Methods and Systems for Secure Authentication of a User by a Host System

A method for allowing a user to securely log on to a host system via an electronic interface, comprising:

• receiving, at a processor of an application server computer, a user's credentials encrypted with a symmetric key and the symmetric key and a replay prevention ID encrypted with a public key of a public/private key pair of the application server computer from a browser application on a user's computing device via a processor of a web server computer, and passing, using the processor of the application server computer, the symmetric key-encrypted user's credentials and the public key-encrypted symmetric key and replay prevention ID into a tamper-proof physical hardware security module of the application server computer;
• decrypting, using a microprocessor of the tamper-proof physical hardware security module, internally within the tamper-proof physical hardware security module, the public key-encrypted symmetric key and replay prevention ID with the private key of the public/private key pair, and decrypting, using the microprocessor of the tamper-proof physical hardware security module, internally within the tamper-proof physical hardware security module, the symmetric key-encrypted user's credentials with the decrypted symmetric key;
• re-encrypting, using the microprocessor of the tamper-proof physical hardware security module, internally within the tamper-proof physical hardware security module, the decrypted user's credentials with a new symmetric key, and passing, using the microprocessor of the tamper-proof physical hardware security module, the re-encrypted user's credentials and decrypted replay prevention ID out of the tamper-proof physical hardware security module;
• sending, using the processor of the application server computer, the re-encrypted user's credentials to a processor of an authentication server computer for verification;
• and
• decrypting, using the processor of the authentication server computer, the re-encrypted user's credentials with the new symmetric key, and verifying, using the processor of the authentication server computer, the decrypted user's credentials.

A system for allowing a user to securely log on to a host system via an electronic interface, comprising:

• an application server computer having a processor coupled to memory, said application server computer processor being programmed for receiving a user's credentials encrypted with a symmetric key and the symmetric key and a replay prevention ID encrypted with a public key of a public/private key pair from a browser application on a user's computing device via a processor of a web server computer and for passing the symmetric key-encrypted user's credentials and public key-encrypted symmetric key and replay prevention ID into a tamper-proof physical hardware security module of the application server computer;
• the tamper-proof physical hardware security module having a microprocessor coupled to memory, said tamper-proof physical hardware security module microprocessor being programmed for:
• decrypting, internally within the tamper-proof physical hardware security module, the public key-encrypted symmetric key and replay prevention ID with the private key of the public/private key pair;
• decrypting, internally within the tamper-proof physical hardware security module, the symmetric key-encrypted user's credentials with the decrypted symmetric key;
• re-encrypting, internally within the tamper-proof physical hardware security module, the decrypted user's credentials with a new symmetric key;
• and
• passing the re-encrypted user's credentials and decrypted replay prevention ID out of the tamper-proof physical hardware security module of the application server computer;
• the application server computer processor being further programmed for sending the re-encrypted user's credentials to an authentication server computer for verification;
• and
• the authentication server computer having a processor coupled to memory, said authentication server computer processor being programmed for decrypting the re-encrypted user's credentials with the new symmetric key and for verifying the decrypted user's credentials.