Patent ID: 7296160

Claim:
A method of performing user authentication over a client in communication via a first network with a server infrastructure including an application server, the client having access via a user-controllable card reader to a smart card, the method comprising: providing a first authentication key (K PRIV — AUT — CLIENT ) stored on the smart card; providing a second authentication key (K READER ) stored in the card reader; performing a first user authentication step between the client and the server infrastructure using the first authentication key (K PRIV — AUT — CLIENT ), the first user authentication step comprising a communication from the server infrastructure to the client that is signed by the smart card using the first authentication key (K PRIV — AUT — CLIENT ), the first authentication step being performed over an established or in context with establishing an encrypted channel over the first network; and performing a second user authentication step between the client and the application server using both the first authentication key (K PRIV — AUT — CLIENT ) and the second authentication key (K READER ), the second user authentication step comprising a communication from the application server to the client that is signed by both the smart card using the first authentication key (K PRIV — AUT — CLIENT ) and also the card reader using the second authentication key (K READER ).