Personalized, server-specific authentication mechanism

A user computer system comprising a processor, a memory with program instructions and a communication interface, an execution of the program instructions by the processor causing the user computer system to execute a method for implementing an authentication mechanism, the authentication mechanism providing a personalized, server-specific authentication of a user with respect to a service server using an authentication token,

• the method comprising:
• calling up a registration web page provided by the service server for registering the user with the service server through the user computer system via a network using a browser application, in the course of the calling up the registration web page, a first encrypted communication channel being set up between the user computer system and the service server, the user computer system authenticating the service server in the course of the setting up of the first encrypted communication channel using a service server certificate, registering the user comprising creating a personalized user account for the user through the service server,
• setting up a parallel second encrypted communication channel between the user computer system and the service server, in the course of the setting up of the second encrypted communication channel, a mutual authenticating of user and service server taking place using a user certificate and the service server certificate,
• receiving a first request from the service server by the user computer system for providing the user's personalization data for personalizing the user account,
• initiating a read-out of the personalization data to be provided by the user computer system from an electronic personalization data source, a read-out of the personalization data to be provided requiring successful authentication of the user with respect to the personalization data source,
• forwarding the personalization data read out from the personalization data source by the user computer system to the service server via the second encrypted communication channel,
• forwarding of a proof of authorization of the user to use the personalization data as his own personalization data by the user computer system to the service server via the second encrypted communication channel,
• receiving a second request from the service server by the user computer system using the browser application via the first encrypted communication channel for providing a server-specific authenticating key for a future authenticating of the user of the personalized user account, the second request comprising a first challenge,
• forwarding the first challenge from the user computer system to an authentication token of the user,
• receiving, by the user computer system, a first response to the first challenge together with a server-specific authenticating key for the service server, the server-specific authenticating key in the form of a public cryptographic key of an asymmetric cryptographic key pair generated from the authentication token using a unique service-server attribute, the first response created from the authentication token, the first response comprising a signature of the first challenge with a server-specific authentication key associated with the authenticating key in the form of a private cryptographic key of the generated asymmetric cryptographic key pair, creating the first response requiring successful authenticating of the user with respect to the authentication token,
• forwarding, by the user computer system using the browser application via the first encrypted communication channel, the first response and the server-specific authenticating key to the service server for storing the server-specific authenticating key in connection with the personalized user account of the user, the first response serving as proof that the user has the server-specific authentication key associated with the authenticating key, the stored authenticating key enabling the service server to verify a validity of a second response provided by the user as proof of authentication with a second signature of a second challenge from the service server in the course of future user authenticatings, which was created using the server-specific authentication key and assigned to the user's personalized user account.