Machine-Readable Code Presence Verification Against QR Reuse
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing machine-readable codes, such as QR codes, can be easily duplicated and reused, leading to security vulnerabilities in data exchanges, and conventional security measures like time limits or refresh rates fail to confirm the presence of the scanning device.
Innovation Solution
A method involving a user device scanning a first machine-readable code, generating a second code with a token from a server, and validating this token to ensure the device's presence, thereby preventing unauthorized reuse.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If machine-readable codes are used to initiate data exchanges, then ease of operation is improved, but security deteriorates due to code duplication and reuse
Solution Approach 1:
The system performs preliminary actions by generating a time-limited second machine-readable code after the initial code is scanned. This preliminary generation of a new code with a unique token prevents the original code from being reused, thereby addressing the security issue while maintaining ease of operation through automated code generation and validation
Solution Approach 2:
The system implements feedback by validating the unique token from the second code against the first code's data. This feedback mechanism confirms that the scanning device is physically present and has properly captured the updated code, preventing unauthorized reuse while maintaining user-friendly operation
2Reliability
If codes are continuously refreshed to prevent reuse, then security is improved, but device complexity increases due to continuous updating mechanisms
Solution Approach 1:
The system uses periodic action by generating a second code only after successful scanning of the first code, rather than continuously refreshing. This periodic approach maintains security through code renewal while reducing device complexity by avoiding constant updating mechanisms
Solution Approach 2:
The system implements self-service through automated code generation and validation processes. The computing device automatically generates the second code with a unique token and validates it against the first code, eliminating the need for complex manual intervention or continuous monitoring mechanisms
3Reliability
If conventional security measures like time limits are applied, then security is partially improved, but loss of time increases due to extended validation periods
Solution Approach 1:
The system performs preliminary action by generating the second code immediately after scanning the first code, with a unique token that is validated right away. This preliminary validation action reduces the time window for potential attacks while maintaining security, avoiding extended validation periods
Solution Approach 2:
The system applies the skipping principle by rapidly generating and validating the second code without unnecessary delays. The process moves quickly from scanning the first code to generating and validating the second code with a unique token, minimizing time loss while maintaining strong security through immediate code renewal
Data Source
AI summary
Techniques are disclosed for confirming proof-of-presence of a user device using machine-readable codes. The user device can initiate an image capture process using a camera. While in the image capture process, the user device can capture an image of a machine-readable code using the camera. The machine-readable code can include first information associated with a data exchange session at a server device. While still in the image capture process, the user device can initiate a connection with the server device using the first information, capture an additional image of an updated machine-readable code that includes a token corresponding to the user device, and sending a request comprising the token to the server device using the connection.