Patent claim: The method of claim 6 wherein the method includes conducing a logoff of the client device from the server the logoff including receiving a logoff request from the mobile wireless communications device 115 415 the logoff request including data to terminate connection of the server 105 505 and client device 110 corresponding to the user login.

Related passage: The authentication method of the present invention consists of three phasesSETUP during this Setup phase the Master Secret is generated and all components described above are installed and all applications started.This is done only once.SECRET DISTRIBUTION the purpose of the Secret distribution phase is to compute and distribute all personal secrets to every user mobile device.This phase is run periodically for instance once a day.The personal secret that is distributed is computed using the current system date of the Trusted Server and is defined to be valid for a period of time whose length coincides with the period of the secretcomputation.For instance if this phase is run once a day then all personal secrets are valid for one day if this phase is run once a week then all personal secrets are valid for one week.AUTHENTICATION the Authentication phase is the actual authentication of the user against the authenticating system.This phase is a process that takes place in the following steps1 The user accesses the client computer and requests a login screen.2 The authenticating system serves a login screen that includes a twodimensional barcode.3 The user starts the mobile application in hisher mobile device.4 The user uses the mobile application to take a picture of the 2Dbarcode in the screen of the client computer.5 The mobile application requests the user a password in order to access the personal secret stored in the device.6 The user inputs the password and the mobile application retrieves the personal secret.7 The mobile application computes the response that corresponds to the challenge embedded in the barcode using the personal secret.8 The mobile application sends via wireless communication the tuple user ID challenge response to the URL that was embedded in the barcode.9 The authenticating system receives the tuple.10 The authenticating system processes the tuple.11 If NOK is returned the tuple is not valid and the authentication process fails and ends.12 If OK is returned the tuple is valid and the user is authenticated meaning that the authenticating system trusts that the tuple is coming from the user that corresponds to the user ID.However in order to provide access to the user the process still has to further proceed as follows.13 The authentication system looks up in its user list to see if the user ID that comes with the tuple is in the list.14 If the user ID is not in the list the user is assumed not to be authorized to access the process fails and ends.15 If the user ID is in the list the authenticating system looks up for challenge in the tuple in the session list.If the challenge that came with the tuple is not in thesession list the process fails and ends.16 If the challenge is in the session list the authenticating system pushes the welcome screen to the client computer that corresponds to the session identification number possibly a personalized welcome screen for the user ID.The process has finished successfully.