Patent claim: A method comprising conducting operations in a server 105 505 using a controller 521 of the server 105 505 the operations including generating coded image data the coded image data having data corresponding to a user login to the server 105 505 transmitting the coded image data to a client device 110 entering into a secure communication connection with a mobile wireless communications device 115 415 receiving via the secure communication connection authenticating data of the user login between the client device 110 and the server 105 505 without an authentication token being provided to the client device 110 theauthenticating data based on the coded image data transmitted to the client device 110 entering into an interactive session with the client device 110 without the authentication token being provided to the client device based on comparing the authenticating data with the data of the coded image data the interactive session corresponding to the user login and conducting a confirmation of a transaction of an application of the server 105 505 during the interactive session between the client device 110 and the server 105 505 the confirmation conducted in response to a communication from the mobile wireless communications device 115 415 to complete the confirmation the confirmation being conducted without the authentication token being provided to the client device 110.

Related passage: The authentication method of the present invention consists of three phasesSETUP during this Setup phase the Master Secret is generated and all components described above are installed and all applications started.This is done only once.SECRET DISTRIBUTION the purpose of the Secret distribution phase is to compute and distribute all personal secrets to every user mobile device.This phase is run periodically for instance once a day.The personal secret that is distributed is computed using the current system date of the Trusted Server and is defined to be valid for a period of time whose length coincides with the period of the secretcomputation.For instance if this phase is run once a day then all personal secrets are valid for one day if this phase is run once a week then all personal secrets are valid for one week.AUTHENTICATION the Authentication phase is the actual authentication of the user against the authenticating system.This phase is a process that takes place in the following steps1 The user accesses the client computer and requests a login screen.2 The authenticating system serves a login screen that includes a twodimensional barcode.3 The user starts the mobile application in hisher mobile device.4 The user uses the mobile application to take a picture of the 2Dbarcode in the screen of the client computer.5 The mobile application requests the user a password in order to access the personal secret stored in the device.6 The user inputs the password and the mobile application retrieves the personal secret.7 The mobile application computes the response that corresponds to the challenge embedded in the barcode using the personal secret.8 The mobile application sends via wireless communication the tuple user ID challenge response to the URL that was embedded in the barcode.9 The authenticating system receives the tuple.10 The authenticating system processes the tuple.11 If NOK is returned the tuple is not valid and the authentication process fails and ends.12 If OK is returned the tuple is valid and the user is authenticated meaning that the authenticating system trusts that the tuple is coming from the user that corresponds to the user ID.However in order to provide access to the user the process still has to further proceed as follows.13 The authentication system looks up in its user list to see if the user ID that comes with the tuple is in the list.14 If the user ID is not in the list the user is assumed not to be authorized to access the process fails and ends.15 If the user ID is in the list the authenticating system looks up for challenge in the tuple in the session list.If the challenge that came with the tuple is not in thesession list the process fails and ends.16 If the challenge is in the session list the authenticating system pushes the welcome screen to the client computer that corresponds to the session identification number possibly a personalized welcome screen for the user ID.The process has finished successfully.