Dynamic QR Code Security via Contextual Data Embedding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing mobile payment systems using QR codes are vulnerable to unauthorized use as images can be captured and reused for fraudulent transactions, as users lack practical means to identify illicit use until fraud occurs.
Innovation Solution
A system that generates a QR code for payment incorporating information about sensed conditions at the time of payment, which is independently verified by a barcode scanner to ensure the transaction is authorized only if conditions match, using publicly accessible information as a key to encrypt the code, limiting its validity to a specific time and location.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If a QR code is generated for mobile payment, then payment convenience is improved, but security against unauthorized reuse deteriorates
Solution Approach 1:
The system embeds sensing information (location, time, device identifiers) into the QR code before it is presented for payment. This preliminary embedding of contextual data ensures that when the QR code is scanned, the system can verify these conditions match the current transaction context, preventing unauthorized reuse of captured QR code images
Solution Approach 2:
The payment system implements a feedback mechanism where the QR code scanner independently determines sensing information and compares it with the embedded information in the QR code. This verification feedback loop ensures that only QR codes presented under the correct conditions (matching location, time, and device identifiers) are authorized for payment, thereby preventing fraudulent transactions
2Reliability
If sensing information is embedded in the QR code, then security is improved, but device complexity increases
Solution Approach 1:
The mobile device automatically collects sensing information (location data, time, device identifiers) through its built-in sensors and system components without requiring additional external devices or manual input. The QR code generator then automatically embeds this self-collected information into the code, reducing the need for additional system components while maintaining enhanced security
Solution Approach 2:
The system uses existing multi-functional components of the mobile device (GPS for location, clock for time, unique device identifiers) to gather sensing information. These same components serve multiple purposes in the device, so their use for QR code security does not significantly increase overall device complexity. The verification system at the scanner also uses universal comparison logic that can validate multiple types of embedded information
Data Source
AI summary
Unauthorized copying of a transaction barcode is prevented by including a sensed condition or other publicly-accessible data with the transaction barcode for use as a comparison with the publicly accessible data determined at a barcode reader. If the sensed condition included in the transaction barcode indicates that the transaction barcode was generated for a different transaction, then the barcode reader invalidates the transaction. For instance, if the barcode was generated too distant in time, position, or sequential transactions, then the barcode reader invalidates the transaction barcode as an unauthorized copy of a transaction barcode generated for a different transaction.