QR Code Authentication for Cardless ATM Transactions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication methods, such as static password-based systems, are vulnerable to unauthorized access and phishing attacks, and two-factor authentication is often limited due to high operational costs and user inconvenience, particularly with hardware tokens.
Innovation Solution
The use of QR codes on mobile devices for authenticating users to secure resources, where a QR code displayed on a login page is scanned to generate and transmit an OTP, combining the security of two-factor authentication with the convenience of mobile device possession, using cryptographic camouflaging to protect seed keys.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If static password-based authentication is used, then ease of operation is improved, but reliability deteriorates due to vulnerability to phishing and eavesdropping
Solution Approach 1:
The patent introduces an intermediary authentication mechanism using QR codes and mobile devices. Instead of directly transmitting passwords over potentially compromised channels, the system uses a QR code as an intermediary that encodes authentication data, which is then scanned and processed by a mobile device to generate a one-time password. This intermediary layer prevents direct exposure of static passwords to phishing and eavesdropping attacks.
Solution Approach 2:
The patent transitions from static password authentication to dynamic authentication using one-time passwords (OTPs). The OTP changes with each authentication attempt and is generated based on a shared secret and timestamp or counter. This dynamic approach ensures that even if one OTP is compromised, it cannot be reused, thereby significantly improving reliability while maintaining ease of operation through mobile device integration.
2Reliability
If two-factor authentication with hardware tokens is implemented, then reliability is improved, but device complexity and operational costs increase
Solution Approach 1:
The patent replaces physical hardware tokens with a software-based implementation on mobile devices. The authentication functionality is copied from dedicated hardware tokens to general-purpose mobile devices that users already possess. This eliminates the need for separate hardware tokens, reducing device complexity and operational costs while maintaining the reliability benefits of two-factor authentication through the combination of something the user knows (password) and something the user has (mobile device).
Solution Approach 2:
The patent leverages the universality of mobile devices, which users already carry for communication and other purposes. Instead of requiring specialized hardware tokens, the system uses the mobile device's existing capabilities (camera for scanning QR codes, processor for generating OTPs, communication interfaces for transmission) to provide authentication functionality. This multi-functional approach reduces overall system complexity and eliminates the need for separate authentication hardware.
3Ease of operation
If QR code authentication is used, then ease of operation is improved, but vulnerability to cloning attacks increases
Solution Approach 1:
The patent implements periodic action through the use of one-time passwords that are valid only for a single authentication attempt or a limited time window. Each QR code scan generates a unique OTP that expires after use or after a short time period. This periodic/one-time nature of authentication prevents cloning attacks because even if a QR code or OTP is captured, it becomes invalid immediately after use or expiration, making replication useless.
Solution Approach 2:
The patent incorporates preliminary action through cryptographic camouflaging of seed keys. Before authentication occurs, the system establishes encrypted communication channels and securely stores cryptographic keys in a protected manner. The QR code itself may contain encrypted or encoded authentication data that requires decryption. This preliminary cryptographic preparation ensures that even if the QR code is cloned, the underlying cryptographic secrets remain protected and cannot be extracted to create valid authentication credentials.
Data Source
AI summary
Systems, apparatus, methods, and computer program products for using quick response (QR) codes for authenticating users to ATMs and other secure machines for cardless transactions are disclosed. Embodiments of the present disclosure read an image displayed on a display of an external device using a mobile device associated with a user authorized to access a secure resource, decode transaction information encoded in the image, transmit the transaction information and an identifier of the mobile device from the mobile device to an authentication system, and grant access to the secure resource if the transaction information and the identifier satisfy an authentication test performed at the authentication system.