Patent ID: 8438384

Claim:
A computer-implemented method for performing mutual authentication between a handheld device and a server, the method comprising: verifying a username and a password of the handheld device by the server, and reading an identifier of the handheld device from a second storage device of the server upon the condition that the username and the password of the handheld device are correct; generating an encrypted authentication token and a second encrypted identifier of the server by encrypting an authentication token and an identifier of the server, and sending the encrypted authentication token and the second encrypted identifier of the server to the handheld device; receiving an encrypted identifier of the handheld device from the handheld device upon the condition that the handheld device determines that the second encrypted identifier of the server is correct; generating a decrypted identifier of the handheld device by decrypting the encrypted identifier of the handheld device with the authentication token of the server; and determining if the decrypted identifier of the handheld device is correct according to the identifier of the handheld device stored in the second storage device, and allocating an access authority to the handheld device upon the condition that the decrypted identifier of the handheld device is correct.