Methods and systems for secure authentication of a user by a host system

A method for allowing a user to securely log on to a host system via an electronic interface, comprising:

• receiving, at a processor of an application server computer, a user's credentials encrypted with a symmetric key and the symmetric key and a replay prevention ID encrypted with a public key of a public/private key pair of the application server computer from a browser application on a user's computing device via a processor of a web server computer, and passing, using the processor of the application server computer, the symmetric key-encrypted user's credentials and the public key-encrypted symmetric key and replay prevention ID into a tamper-proof physical hardware security module of the application server computer;
• decrypting, using a microprocessor of the tamper-proof physical hardware security module, internally within the tamper-proof physical hardware security module, the public key-encrypted symmetric key and replay prevention ID with the private key of the public/private key pair, and decrypting, using the microprocessor of the tamper-proof physical hardware security module, internally within the tamper-proof physical hardware security module, the symmetric key-encrypted user's credentials with the decrypted symmetric key;
• re-encrypting, using the microprocessor of the tamper-proof physical hardware security module, internally within the tamper-proof physical hardware security module, the decrypted user's credentials with a new symmetric key, and passing, using the microprocessor of the tamper-proof physical hardware security module, the re-encrypted user's credentials and decrypted replay prevention ID out of the tamper-proof physical hardware security module;
• sending, using the processor of the application server computer, the re-encrypted user's credentials to a processor of an authentication server computer for verification;
• and
• decrypting, using the processor of the authentication server computer, the re-encrypted user's credentials with the new symmetric key, and verifying, using the processor of the authentication server computer, the decrypted user's credentials.