Patent ID: 8296568

Claim:
A method for authenticating an electronic request between a client computer and a transaction server, the method comprising: (A) receiving, at a suitably programmed application server, an electronic application request for an application from the client computer, wherein the electronic request comprises an identity of a user originating the electronic request; (B) constructing, by the suitably programmed application server and responsive to receiving the electronic application request, a signing key as a first function of a first plurality of parameters, wherein the first plurality of parameters comprises; (i) the identity of the user originating the electronic request for the application, (ii) a first time based salt value, and (iii) a secret that is shared between the suitably programmed application server and the transaction server; (C) embedding, by the suitably programmed application server, the signing key in an unbranded version of the application thereby forming a branded version of the application, wherein the branded version of the application is configured to (i) sign a request with the signing key thereby forming a signed request, and (ii) submit the signed request to the transaction server with the identity of the user and the identifier that identifies the distributor or developer of the application; (D) receiving, by the transaction server and from the client computer, a signed request, the signed request comprising a signature based upon the signing key embedded in the branded application; (E) forming, by the transaction server, a reconstructed signing key, wherein the transaction server is suitably programmed to perform the forming, wherein the forming comprises applying a second function to a second plurality of parameters, and wherein the second plurality of parameters comprises: (i) the identity of the user making the request, (ii) a second time based salt value, and (iii) the secret that is shared between the suitably programmed application server and the transaction server; (F) forming, by the transaction server, a signature from the reconstructed signing key; and (G) assessing, by the transaction server, the signed request wherein the assessing: (i) achieves a verified state when the signature formed from the reconstructed signing key matches the signature transaction request, or (ii) achieves a failed state when the signature formed from the reconstructed signing key does not match the signature in the transaction request.