| 4.1 |  | AAA Secure Network Access |
| 4.1.6 |  | Authentication - token cards and servers |

| Another one-time password authentication method that adds a new layer of security uses a token card or smart card, and a token server. Each token card, about the size of a credit card, is programmed to a specific user and each user has a unique PIN that can generate a password keyed strictly to the corresponding card. Token cards and servers generally work as demonstrated in the following steps :

1. The user generates a one-time password with the token card using a security algorithm.
2. The user enters the one-time password into the authentication screen generated by the remote client, the Windows Dial-Up Networking screen in Figure .
3. The remote client sends the one-time password to the token server via the network and a NAS.
4. The token server uses the same algorithm to verify the password is correct and authenticates the remote user.

Token card and server methods
Two token card and server methods are used:

1. Time-based
2. Challenge-response