QR Code Mobile Authentication for Credential Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Users often select weak or reused credentials for multiple accounts, exposing them to credential cracking due to fear of misremembering stronger credentials and the practice of using the same credentials across different services.
Innovation Solution
A method involving a quick response (QR) code system where a web application generates a QR code displayed on a computing device, allowing a mobile device to capture and authenticate user credentials securely, with the authentication server managing sessions and forwarding encrypted credentials to the web application for verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If users select strong credentials to improve security, then security is improved, but users may misremember credentials leading to authentication failures
Solution Approach 1:
The patent introduces a mobile device as an intermediary that stores credentials and generates one-time codes. Instead of users directly managing complex credentials, the mobile device mediates the authentication process by capturing QR codes, storing credential data, and generating time-limited authentication codes, thereby improving both security and ease of use
Solution Approach 2:
The system creates a copy of the credential verification process through QR code generation and mobile device capture. The authenticating system generates a QR code containing session information, which is captured by the mobile device to initiate authentication without requiring users to directly input or remember complex credentials
2Ease of operation
If users use the same credentials for multiple accounts to simplify login, then ease of operation is improved, but users become vulnerable to credential cracking
Solution Approach 1:
The system implements dynamic authentication where credentials are not static but change with each authentication session. The mobile device generates one-time codes that are valid only for specific sessions and time periods, making credentials dynamic rather than static, thus preventing credential cracking even if one account is compromised
Solution Approach 2:
The authentication system segments credentials into account-specific one-time codes generated by the mobile device. Instead of using a single master password across multiple accounts, each authentication request generates a unique code segment that is valid only for that specific authentication event, isolating the security risk to individual sessions
3Device complexity
If traditional username-password authentication is used, then implementation simplicity is maintained, but security is compromised due to weak or reused credentials
Solution Approach 1:
The patent replaces the mechanical interaction of typing passwords with optical interaction through QR code capture. The mobile device camera captures the QR code generated by the authenticating system, substituting the manual password entry mechanism with an automated optical recognition system that enhances security while maintaining user convenience
Solution Approach 2:
The mobile device serves multiple functions in the authentication process: it captures QR codes, stores credential data, generates one-time codes, and communicates with the authenticating system. This multi-functional approach consolidates security operations into a single device, simplifying the overall system architecture while enhancing security capabilities
Data Source
AI summary
Some embodiments provide a method for mobile device based user authentication. The method includes registering a session between a browser and a web application. The method also includes receiving a data object associated with the session and receiving a QR code from a mobile device that is captured from the browser. The method also provides for identifying the data object and sending the data object to the mobile device to retrieve user credentials. The method then receives an encrypted message comprising the user credentials from the mobile device. The encrypted message is then forwarded to the web application for authentication.