System and method for authenticating the legitimacy of a request for a resource by a user

An authentication server operably coupled to an electronic communications network,

• said authentication server forming part of an authentication system for authenticating the legitimacy of a request for a resource by a user,
• said authentication system including one or more resource provider servers, arranged to receive a user request message from a user, said user request message comprising a user verified message and a resource identifier that identifies the resource being requested, and said one or more resource provider servers operable to create a resource provider message by at least adding a resource identifier to the user request message and forward the resource provider message to the authentication server,
• said user verified message comprising a structured user message including a user identifier and said resource identifier and a digital signature created using a signing key held by the user,
• said user verified message having been created in part by encrypting the structured user message and at least partially composed of a verification string derived from at least part of the structured user message,
• said authentication server being operable to receive and de-assemble said resource provider message as an input, and arranged to confirm said verification string accords with a well-formed structured user message according to a predetermined criteria,
• said authentication server being operable to decrypt the user verified message to yield the structured user message and verifying the digital signature of the structured user message,
• said authentication server being arranged to determine whether the resource identifier in the structured user message is equal or equivalent to the identified resource in the resource provider message,
• said authentication server being operable to determine whether the user identifier in the structured user message is a valid user identifier,
• said authentication server being operable to generate an authentication result including a result indicator as to the legitimacy of the resource provider message based on the result of confirming and determining, and
• said authentication server having a communications means to receive a resource provider message, and return an authentication result determined.

A non-transitory computer readable medium encoded with processing instructions which when executed using one or more processors cause performing a method of authenticating the legitimacy of a request for a resource by a user, in an electronic communication system, after the following predetermined steps have occurred:

• a structured user message having been created, said structured user message including a resource identifier to identify the resource, and a user identifier to identify the user that is requesting the resource and a digital signature having been created using a signing key held by the user;
• a user verified message having been created in part by encrypting the structured user message, said user verified message at least partially comprising a verification string derived from at least part of the structured user message,
• a user request message having been assembled, said user request message including the user verified message, and the resource identifier to identify the resource being requested of the resource provider,
• the user request message having been sent to a resource provider,
• a process having been run by the resource provider receiving the user request message to create a resource provider message by at least adding a resource identifier to the user request message,
• said method including the steps of:
• receiving and de-assembling the resource provider message,
• confirming the integrity of the user request message by checking the verification string accords with a well-formed structured user message,
• decrypting the user verified message to yield the structured user message and verifying the digital signature of the structured message,
• creating a result indicator as to the legitimacy of the resource provider message by performing two or more authenticity checks, including a first authenticity check that the resource identifier in the structured user message is equal or equivalent to the identified resource in the resource provider message, and a second authenticity check that the user identifier in the structured user message is correlated with a known and valid user, and
• sending an authentication result including said result indicator.