Patent ID: 7194765

Claim:
A challenge-response based user-authentication method comprising the steps of: generating, at an authentication center, an expected response by a response function from a secret key and a random challenge; generating, at said authentication center, at least a masked expected response by a masking function in response to said expected response; transmitting at least said masked expected response and said random challenge to an intermediate party; transmitting said random challenge from the intermediate party to a user; generating, at said user, a response by said response function in response to said secret key and said random challenge; transmitting said user response to said intermediate party; generating, at said intermediate party, a masked user response by the same masking function as said authentication center in response to the received user response; and verifying, at said intermediate party, that said masked user response corresponds to said masked expected response; wherein the intermediate party manages authentication proof information, including at least the user response received from the user and corresponding user identification information, to enable the intermediate party to prove that the user has been authenticated; said intermediate party transmitting authentication proof information to the authentication center; and said authentication center verifying whether the user has been authenticated at the intermediate party based on the received proof information.