Patent ID: 8327422

Claim:
A method of supporting authentication of a server device, the method comprising: supplying a user device with a user mechanism which is constructed and arranged to dynamically generate user representations; receiving, at the server device, a request from the user device; and providing a server representation to the user device from the server device in response to the request, the server device being successfully authenticated to a user of the user device when a user representation dynamically generated by the user mechanism matches the server representation provided to the user device, and the server device not being successfully authenticated to the user of the user device when the user representation dynamically generated by the user mechanism does not match the server representation provided to the user device; wherein providing the server representation to the user device includes: obtaining a server password from a server one-time password (OTP) circuit, the server password being based on a particular secret and current time, and the server OTP circuit being constructed and arranged to provide a series of server passwords over a series of predefined time windows, generating the server representation based on the server password obtained from the server OTP circuit, and sending the server representation to the user device; wherein the server OTP circuit is synchronized with a user OTP circuit at the user mechanism so that the server representation matches the user representation when the user representation is generated by the user OTP circuit based on the particular secret and the same current time; wherein the user device has a public key and the server device has a private key, the public key and the private key forming a secure encryption/decryption key pair enabling the server device to securely decrypt encrypted messages sent from the user device over a public network; and wherein generating the server representation based on the server password obtained from the server OTP circuit includes (i) obtaining an encryption result from encrypting the server password using the public key and (ii) deriving the server representation based on the encryption result.