authentication code included in the authentication request with respect to the identified authentication code source, and (3) providing the authentication decision to the subscribing site over the communications network, and further including delivering the authentication code source to the user, wherein delivering the authentication code source is performed by distributing the authentication code source unsolicited by both the user and the subscribing site.