Authentication of data communications

A method for authenticating communication between a user computer and a server via a data communications network, the method comprising:

• sending an authentication message via the data communications network to the user computer;
• producing an authentication output containing the authentication message;
• receiving the authentication output from the user computer;
• extracting the authentication message from the authentication output;
• sending the authentication message to the security device;
• generating an authentication response to the authentication message using security data stored in the security device;
• and
• sending the authentication response to the server via a communications channel which bypasses the user computer.

An intrusion detection method for a data communications system in which a security device having memory containing security data is adapted for data communications with a remote server via an interface device for communicating with the server via a first communications channel and is operative to communicate with the server via at least one further communications channel, the method comprising:

• sending an authentication message from the server to the security device using said first and said at lease one further channels in respective authentication communications;
• sending an authentication response generated from the security data by the security device to the server for mutual authentication thereof;
• detecting differences between authentication results from said communications using said first and said at lease one further channels;
• and
• identifying potentially compromised components of said data communications system based on said differences.

A data communications system, comprising:

• a server;
• a first interface device operative to communicating data with the server via a first communications channel of the system;
• a security device having memory containing security data operative to communicate with the server via the first interface device and operative to communicate with the server via at least one further communications channel of the system;
• and
• intrusion detection logic;
• wherein the server and security device are operative to use said first and said at lease one further channels in authentication communications in which the server sends an authentication message to the security device and the security device sends an authentication response generated using said security data to the server for mutual authentication thereof;
• and
• wherein the intrusion detection logic is operative to detect differences between authentication results from said communications using said first and said at least one further channels and to identify potentially compromised components of the data communications system based on said differences.

An authentication apparatus for authenticating data communications with a remote server, the apparatus comprising:

• a security device having memory containing security data, and a security logic adapted to use the security data in authentication communications with the server to generate an authentication response to an authentication message received from the server;
• a first interface device adapted for data communications with the security device and adapted for data communications with the server via a first communications channel;
• at least one communications interface for communicating with the server via a second communications channel;
• and
• channel selection logic adapted to select one of said communications channels for authentication communications with the server in dependence on a security indicator associated with a communication from the server on the first communications channel, the channel selection logic being adapted to send said authentication response, generated by the security logic in said authentication communications, to the server via the selected communications channel.

A method for authenticating data communications with a remote server performed by a security device which has memory containing security data, the security device adapted for data communications with an interface device for communicating with the server via a first communications channel, and which is operative to communicate with the server via a second communications channel, the method comprising:

• selecting one of said first and second communications channels for authentication communications with the server in dependence on a security indicator associated with a communication from the server on the first communications channel;
• in response to an authentication message received from the server, using said security data to generate an authentication response;
• and
• sending the authentication response to the server via the selected communications channel.