Patent claim: The method of claim 9 wherein conducting the logoff includes the server 105 505 invalidating cookies associated with the user login invalidating session data cached by the client device 110 or both invalidating cookies associated with the user login invalidating session data cached by the client device 110.

Related passage: This authenticating system performs the following four functionsa.It serves the so called login pages or login screens.This means that the authenticating system is capable of generating and sending to the client computer agraphical interface that possesses the following propertiesi.It includes a twodimensional barcode that embeds the URL of the authenticating system and a securely random challenge of a given number of bits.ii.It tracks the client computers where it is serving login pages by means of the challenge that it has sent using this challenge as a session identification number.The system stores the session identification number in a session list.In this way the system knows which client computer corresponds to every challenge that it has generated.The session identification number for any client computer is identical to the last challenge sent to that client computer embedded in the login page or screen.iii.At any given time if the client computer requests another login page a new random challenge is generated the login page is served and the session list is updated with the new challenge i.e.the new session identification number rendering the previous one invalid.In the particular case that the client computer is a personal PC that hosts an Internet browser then this function is a web server function and the served interface takes the form of an HTML page that includes an embedded image with the twodimensional barcode.b.It listens to and receives tuples that are sent by mobile devices over their wireless communication channels.Typically the wireless channel will be a wireless access to the Internet and in this case the system receives the tuples via the Internet.c.It processes tuples.Tuple processing is defined as analyzing the three elements of every tuple user ID challenge and response and returning OK or NOK.The process shall take as input the three values in the tuple and one or possibly more input dates typically just one date the current date.The process shall return OK whenever the tuple is a valid tuple and shall return NOK in any other case.A valid tuple is defined as a tuple where the response to the challenge is guaranteed to be generated using the personal secret that corresponds to the user whose user ID is in the tuple for any of the periods related to the input dates.The tuple processing function is performed using public cryptographic primitives which are assumed might be known by anyone.This function is performed by a software program that includes or accesses no secrets.d.It pushes welcome pages or welcome screens.A welcome page is definedas the first page or screen that every user sees in the client computer after heshe has successfully authenticated.From this page the user shall be able to access the system according to hisher authorized roles.This means that the system has the capability to identify for any given challenge the client computer where it served the login page that included that challenge and subsequently send under its own initiative the welcome page of an authenticated session to that particular client computer.In the particular case that the client computer is a personal PC that hosts an Internet browser the push capability consists in the capability to push an HTML page to this browser.