Patent ID: 7760882

Claim:
A method comprising: receiving, at an authentication server, a communication from a client, the communication having been sent wirelessly from the client to an access point and from the access point to the authentication server, the communication associated with a credential, the credential having a user identifier and a first token; determining, at the authentication server, a second token associated with the user identifier, wherein the second token is independently stored on the client such that the second token is not transmitted between the client and authentication server but is available on both the client and the authentication server; generating, at the authentication server, an encryption key based at least in part on the second token, wherein the encryption key is not transmitted between the client and authentication server but is available on both the client and authentication server since each can generate the encryption key using the second token; receiving, at the authentication server, an authentication message from the client, wherein the authentication message was encrypted at the client using the encryption key, wherein the encryption key was generated at the client using the second token; decrypting, at the authentication server, the authentication message using the encryption key, wherein the authentication message encrypted using the encryption key allows the authentication server to authenticate the client; and transmitting, from the authentication server to the client, an authentication reply encrypted using the encryption key, wherein the authentication reply encrypted using the encryption key allows the client to authenticate the authentication server.