Patent ID: 8132243

Claim:
A method for handling a session one-time-password (“OTP”) transmission with an OTP token, the OTP token in communication with a server and a client workstation via a network, the method comprising: an OTP token opening, with an embedded security browser at the OTP token, a secure session between the OTP token and a server; receiving, at the OTP token, after opening the secure session, server information that at least partially identifies the server, wherein the server information is received from the server; determining whether the server is legitimate based on the received server information; in response to determining that the server is legitimate: transmitting, from the OTP token, data of an internally-generated OTP; and initiating, with the OTP token, a client-server session with the server; and in response to determining that the server is not legitimate: refraining from transmitting, from the OTP token, data of an internally-generated OTP.