System and method for anti-phishing authentication

Abstract

A method and system for providing security against phishing attacks. The method can include receiving a login ID from a client, and providing an encrypted commitment to the client. The method can also include receiving a one-time password (OTP) from the client, and validating the OTP. The method can also include sending a commitment key, to be authenticated by the client, receiving a static password from the client and authenticating the client. Embodiments of the invention are directed to a system for providing security against phishing attacks. The system can include one or more servers configured to receive a login ID from a client, and provide an encrypted commitment to the client. The processors can be configured to receive a one-time password (OTP) from the client, validate the OTP, send a commitment key, to be authenticated by the client, receive a static password from the client and authenticate the client.

Description

FIELD OF THE INVENTION

The present invention relates generally to computer security, and, more particularly, to systems and methods for providing security against phishing and other attacks.

BACKGROUND OF THE INVENTION

In computing, phishing is a form of social engineering, characterized by attempts to fraudulently acquire sensitive information, such as passwords and credit card details, by masquerading as a trustworthy person or business. The objective is to lure a user to connect and present authentication credentials to an illegitimate party who masquerades as another. Sometimes, the phisher fools the user by sending an apparently official electronic communication, such as an email or an instant message. The term phishing arises, in part, from the use of increasingly sophisticated lures to “fish” for users' financial information and passwords.

More recent phishing attempts have started to target the customers of banks and online payment services. While the first such examples were sent indiscriminately in the hope of finding a customer of a given bank or service, recent research has shown that phishers may in principle be able to establish what bank a potential victim has a relationship with, and then send an appropriate spoofed email to this victim. In general, such targeted versions of phishing have been termed spear phishing.

The damage caused by phishing ranges from loss of access to email to substantial financial loss. This style of identity theft is becoming more popular, because of the ease with which unsuspecting people often divulge to phishers personal information, including credit card numbers and social security numbers. Once this information is acquired, the phishers may use a person's personal information to create fake accounts in a victim's name, ruin a victim's credit, or even prevent victims from accessing their own accounts.

In one type of phishing attack, known as a man-in-the-middle attack, an attacker tricks a client into pointing his or her browser at the attacker's login page. In such scenarios, the attacker sends an e-mail message to the client, asking the client to login to a Web site posing as a legitimate corporate site. Next, the client logs into the attacker's site, thus divulging the client's authentication credentials. The attacker then uses the client's authentication credentials to login to the legitimate corporate site.

Some phishing vulnerabilities can be mitigated by use of a One-Time Password (OTP). Unlike a conventional password, an OTP has only a limited usefulness to an attacker. In a common scenario, a time-based OTP is only valid for a few minutes, such as that provided by RSA's SecurID® system, as is known to those skilled in the art. A secure server executes security software which validates a particular OTP. If a phisher discovers the value of the OTP, then the phisher cannot store the value for later reuse, because the OTP's usefulness quickly expires. Rather, the phisher must exploit the OTP immediately and launch an attack. Some OTP systems increase the difficulty of an attack by providing additional security controls which limit the acceptance of an OTP to a single use even within the limited validity period. However, the use of a OTP does not completely solve the Phishing issue. For example, an attacker may obtain use of an OTP a single time.

In a common man-in-the-middle scenario, an attacker relays an entire session between the client and the legitimate server. While in the middle, the attacker views the entire session, harvesting account numbers and possibly other important information. Upon acquiring this information, the attacker can potentially interact with the legitimate server directly. With reference to FIG. 1, there is shown an exemplary man-in-the-middle attack. FIG. 1 illustrates that the client 100 attempts to connect to a server 110. Unfortunately, a phisher 11 (acting in the role of man-in-the-middle) captures the entire session and thereby discovers confidential information. The phisher 11 opens a channel to the server 110 and simply copies everything that it receives from either the client 100 or the server 110 into its own unauthorized log 19. First, the client 100 mistakenly connects to the phisher 11 and sends authentication credentials 10. The server copies the message that it receives into the unauthorized log 19, and forwards an exact copy of the message to the server 110 in message 12. The server 110 authenticates and responds 14. The phisher 11 copies the response into the unauthorized log 19, and returns the response 13 to the client 100. The client subsequently interacts 15, and the phisher 11 captures all information and copies into the unauthorized log 19, and forwards the interactions 16 to the server 110. The server 110 also sends interaction responses 16 which the phisher 11 copies to the unauthorized log 19 and returns the interactions 15 to the client 110. Eventually, the client 100 finishes the interaction and logs out 17, and the phisher copies the logout message to the unauthorized log 19 and sends the logout 18 to the server 110. The final result of the session is that the client performed all work as intended without detecting any attack. The phishers, however, has captured all information transmitted in the session and stored that information in an unauthorized log 19.

Thus, there is a need for an improved system and method for providing security against phishing attacks. Embodiments of the invention serve to protect against attacks such as that described above with respect to the description of FIG. 1.

Two-factor authentication is a means by which a peer may authenticate to another party by presenting two or more of the following: something the user knows, e.g., a password; something the user has, e.g., physical possession of an authentication device; and something the user is, e.g., a thumb print. Three-factor authentication is a means which requires an additional factor beyond two-factor authentication such as a biometric.

Two-factor authentication, however, typically employs a conventional password coupled with a stronger form of authentication, such as, for example, a OTP on a token. In such an arrangement, the purpose of the password is to protect the authentication mechanism in the case that the user loses the stronger authentication factor (e.g., if the user loses an OTP token), and then the password protects against the possibility of usage by the attacker.

The factors in a multiple-factor authentication may be either static or dynamic as follows: a static credential factor, otherwise called a static credential, remains constant until the owner of the static credential explicitly participates in an event which changes the credential in a meaningful way. For example, a password is a static credential. If the user wishes to change the password, the user must explicitly initiate the change password process.

A dynamic factor, otherwise called a dynamic credential, changes automatically. The following are examples of dynamic credentials:

OTP: a one-time-password automatically changes upon each use. An exemplary OTP is the password provided by an RSA SecurID® token (numbers or letters that appear on the token's screen). The value displayed by the token changes periodically, and the servers ensure that they do not accept a single token value more than once per period. Another example is a list of passwords. After the user submits one password from the list to the server, the servers are configured such that the user must submit a password that appears later in the list in a subsequent authentication event.

In a multiple-factor authentication mechanism, suppose an attacker were to discover the value of a dynamic credential without knowing the value of the corresponding static credential. In this case, the attacker could not successfully login because the attacker would not know the value of the static credential. Knowledge of the dynamic credential would become useless at the event in which the dynamic credential changes value. For example, suppose an OTP were accepted by the server for three minutes. Further suppose that the attacker were to discover the value of the dynamic credential. In this case, the attacker must discover the value of the static credential before the expiration of the three-minute time window in order to use the dynamic credential in a meaningful way. Otherwise, at the expiration of the three-minute time window, the attacker's knowledge of the expired dynamic credential value would become useless. Multiple-factor authentication requires at least two factors.

Mutual authentication is a means in which peers in a communication each authenticate the other. If a first peer communicates with a second peer, then the first peer requires that the second peer provide credentials. Once validated by the first peer, these credentials demonstrate the second peer's identity. Additionally, the second peer requires that the first peer provide credentials. Once validated by the second peer, these credentials demonstrate the first peer's identity.

SUMMARY OF THE INVENTION

Embodiments of the present invention provide improved systems and methods for anti-phishing authentication.

Embodiments provide security, even if an attacker may potentially discover the value of the dynamic credential, by ensuring that the client does not send the value of the static credential over any network until the client authenticates the server.

Some embodiments provide a sequence of OTPs that appear to be a random sequence.

Some embodiments protect a client from a phishing attack by way of a method wherein a server cannot provide information that could potentially aid an attacker until the server confirms the client's identity, and a client cannot provide information that can be used in a phishing attack until the client confirms the server's identify.

In some embodiments, the method includes the client providing a login ID to the server. Next, the server provides an encrypted commitment to the client. Next, the client provides an OTP to the server. Then, the server validates the OTP, and sends a commitment key to the client. Upon receiving the commitment key, the client authenticates the server, and provides a static password to the server. Upon receipt of the static password, the server authenticates the client.

Thus, by way of embodiments of the invention, additional security against phishing attacks can be provided.

BRIEF DESCRIPTION OF THE DRAWINGS

The present invention will be more readily understood from the detailed description of exemplary embodiments presented below considered in conjunction with the attached drawings, of which:

FIG. 1 is an exemplary flow diagram illustrating information related to a phishing attack;

FIG. 2 is an exemplary flow diagram illustrating a method for providing security against phishing attacks, in accordance with an embodiment of the present invention:

FIG. 3 illustrates an exemplary mechanism related to allowing a client to match a distinguished name in a SSL (TLS) certificate, to protect a connection with the a server; and

FIG. 4 illustrates an exemplary mechanism related to allowing use of an event-based token.

It is to be understood that the attached drawings are for purposes of illustrating the concepts of the invention.

DETAILED DESCRIPTION

Embodiments of the invention provide for security against phishing attacks. In one such embodiment, before attempting to authenticate, the client opens an SSL or TLS connection with the server. At this point, neither the client, nor the server have authenticated the remote peer. In the SSL or TLS connection, the server uses a certificate with a distinguished name.

This embodiment can include a time-based OTP in which the OTP value is generated as is described in further detail below. In some embodiments, assume that a tamper-resistant authentication token similar to SecurID generates the OTP value, or other known token as is known to those skilled in the art.

With embodiments of the invention, the client does not submit his or her static credential until the client discovers the identity of the server. Otherwise, the client would be providing sufficient information for an attacker to launch a man-in-the-middle phishing attack. On the other hand, the server needs to carefully control the information that it sends over networks to its peer (as described herein, the server and the client are considered to be peers), until the server authenticates the peer as the legitimate client. This issue is a problem because both peers must be extremely careful when they divulge information in any period that precedes authentication of the peer.

To provide security against phishing attacks, a system requires protection of a dynamic credential of multiple-factor authentication. With such protection, the user does not reveal the static credential until he or she authenticates the server.

Another beneficial aspect of some embodiments is that key entropy (e.g., number of bits of randomness that contribute to choosing the value of the key) is not restricted in the cryptographic calculations. Thus, in some embodiments, keys that are used to protect a static password are not limited by entropy. The server cannot provide information that could potentially aid an attacker until the server confirms the client's identity. Likewise, the client cannot provide information that can be used to successfully launch a phishing attack until the client confirms the server's identity.

The client 100 has access to the current value produced by a token which generates one-time passwords used as dynamic credentials. As used herein, the values of these one time passwords are designated as: t1, t2,t3, . . . , etc. In some embodiments, each OTP value appears on the token for a fixed amount of time. When the time period expires, the token displays the next token code. At the ith period, the token code displays ti. At the i+1th period, the token code displays t(i+1). For example, if the values displayed by the token during the first three periods are 381291, 583920 , and 393271 , respectively, then t2=583920.

In such embodiments, the server 110 and the token generate the sequence of token code values t1, t2,t3, . . . , using a method that references a secret key, k 401. Each token has a unique secret key, k 401, and the server 110 has access to a copy of the secret key, k 401. At each time period, i, both the token and the server 110 calculate an intermediary value, xi 402, using the following methodxi=h(AES(k,h(i|CONST))).where:

CONST is a known constant value such as: 123456789.

i|CONST is the value i concatenated onto the constant value. For example, if i=3 , then i|CONST=3123456789.

h(z) is a one-way message digest algorithm computed over value z. An exemplary one-way message digest algorithm is SHA-256 , as is known to those skilled in the art.

AES(a,b) is a symmetric encryption algorithm such as the Advanced Encryption Standard, as is known to those of skill in the art, using (key a) for the purpose of producing encrypted value, given (plaintext value b).

A purpose of this method is to generate a sequence of random-appearing values xi, Each token uses the same method to generate the sequence x1, x2, x3, . . . ; however, each token has a different secret key. For example, another token may use secret key, k′, and this second token generates the following value xi in the ith time period: h(AES(k′,h(i|CONST)))

The token stores each value xi that it generates in its internal storage without revealing each xi to the client, or any other party. The token generates the token code value 113, (also known as ti or OTP) using the following method:ti=f(h(S|xi),n)where:

S is the distinguished name of the server 110.

S|xi is the distinguished name of the server 110 concatenated with the value xi (the vertical bar | denotes the concatenation operation)

f(z,n) is a function that extracts the high-order n digits of base-10 value z. For example, f(123456789,2)=12 and f(987654321,5)=98765.

Thus, in time period i, the token generates the current OTP value 113 (also known as ti) using the following method, where it is assumed that the client and server agree on a value of n through an out-of-band means, e.g., a fixed value of n is programmed into the token and the server's algorithm for generating token values.ti=f(h(S|h(AES(k,h(i|CONST)))),n)

Since the server 110 can determine the same secret key, k 401, and the method for generating ti, the server 110 also can determine how to calculate each ti. Since, for this example, it is assumed that no other party knows the secret key, k 401, no other party can discern ti, except through random guesses.

With reference to FIG. 2, there is shown an exemplary flow diagram illustrating a method for providing security between a client 100 and a server 110 against phishing attacks. In any of the steps described herein, if a validation fails, then the party that notices the failure terminates the protocol immediately and does not proceed to the next step. By way of the method, in c1 the client initiates the protocol by opening an SSL (Secure Socket Layer)(TLS (Transport Layer Security)) session. In step 111, the client 100 provides a user identification code (id) without any accompanying authentication information. In this step, the server 110 can determine the identity of the client 100, but cannot yet authenticate the client 100. With this step, the client 100 does not divulge confidential authentication credential information that could be used by an attacker.

In s1, the server calculates the client's 100 current value of ti, and then computes a commitment value. As used herein, a commitment value is a value used for sending hidden information such that it is verifiable in spite of possible later bias from either the sender or the receiver. With step 112, a commitment value confirms that the server 110 has determined the value that is currently displayed on the client's 100 token. However, at the time of step 112, the commitment value appears to the client 100 as a sequence of random-appearing numbers: and the client 100 cannot understand the full meaning of the commitment value until a later step. In some embodiments, the commitment value can be calculated as follows:Commitment value in time period i: yi=h(h(S|xi)).

At the time that the client 100 receives the commitment, the client 100 does not have enough information to validate the commitment value. The commitment value provides no information that could be used by an attacker to compromise either the server 110 or the client 100. In addition, an attacker cannot forge a correct commitment value because an attacker does not know k, and therefore cannot calculate xi. In c2, the client 100 stores the encrypted commitment 112.

In step 113, the client 100 sends the current OTP displayed on the token (also known as ti). In some embodiments, then token displays the OTP. The OTP can be calculated as follows:OTP value=ti=f(h(S|xi),n),

In such a scenario, the OTP has little use to an attacker unless the attacker can determine the second factor associated with the token, i.e., the password (static credential). Although the client 100 reveals important authentication credential information, this information is not directly useful in the case of an attack. If the attacker does not discover the value of the static credential during time period i, then the attacker's discovery of ti has little use.

Upon receipt in s2, the server 110 then validates the OTP by calculating ti, and comparing against the value received in 113. This validation step serves to demonstrate evidence that the client 100 possesses the correct token, but it does not fully authenticate the client 100.

With further reference to FIG. 2, in step 114, the server 110 sends the commitment key (xi 114) to the client 100. By divulging xi, the server 110 provides the client 100 with the ability to generate a token code. Note that, at this step in the process, the server has already received ti and in order to ensure one-time semantics, the server refuses receipt of any other copies of ti, for this present value of i. Since the server already received ti, release of xi over the network yields little potential value to any possible attackers.

In c3, the client 100 uses xi in the following calculations:z=h(h(S|xi)w=f(h(S|xi),n)

If z is identical to the encrypted commitment 112, and

w is identical to the token code value ti=OTP 113, sent in step 113

Then the client 100 accepts the commitment key 114. Otherwise, validation fails. That is, if either the check of z, or the check of w, or both checks, fail, then the client 100 stops the authentication mechanism immediately, and does not send the value of step 115. In the calculations of w and z, the client uses the value S extracted from the server's certificate in the current SSL (TLS) session.

In c3, by validating the commitment, the client 100 determines the following:

The remote party knew the value of the OTP 113 before the client sent the OTP 113. Therefore, the remote party knew the unique symmetric key k,

The token produced an OTP 113 which is consistent with a value produced using a method that references distinguished name S.

The current SSL (TLS) session connects with a server which has a certificate with distinguished name S.

This evidence is sufficient for convincing the client to send its static password 115, By using the distinguished name the server's SSL (TLS) certificate, the client obtains evidence that its peer is correct, i.e., not an attacker, or man-in-the-middle.

By way of embodiments of the invention, because the client 100 does not divulge its static password in c4 until after it completely validates the server 110, the client 100 can determine that it is not divulging sensitive information to an attacker when the client sends the static password. Once the server 110 obtains both authentication factors, the server 110 can correctly authenticate the client 100. Therefore, at the conclusion of step 115 in s3 the server receives the static credential. In s4, the server uses this credential to complete the authentication. That is, s4 when coupled with s2 validates both the OTP and the static credential. Considering the fact that the client authenticated the server in c3, at the conclusion of s4, the client and server have mutually authenticated.

In some embodiments, the commitment value algorithm computes the message digest twice. Some embodiments use message digests that include a data hiding property. In some embodiments, a double message digest may be used to enhance security. Exemplary algorithms used can include, for example, Message Digest: SHA-1 , or SHA-256.

In some embodiments, the client 100 can be implemented with client-side code, such as an applet or an ActiveX control. The client-side code can perform the tasks of storing the token value between steps 113 and 115, discussed above. The client-side code can also perform client-side message digests and cryptographic steps, as described above.

In some embodiments, the client 100 obtains the client-side code once, and does not obtain further client-side code unless that code is signed by the correct peer.

In some embodiments, if the server 110 and client 100 are not identically synchronized, the server 110 can send multiple commitment values in the same message: yi−2 yi−1 yi yi+1 yi+2. The client validates successfully if it can validate any of the commitments using the value xi.

In some embodiments, the server 110 can enhance data hiding of the commitment by encrypting the commitment with a symmetric algorithm, such as, for example, 3DES. In such an embodiment, in step 114, as described above, the server 110 sends both xi and a 3DES (Triple Data Encryption Standard) key.

Thus embodiments of the invention provide for systems and methods for providing security against phishing attacks. Advantageously, embodiments of the invention do not limit the entropy of any information communicated over a network. Such a result is contrary to known cryptographic solutions to phishing, which typically limit the entropy of communicated information.

Embodiments of the invention beneficially provide for security by embedding the server's 110 name, or identification, into the algorithm for generating OTP values.

Embodiments of the invention cryptographically tie the SSL (TLS) session to the OTP token, thus comparing the token's embedded server name against the SSL (TLS) certificate's distinguished name.

Thus, embodiments provide security against phishing attacks inventively by splitting the authentication process into multiple steps. First, using a commitment in an OTP authentication, and then, second, sending an OTP value in a step before the password, thereby protecting the most vulnerable portion of the authentication credential (the static password) until the end of the authentication process.

In alternate embodiments, additional steps may be added, certain steps may be excluded, certain steps may be performed multiple times, and/or the steps may be performed in a different order and/or simultaneously.

In certain embodiments of the invention, all of the steps of the method can be performed by a computer, or computing system, as described above. In alternative embodiments, one or more of the steps can be performed manually, by a person.

An exemplary embodiment is presented in FIG. 3. In 610, the server 110 sends a dynamic credential, e.g., OTP 113, to the client 100 via a potentially out-of-band method. As used herein, out-of-band means a transmission method that differs from the remainder of the communications. Examples of out-of-band transmission methods are e-mail, physical mail, and telephone messages. Alternatively, an in-band method can be employed. After receiving the message 610, the client 100 wishes to initiate a connection with the server 110. The client executes the steps as described above with respect to FIG. 2 (albeit with modification 611 as described below), to complete the connection in a manner in which the client 100 knows that it is connecting to the right server, i.e., the client 100 obtains anti-phishing assurance in the connection to the server. The client opens the SSL (TLS) after receiving message 610, but before sending message 111. This assurance helps protect the client 100 from sending its authentication credential (including any static credential 115) to any party other than the authorized server 110.

The mechanism described in FIG. 3 ensures that the client 100 matches the distinguished name in the SSL (TLS) certificate that protects the connection with the server 110, against the distinguished name that cryptographically corresponds to the dynamic credential (OTP) 113. If these distinguished names do not match, then the client 100 terminates the connection before sending the static credential 115. In the case of the method shown in FIG. 1, the client trusts the validity of this particular distinguished name because it relates to an OTP obtained from a trusted source (the client's own token). However, in the case of the method shown in FIG. 3, the client receives the OTP in an e-mail or possibly other untrusted channel. Therefore, the client 100 must execute an extra step to ensure validity of the distinguished name. The information collected for the extra step may occur at any point in the mechanism before c3, or at c3 itself. The decision that uses the extra information occurs at c3 as part of the mechanism to authenticate the server. Examples of this extra step include, but are not limited to, any one or more of the following mechanisms: displaying the distinguished name to the user, and waiting for the user to press and acknowledgement button; comparing the distinguished name against a list of names that reside in a trusted location on the client's machine, outbound proxy, or other location trusted by the client; and executing an algorithm that takes a distinguished name and possibly other sources of input such as the server's SSL (TLS) certificate, and producing a binary validity result as output. This algorithm may include a step of validating the SSL (TLS) certificate to ensure that it has a trusted root. Input into this algorithm may potentially include additional information that the user inputs at a prompt or the machine obtains through an interface. Examples of this additional information include the distinguished name that the user types at a prompt or copies from a mobile data source such as a USB memory stick.

In some embodiments, both credentials can be dynamic. In such embodiments, one of the credentials is protected to a greater extent than the other.

With reference to FIG. 4, in some embodiments, the token may generate the token value through an event based token, as is described in the counter example below. In some embodiments, the static credentials may be encrypted. In some embodiments, the client enters the static credential (password) into a program that never releases the static credential in plaintext form. In 711, the value i represents a counter as opposed to a time period; however the formulas remain unchanged with respect to the formulas described above with reference to FIG. 2. The counter increases upon each use. In 711, the client sends the loginid and the current counter value after opening the SSL (TLS) session (c1). The server validates that the counter value is greater than any that had previously been seen by the server. The client increases the counter value by one in order to prepare for its next use, The server executes s1, and in 712 sends the encrypted commitment. The client executes c2, and then in 713 the client sends the dynamic credential. The server executes s2 and in 714 sends the commitment key. In c3, the client authenticates the server. In 715 c4, the client encrypts i|S concatenated with the static credential (password) using k with encryption algorithm AES. The server decrypts using AES with key, k, and executes s3 and s4. The server validates i, S, and the static credential are as expected.

It is to be understood that the exemplary embodiments are merely illustrative of the invention and that many variations of the above-described embodiments can be devised by one skilled in the art without departing from the scope of the invention. It is therefore intended that all such variations be included within the scope of the following claims and their equivalents.

Claims

1. A method for providing security against phishing attacks during client access of a server, the method comprising: providing from the server, upon initiation of a client-server session by the client, an encrypted commitment;receiving at the server, a dynamic credential from the client, in response to receipt of the encrypted commitment;validating the dynamic credential at the server;upon successful validation, transmitting from the server, a commitment key to the client, the commitment key enabling the client to authenticate the server, wherein the client is prohibited from transmitting a static credential until the client authenticates the server.

2. The method of claim 1, further comprising receiving, from the client, a login ID to initiate the client-server session.

3. The method of claim 2, wherein the login ID is a time-based one time use password accessible to both the server and the client.

4. The method of claim 1, further comprising receiving, at the server the static credential upon authentication of the server by the client and authenticating the client at the server.

5. The method of claim 1, wherein if validation of the dynamic credential is unsuccessful, the server terminates the client-server session.

6. The method of claim 1, wherein client-side code stores the received encrypted commitment and the commitment key.

7. The method of claim 1, wherein the client lacks the ability to check validity of the commitment information until the server receives the dynamic credential.

8. The method of claim 1, further comprising embedding a name of the server into an algorithm for generating the dynamic credential.

9. The method of claim 8, further comprising providing from the server an email to the client containing the dynamic credential prior to initiation of the client-server session.

10. The method of claim 9, further comprising validating the server at the client utilizing the embedded server name.

11. A system for providing security against phishing attacks during client access of a server, the system comprising: a server including a processor programmed and configured to perform the steps of: providing from the server, upon initiation of a client-server session over a network by the client, an encrypted commitment;receiving at the server, a dynamic credential from the client, in response to receipt of the encrypted commitment;validating the dynamic credential at the server;upon successful validation, transmitting from the server, a commitment key to the client, the commitment key enabling the client to authenticate the server, wherein the client is prohibited from transmitting a static credential until the client authenticates the server.

12. The system of claim 11, further comprising receiving, from the client, a login ID to initiate the client-server session.

13. The system of claim 12, wherein the login ID is a time-based one time use password accessible to both the server and the client.

14. The system of claim 11, further comprising receiving, at the server the static credential upon authentication of the server by the client and authenticating the client at the server.

15. The system of claim 11, wherein if validation of the dynamic credential is unsuccessful, the server terminates the client-server session.

16. The system of claim 11, wherein client-side code stores the received encrypted commitment and the commitment key.

17. The system of claim 11, wherein the client lacks the ability to check validity of the commitment information until the server receives the dynamic credential.

18. The system of claim 11, further comprising embedding a name of the server into an algorithm for generating the dynamic credential.

19. The system of claim 18, further comprising providing from the server an email to the client containing the dynamic credential prior to initiation of the client-server session.

20. The system of claim 19, further comprising validating the server at the client utilizing the embedded server name.