| CPC G06Q 20/401 (2013.01) [G06Q 20/3829 (2013.01); G06Q 20/385 (2013.01); H04L 9/30 (2013.01); H04L 63/083 (2013.01); H04L 63/0853 (2013.01)] | 18 Claims |

|
1. An authentication server comprising a non-transitory memory for storing machine instructions that are to be executed by a processor, the machine instructions when executed implement the following instructions:
registering a web-based application server for secure transacting using a merchant ID;
receiving a client account identifier from an issuing bank;
providing a token software for download by a client device from an implementer of the authentication server, the token software operating from a secure element on the client device wherein the client account identifier is stored for the token software
connecting with the client device through a secure connection between the client device and the authentication server to authenticate the client device over the secure connection such that the web-based application server is not an intermediary between the client device and the authentication server, and the secure connection is formed with the client device upon the token software on the client device automatically initiating the secure connection, upon actuation of the token software by a user for a payment transaction, with unique connection information for the authentication server included in the token software;
receiving a token output representative of the client account identifier and authentication-enabling data from the token software on the client device over the secure connection;
authenticating the client device by comparing the token output representative of the client account identifier and authentication-enabling data received from the token software on the client device with information and authentication-enabling data stored in the authentication server;
authenticating the web-based application server with the merchant ID and merchant information stored by the authentication server during registration; and
executing a secure transaction between the client device and the web-based application server responsive to authentication of the client device and the web-based application server.
|