FIELD OF THE INVENTION

The present invention relates to an authentication system and methods of authenticating users to service providers, which allows the user to use more than one personal electronic identity gadget mapped to a user account, the personal electronic identity gadgets can be used even with service providers to which only another personal electronic identity gadget of the same user was registered so far. In preferred embodiments, the system and the method offer further advanced functions and further increase both user comfort and security of the authentication system.

BACKGROUND ART

Authentication systems and procedures allow users to have a secure access to services provided by service providers, e.g. services of banks, internet shops, mobile operators, authentication and certification authorities and many more.

One possibility of authentication to the service provider is an authentication utilizing a personal electronic identity gadget (PEIG). This PEIG may be e.g. a chip card, a USB key, a cell phone, a tablet, a computer, a computer program saved in the memory of a computer, of a cell phone, or of a tablet etc. The authentication methods using a personal electronic identity gadget are well-known to persons skilled in the art.

For users, it is often comfortable and secure to have more than one PEIG, so when one of these gadgets is lost or stolen, it can be replaced by another spare PEIG. The service provider can also create separate user accounts for those PEIGs or assign them all to one user account and treat them as mutual backups. These procedures are well-known.

On the other hand, many users use the same PEIG for the authentication to more service providers. Currently, it means that the user has to register all PEIGs to each service provider. When one PEIG is lost, all service providers must be requested by the user to block this PEIG against unauthorized use. Similarly, when a new identity verification is needed or when the cryptographic material in the PEIG gets old, the necessary steps must be performed by the user with each service provider.

The aim of the present invention is to provide a system and method of user authentication to services provided by service providers that will allow PEIGs previously assigned to a user account with one service provider to be used arbitrarily and interchangeably with other service providers, and that will simplify the steps necessary when one or more PEIGs are lost or stolen, when a new user identity verification is needed, and in other situations as well. Thus, the invention shall significantly improve both user comfort and security during the authentication process.

DISCLOSURE OF THE INVENTION

The object of the invention is an authentication system for use with personal electronic identity gadgets (PEIGs) of at least one user of services, wherein the said personal electronic identity gadgets are configured to authenticate to a main service provider (for all PEIGs of this service user) and are configured to trigger synchronization of data storages of service providers; wherein the said system comprisesa data storage of an authentication system server component of at least one main service provider, wherein the said data storage is synchronizable with data storage(s) of server component(s) of at least one other service provider, either directly or via personal electronic identity gadgets, and wherein the said authentication system server component of the at least one main service provider is configured for mapping personal electronic identity gadgets to the account of the user of services (user account);a data storage of an authentication system server component of at least one other service provider that is synchronizable with the data storage of the authentication system server component of the at least one main service provider, either directly or via personal electronic identity gadget;

wherein:the data storage of the authentication system server component of each service provider contains, for each personal electronic identity gadget registered to this provider for the said user of services, a record with data for authenticating this personal electronic identity gadget,the data storage of the authentication system server component of the main service provider contains identifiers assigned to personal electronic identity gadgets and/or to users, wherein for each personal electronic identity gadget of a user and/or for each user, a separate identifier is assigned for each service provider for whom at least one personal electronic identity gadget of the user is assigned to the user account;the data storage of the authentication system server component of the main service provider contains a map of personal electronic identity gadgets for each user account, in the said map the records for all personal electronic identity gadgets of the said user in the said data storage are mapped to the said user account, furthermore the map contains the identifiers assigned to the personal electronic identity gadgets of the said user for all service providers and/or the identifiers assigned to the said user for all service providers;the data storage of the authentication system server component of other service provider contains at least the identifiers assigned to personal electronic identity gadgets and/or to users of this other service provider;the data storage of the authentication system server component of other service provider contains a map of personal electronic identity gadgets for each user account, wherein in the said map, the records for all personal electronic identity gadgets of the said user in this data storage are mapped to the said user account, furthermore the map contains the identifiers assigned to the personal electronic identity gadgets of the said user for at least this other service provider and/or the identifier assigned to the said user for at least this other service provider;the data storages and/or the authentication system server components are configured so that the identifiers assigned to the personal electronic identity gadgets assigned to the account of one user and/or identifiers assigned to one user are synchronizable by transmitting synchronization information between the data storages of the authentication system server components and/or between the authentication system server components, directly or via personal electronic identity gadgets.

Another object of the present invention is a method of user authentication using a personal electronic identity gadget (PEIG) in the authentication system for use with the said personal electronic identity gadgets of at least one user of services, wherein the said personal electronic identity gadgets are configured to authenticate to a main service provider (for all PEIGs of this service user) and are configured to trigger synchronization of data storages of service providers; wherein the said system comprisesa data storage of an authentication system server component of at least one main service provider, wherein the said data storage is synchronizable with data storage(s) of server component(s) of at least one other service provider, either directly or via personal electronic identity gadgets, and wherein the said authentication system server component of the at least one main service provider is configured for mapping personal electronic identity gadgets to the account of the user of services (user account);a data storage of an authentication system server component of at least one other service provider that is synchronizable with the data storage of the authentication system server component of the at least one main service provider, either directly or via personal electronic identity gadget;

wherein the method is characterized in thatin the data storage of the authentication system server component of the main service provider, a record containing data for authentication of the personal identity gadget is assigned to each personal electronic identity gadget during its registration to the user account;in the data storage of the authentication system server component of the main service provider, the records of all personal electronic identity gadgets assigned to the account of one user of services are mapped to a map of personal electronic identity gadgets for the said user account; and identifiers assigned to all personal electronic identity gadgets of the said user or/and to the said user are mapped to the said map of personal electronic identity gadgets for the said user account, wherein a separate identified is assigned to each personal electronic identity gadget of the said user and/or to the said user for each service provider for whom any personal electronic identity gadget of this user is registered;

andwhen any personal electronic identity gadget of the user is used at least for the first authentication to an other service provider, this personal electronic identity gadget connects and authenticates to the main service provider and requests synchronization information from the authentication system server component of the main service provider, said synchronization information containing the map of personal electronic identity gadgets mapped to the said user's account and containing information on identifiers assigned to all personal electronic identity gadgets mapped to the map for at least the said other service provider and/or on identifiers assigned to the said user for at least the said other service provider; then the personal electronic identity gadget transmits this synchronization information to the authentication system server component of the said other service provider, wherein the authentication system server component of the said other service provider uses the synchronization information to amend the map of personal electronic identity gadgets and the information on identifiers in its data storage.

In a preferred embodiment, the object of the invention is an authentication system for use with personal electronic identity gadgets (PEIGs) of at least one user of services, wherein the said personal electronic identity gadgets are configured to authenticate to a main service provider (for all PEIGs of this user of services) and are configured to trigger synchronization of data storages of service providers; wherein the said system comprisesa data storage of an authentication system server component of at least one main service provider, wherein the said data storage is synchronizable with data storage(s) of server component(s) of at least one other service provider, either directly or via personal electronic identity gadgets, and wherein the said authentication system server component of the at least one main service provider is configured for mapping personal electronic identity gadgets to the account of the user of services (user account);a data storage of an authentication system server component of at least one other service provider which is synchronizable with the data storage of the authentication system server component of the at least one main service provider, either directly or via personal electronic identity gadget;

wherein:the data storage of the authentication system server component of each service provider contains, for each personal electronic identity gadget of the said user of services, a record with data for authenticating this personal electronic identity gadget,the data storage of the authentication system server component of the main service provider contains a map of personal electronic identity gadgets for each user account, in the said map the records for all personal electronic identity gadgets of the said user in the said data storage are mapped to the said user account, furthermore the map contains identifiers assigned to the personal electronic identity gadgets of the said user for all service providers, wherein a separate identifier is assigned for each personal electronic identity gadget of the said user for each service provider for whom at least one personal electronic identity gadget is registered for the said user account;the data storage of the authentication system server component of other service provider contains a map of personal electronic identity gadgets for each user account, wherein in the said map, the records for all personal electronic identity gadgets of the said user in this data storage are mapped to the said user account, furthermore the map contains the identifiers assigned to the personal electronic identity gadgets of the said user for at least this other service provider (and optionally for further other service providers for whom at least one personal electronic identity gadget is registered for the said user account);the data storages and/or the authentication system server components are configured so that the identifiers assigned to the personal electronic identity gadgets assigned to the account of one user are synchronizable by transmitting synchronization information between the data storages of the authentication system server components and/or between the authentication system server components, directly or via personal electronic identity gadgets.

In a preferred embodiment a method of user authentication using a personal electronic identity gadget (PEIG) in the authentication system for use with the said personal electronic identity gadgets of at least one user of services is provided, wherein the said personal electronic identity gadgets are configured to authenticate the user to a main service provider (for all PEIGs of this service user) and are configured to trigger synchronization of data storages of service providers; wherein the said system comprisesa data storage of an authentication system server component of at least one main service provider, wherein the said data storage is synchronizable with data storage(s) of server component(s) of at least one other service provider, either directly or via personal electronic identity gadgets, and wherein the said authentication system server component of the at least one main service provider is configured for mapping personal electronic identity gadgets to the account of the user of services (user account);a data storage of an authentication system server component of at least one other service provider that is synchronizable with the data storage of the authentication system server component of the at least one main service provider, either directly or via personal electronic identity gadget;

wherein the method is characterized in thatin the data storage of the authentication system server component of the main service provider, a record containing data for authentication of the personal identity gadget is assigned to each personal electronic identity gadget;in the data storage of the authentication system server component of the main service provider, the records of all personal electronic identity gadgets assigned to the account of one user of services are mapped to a map of personal electronic identity gadgets for the said user account; and identifiers assigned to all personal electronic identity gadgets of the said user are mapped to the said map of personal electronic identity gadgets for the said user account, wherein a separate identifier is assigned to each personal electronic identity gadget of the said user for each service provider for whom at least one personal electronic identity gadget of this user is registered;

andwhen any personal electronic identity gadget of the user is used at least for the first authentication to an other service provider, this personal electronic identity gadget connects and authenticates to the main service provider and requests synchronization information from the authentication system server component of the main service provider, said synchronization information containing the map of personal electronic identity gadgets mapped to the said user's account and containing information on identifiers assigned to all personal electronic identity gadgets mapped to the map for at least the said other service provider for at least the said other service provider; then the personal electronic identity gadget transmits this synchronization information to the authentication system server component of the said other service provider, wherein the authentication system server component of the said other service provider uses the synchronization information to amend the map of personal electronic identity gadgets and the information on identifiers in its data storage.

The authentication system according to the invention thus uses personal electronic identity gadgets (for one user, it can use one or more identity gadgets) and allows the user to assign more than one personal electronic identity gadget to his account. In the following text, this process of assigning gadgets to a user account is called also “replica” or “replica creation”. Subsequently the user can use these personal identity gadgets arbitrarily and interchangeably with any service provider, provided that the user registers at least one PEIG to this service provider either before or after creating the replica.

The personal electronic identity gadgets are assigned to a user account at the main service provider. The main service provider is identical for all personal electronic identity gadgets of one user of services, thus for all his personal electronic identity gadgets assigned to his user account. The data storage of the authentication system server component of the said main service provider is central for the relevant user account and his personal electronic identity gadgets. It is preferred when main service provider server with the database is continuously accessible. The main service provider does not have to be the same for all users, however all personal electronic identity gadgets are configured for authenticating their user account to the respective main service provider.

The term “authentication” in this text stands for verifying the identity.

The term “other service provider” is used for any service provider that is not the main service provider for the personal electronic identity gadgets of the respective user.

The ability of the PEIG to authenticate to the main service provider can be enabled either by equipping it with information on the main service provider, or by equipping it with an application having access to information on the main service provider, or by providing it with a connection to the application of the main service provider that transmits the relevant information, or by other means, based on the type and purpose of the PEIG.

When used for the first time for authentication to each other service provider, the personal electronic identity gadget tries to connect and authenticate to the main service provider. If it has already been assigned to a user account (replica was created) at the main service provider, then preferably a record for this PEIG is created at the said other service provider upon the first registration (assigning) of the personal electronic identity gadget to the said other service provider, and a map of PEIGs and their identifiers is synchronized from the main service provider.

When registering a PEIG to an other service provider and said PEIG is not yet assigned to any user account at the main service provider, a valid map for this PEIG cannot be obtained. Only when the PEIG is assigned to a user account at the main service provider (replica is created), it triggers synchronization of the map with mapped identifiers from the main service provider to all other service providers where it was already used (assigned, identity created).

When assigning a further PEIG to a user account at the main service provider, a record for this further PEIG is created and this record is mapped to the map of the PEIGs for this user account. At the same time the authentication system server component of the main service provider generates the identifiers so that an identifier is assigned to each PEIG and to each service provider having registered at least one PEIG mapped to the map and/or an identifier assigned to the user and to each service provider having registered at least one PEIG mapped to the map. So the identifiers are generated and assigned also to combinations of PEIGs and other service providers, at which these PEIGs have not been registered. Nevertheless at the moment of using such PEIG at such other service provider for the first time, the PEIG triggers a synchronization of the map of PEIGs and a synchronization of the identifiers. So in this preferred embodiment the other service provider uses the identifiers to verify that the PEIG is assigned to the account of its user and it does not need to be assigned to the user account at this other service provider anew. Optionally, the synchronization of the map can be triggered at each service provider when assigning each further PEIG to the user account at the main service provider.

The map of PEIGs at each service provider is configured so that for each PEIG record, the relevant map of PEIGs can be identified, and for each map of PEIGs, the records of all PEIGs relevant to the said map in the data storage of the relevant service provider can be identified. Furthermore, for each map of PEIGs at each other service provider, the identifiers for each PEIG mapped to this map and for at least the relevant other service provider (optionally also for further service providers) and/or identifiers assigned to the user for at least this other service provider (optionally also for further service providers) can be identified. To each map of PEIGs at the main service provider, identifiers are mapped for each PEIG and for each service provider having registered at least one of the PEIGs mapped to the said map and/or identifiers are mapped for the user and for each service provider having registered at least one of the PEIGs mapped to the said map.

The requirement for the synchronizability of the data storage of a service provider “either directly or via PEIG” has to be interpreted so that the data storage can be synchronized with the data storage of another service provider using any of these methods according to needs or requirements. The data storage synchronization always encompasses creating synchronization information from the data contained in one data storage and transmitting it to another data storage, and appropriately amending the data in the said another data storage.

The term “each service provider” encompasses both the main service provider and other service providers, if not specified otherwise.

The terms “registered”, “register”, “registration” stand for assigning the PEIG, particularly the first PEIG, to the user account at any other service provider or at the main service provider. Assigning the PEIG (particularly the second PEIG and the following PEIGs) to the user account at the main service provider is called also “replica creation”.

The term “synchronization information” represents information created so that it contains the necessary data such as the information about the map of PEIGs for the relevant user account and the information about identifiers for the PEIGs mapped to the map and/or for the user. Methods suitable for creating the synchronization information are known in the art. The synchronization information can be e.g. cryptographically protected or marked with a time stamp if needed.

The term “data storage” should be understood as any device or system capable of storing and preserving data as well as of processing them. Examples include a database, a file system, an operating memory, a hard drive, etc.

A PEIG suitable for use in the authentication system according to the invention is configured for connection and authentication to the main service provider during at least the first authentication to an other service provider, for triggering the synchronization of the map for the relevant user account from the main service provider to the other service provider and for triggering the synchronization of identifiers assigned to all PEIGs of this user and/or to users for at least this other service provider.

The personal electronic identity gadget (PEIG) can be e.g. a cell phone, a tablet, a chip card, a USB key ring, a smart watch, an electronic bracelet, an electronic pendant, or another object suitable for authentication to service providers that is known to the skilled person.

The term “identifier” is known to the skilled person, as well as the common technical features of the identifier. The identifier is unique especially within its identificator space (identificator framework), thus the system ensures that the same identifier is not assigned to two different objects within the relevant identificator space. The same identifier must not be assigned to two different PEIGs for one service provider; the same identifier must not be assigned to two different users for one service provider. However the same identifier can (but does not have to) be assigned to the same PEIG or to the same user for different service providers, because each service provider has its own identificator framework.

In addition to the herein mentioned identifiers, the system may also contain local identifiers assigned to a PEIG and/or to a user at the data storage of a service provider, the local identifiers are not transmitted to any further service provider. The local identifiers are then linked with identifiers assigned to the PEIG and/or to the user by the main service provider for the relevant service provider.

Authentication procedures and methods of secure information transfer used within the framework of this invention may include any suitable authentication procedures and methods of secure information transfer known in the field. Person skilled in the art can evaluate their suitability and applicability for this invention and put them into practice. To connect the PEIG to the main and the other service provider for synchronization of the data, procedures known in the field can be used, e.g. procedures according to the patent application PCT/CZ2016/050024.

The service provider may be any provider of electronic services, e.g. provider of electronic banking, mobile operator, provider of electronic databases, provider of identity verification (Identity provider), provider of public transport (electronic tickets), building entrance control (electronic entrance system), internet shop, provider of medical services (electronic health service), etc.

The authentication system server component is a part of the authentication system (usually embodied in a software) that is stored and run on the server of the relevant service provider. Usually this server component communicates with the user via a user interface.

When using any arbitrary PEIG for authentication to an other service provider for the first time, the PEIG also connects and authenticates to the main service provider and requests the synchronization information. The synchronization information contains a map of PEIGs and identifiers assigned to all PEIGs incorporated into this map and/or identifiers of the user for at least this service provider.

After obtaining the synchronization information the PEIG transmits this synchronization information to the said other service provider, which uses this synchronization information in an appropriate manner to amend its map of PEIGs for the relevant user account and to amend the identifiers assigned to all PEIGs mapped to the map for the relevant user account and/or the identifiers assigned to the relevant user.

This ensures that all service providers have information on PEIGs of the relevant user and they timely get identifiers for authentication with a PEIG of the user that was never registered with them specifically.

Preferably, the synchronization information is requested and transmitted at least in the beginning of the process of authentication using a PEIG with an other service provider for the first time. This facilitates the procedure when the PEIG being used for the authentication was never used by the user for this service provider before. Using the transmitted synchronization information, the service provider can verify that this PEIG is mapped to the map of PEIGs of the relevant user and the identifier assigned to this PEIG for this service provider is available to the service provider and can be used in the authentication process.

When one of PEIGs is then registered to a new service provider, the PEIG connects and authenticates to the main service provider, requests the main service provider to generate identifiers for all PEIGs mapped to the map of PEIGs and for this new service provider, and/or to generate identifiers for the user and for this new service provider; the PEIG also requests from the main service provider the creation of the synchronization information containing the map of PEIGs and the identifiers assigned to all PEIGs mapped to the map, and/or assigned to the user, for at least this service provider, optionally for at least one more other service provider or for all service providers having registered at least one PEIG of this user. Then the PEIG transmits this synchronization information to this new service provider.

Thus, the synchronization procedure and the requesting and transmitting of the synchronization information via the PEIG ensures that the new service provider has all PEIGs of the relevant user assigned to the user's account, and it has for any and all of them and/or for the user an identifier usable for authentication. At the same time the main service provider has information on the new other service provider which can advantageously be used when dealing with emergency situations.

Further, a preferred embodiment is described which is suitable for resolving problems caused by loss or destruction of a PEIG.

In this case, the authentication system is configured to transmit synchronization messages (synchronization information) between the main service provider and other service providers directly via a synchronization channel, without the need for transfer via a PEIG. This feature improves the system security by enabling a reliable and fast blocking of the lost, destroyed or stolen PEIG.

When the first identity gadget is lost, destroyed or stolen, the user authenticates to the main service provider with another PEIG that he still has at hand, and he enters a command to revoke centrally the first (lost) PEIG. The authentication system server component of the main service provider then prepares a synchronization message flagging the first PEIG for blocking and/or for rejection of authentication; this synchronization message is then transmitted via synchronization channels to all other service providers having registered any PEIGs mapped to the map of PEIGs of the relevant user. The other service providers use this synchronization message to amend the data in databases of their autentication system server components, and if anybody tries to use this first PEIG with any of them, the PEIG is blocked and/or the authentication is rejected. To identify this first (lost) PEIG, the other service providers use the identifiers assigned to this PEIG mapped to their maps of PEIGs for this user.

When all PEIGs are lost, destroyed or stolen, the authentication system according to the invention preferably provides an entry for the administrator (e.g. an authorized person) of the main service provider, who after verifying the user's identity enters a command to revoke centrally all PEIGs of this user. The authentication system server component of the main service provider then prepares a synchronization message flagging all PEIG for blocking and/or for rejection of authentication; this synchronization message is then transmitted via synchronization channels to all other service providers having registered any PEIGs mapped to the map of PEIGs for this user. The other service providers use this synchronization message to amend the data in databases of their authentication system server components; if anybody tries to use any of these PEIGs at any of them, the PEIG is blocked and/or the authentication is rejected. To identify these PEIGs, the other service providers use the identifiers assigned to these PEIGs mapped to their maps of PEIGs for this user.

Yet further, a preferred embodiment of the invention is described which resolves the problems caused by one or more PEIGs of a user having an invalid (e.g. outdated) cryptographic material for authentication to one or more other service providers, for example when it was not used for this authentication for a long time and it is kept as a backup PEIG. In this embodiment the cryptographic material for authenticating to the main service provider is not invalid (e.g. outdated) in the PEIG.

When using this PEIG for authentication to an other service provider, this other service provider determines the cryptographic material in the PEIG to be invalid. Due to this determination, the authentication of the PEIG to this other service provider is rejected, so the PEIG acts in the same way as when authenticating (registering) to the other service provider for the first time, thus it connects and authenticates to the main service provider, requests the main service provider to create synchronization information containing a map of PEIGs and identifiers assigned to all PEIGs mapped to the map for at least this service provider, and transmits this synchronization information to the said other service provider. Subsequently after having compared the map of PEIGs saved originally at this other service provider with the newly transmitted map or after analyzing the identifier for the relevant PEIG, a new cryptographic material for authentication of this PEIG is created.

If the cryptographic material in the PEIG is determined invalid also for authentication to the main service provider, the authentication system according to the invention preferably provides an entry for the administrator (e.g. an authorized person) of the main service provider, who after verifying the user's identity allows the creation or creates a new cryptographic material of the said PEIG at the main service provider without cancelling the mapping of the said PEIG to the map of PEIGs for the relevant user. For other service providers, the procedure described in the preceding paragraph is used.

A preferred embodiment of the invention, in which an identifier assigned to the user is mapped to the map of PEIGs, allows the centralized user identity verification to be used.

The centralized user identity verification is performed by a provider of verification services. The provider of verification services may be identical with the main service provider for the relevant user or it may be a different entity.

The identifiers assigned to users for each service provider can be generated either by the main service provider, or by the provider of verification services, or by an other service provider, optionally transmitted to the main service provider, mapped to the map of PEIGs of this user in the data storage of the authentication system server component of the main service provider, and at least the identifier assigned to the user for the relevant other service provider is saved into the data storage of the authentication system server component of this other service provider and they are a part of the synchronization information. In the further text they are called “user identifier” or “user reference identifier”.

In addition to the user identifier for each service provider which is a part of the synchronization information, a local user identifier is provided for each service provider, the local identifier is not transmitted anywhere, but it is mapped to the map of PEIGs of the relevant user for the relevant service provider. The local identifier is generated by the relevant service provider, where it is located.

During the centralized identity verification, the provider of verification services verifies the user identity e.g. using an identification document; if the provider of verification services differs from the main service provider, it transmits the result of the user identity verification to the main service provider. The result of the user identity verification is then transmitted to an other service provider as part of synchronization information or during a separate operation of transmission of the results of the user identity verification, together with a user reference identifier for the relevant other service provider, and on the basis of the user reference identifier the verification result is linked with the relevant local user identifier assigned to the user at the said other service provider. Transmission of the synchronization information or transmission of the results of the user identity verification during a separate operation of transmission of the results of the user identity verification can take place either directly between the authentication system server components of the service providers, or via PEIGs.

The system according to the invention can be used to verify the user identity and to transmit the result of the verification by way of its linking with the map of PEIGs for this user and/or its linking with user reference indicators for other service providers.

The same procedures can be used for a repeated user identity verification or when the user personal information is changed, so the user has to undergo the process of identity verification or personal information change only with one provider of verification services; then the authentication system according to the invention transmits the relevant information to all or selected other service providers. In addition to this, the system preferably allows to control the content of the transmitted personal information with respect to valid legislation on private data protection.

Yet further preferred embodiment allows to perform a direct transaction (data transmission) between two service providers (e.g. between the main service provider and an other service provider, or between two other service providers) when a PEIG is connected to one service provider, wherein the relevant local identifiers of this user mapped to the map of PEIGs for this user are available at data storages of authentication system server components of both service providers. Furthermore, this embodiment uses the ability of the authentication system to transmit the data to be transmitted directly between any service providers.

In this procedure the PEIG cooperates with authentication system server components of both service providers and the authentication system server component of one service provider generates a one-time user identifier that is transmitted to the authentication system server component of the other service provider via PEIG. In data storages of authentication system server components of both service providers, the one-time user identifier is linked with the relevant local identifier of this user. Consequently the application that requires the transaction to be processed at the second service provider requests completion of the transaction and transmits the transaction parameters and the local user identifier for the second service provider to the authentication system server component of the second service provider. The second server component uses the local user identifier to search for the linked one-time user identifier in its data storage and transmits the request for completion of the transaction, transaction parameters, and the one-time user identifier to the authentication system server component of the first service provider via a direct synchronization channel The server component of the authentication system of the first service provider uses the one-time user identifier to find the local user identifier for the first service provider in its data storage and transmits this local user identifier and transaction parameters to the application involved in the transaction at the first service provider. When the transaction is completed, both service providers remove the one-time user identifier from their data storages. Thus for each transaction a separate one-time user identifier is generated. This prevents the transaction to be processed without user's knowledge.

Individual preferred embodiments can be combined as needed, wherein the authentication system as defined in claims is useful for their implementation.

EXAMPLES OF CARRY OUT THE INVENTION

List of abbreviations used in examples:

PEIG—personal electronic identity gadget;

AIM—authentication system server component of a service provider;

AIM database—data storage of authentication system server component of a service provider;

Map or PEIG Map—map of personal electronic identity gadgets;

UDI—local user identifier (user database index);

URID—user reference identifier;

UOTID—user one-time identifier;

Xx (e.g. Ba, Aa)—labels for identifiers of personal electronic identity gadgets, capital letters refer to service providers, small letters refer to personal electronic identity gadgets.

The main service provider is marked A, if not stated otherwise.

Other service providers are marked with further letters of the alphabet.

