CN103258265A - ID authentication method based on representation of barcode - Google Patents

Abstract

A barcode which is generated by a mobile phone or represents an ID of a user is used. Various treatment which needs ID authentication such as electronic payment in electronic commerce is finished through the ID represented by the barcode. Due to the fact that the barcode needs to be represented through a picture, a secure channel cannot be set up just like NFC or other communication methods. In order to prevent the ID from being masked, a usual method comprises the step that the user inputs a PIN to further carry out confirmation. In the ID authentication method based on the representation of the barcode, the authentication of the PIN is replaced by the method using a dynamic authentication code. The dynamic authentication code is guaranteed to be effective only in a certain time range. The user just needs to prevent the own barcode from being stolen in the certain time, and then safety of the ID authentication can be guaranteed, so that authentication procedures are simplified and the needed time is shortened, and the above equal safety is guaranteed. An irreversible Hash value is adopted in the process of transmission of the dynamic authentication code, and the phenomenon that authentication information contained in an authentication code cannot be copied is guaranteed.

Description

ID authentication method based on bar code representation

Technical Field

The invention relates to the field of electronic commerce, in particular to the field of security authentication application of electronic commerce.

Background

1. Background of the invention

For payment of a smart phone with an NFC chip, specifications such as SecureElement and the like are not unified, and specifications of a mobile phone manufacturer and an operator manufacturer are different, so that great difficulty is brought to import and commercial operation. In this context, there is a need in the market for a more convenient method to initiate mobile-based electronic payments during the dawn of NFC smartphones to get market support first.

2. Objects of the invention

ID authentication is completed by using the representation of the bar code, and the problem that the bar code cannot establish a Secure Channel (Secure Channel) but needs to ensure security is solved.

Disclosure of Invention

The ID of the user is represented in the form of a bar code through the smart phone, and ID authentication is completed through an authentication code related to the ID. And the dynamic authentication code with certain timeliness is used for generating the bar code so as to solve the problem that the bar code is easy to copy in the process of representation.

The invention has the advantages that:

1. before the popularization of the NFC mobile phone, an electronic payment mode based on the smart phone is introduced in advance.

2. In comparison with the U.S. patent application No. US2012185317, Mobile Barcode Generation and Payment (Mobile bar code Generation and Payment) proposed by Ebay Inc, the scheme of the present invention employs dynamic barcodes, which solves the security problem caused by Barcode display.

Drawings

FIG. 1 is a schematic diagram of the system configuration

FIG. 2 group length diagram of mobile phone payment procedure part

FIG. 3 composition of dynamic Bar codes

FIG. 4 method for generating dynamic bar code

FIG. 5 Bar code based Payment flow

FIG. 6 authentication processing method

FIG. 7 application of different kinds of barcodes

Detailed Description

In the ID barcode described in U.S. patent application No. US2012185317, information required for authentication is added. The authentication information uses a dynamic authentication code method, so that the bar code representation is different every time. Therefore, even if the bar code information is stolen and leaked, the bar code information cannot be used maliciously.

FIG. 1 is a schematic diagram of the system configuration

The system comprises:

1. a handset 1 in which a barcode authentication based program is deployed for generating/representing a barcode 7.

2. The network 2, the internet, transmits data by a protocol such as HTTPs, and may use a LAN for the equivalent replacement and an underlying Socket communication scheme.

3. The central server 3 is used for recording electronic money or processing other electronic money derivative electronic records such as commodity discount coupons, member discount coupons, group buying members, commodity coupons and the like similar to the electronic money. The server is a general physical server with a CPU, a memory and a NIC, and can also be a virtual server based on the physical server. A barcode authentication program 31 is disposed in the server 3, and authentication processing is performed according to the barcode authentication method explained in the present invention.

And 4, the POS terminal 4 finishes the functions of cash register and the like. The POS terminal is a computing device having a CPU, memory, storage, OS. Deploying a goods vending-related program on the OS.

5. The barcode device 5 is a standard device generally used by vendors to identify the ID presented by the mobile phone.

In actual practice, the POS terminal 4 and the ID identifying device 5 may be integrated into one device, and the actual processing and configuration thereof are the same as those of the separate type.

The mobile phone is provided with a display screen, a CPU and a storage unit, and Android is deployed in the storage unit^TMEtc. a general-purpose OS. In the mobile phone with the structure, a program is deployed according to the following diagram:

FIG. 2 is a deployment diagram of a barcode-based authentication procedure

In the general OS of the mobile phone, a program 10 based on bar code authentication is deployed, and the program 10 based on bar code authentication includes a bar code generation module 101 and other functional modules 102

The bar code generating module generates a dynamic bar code by using a method described in a subsequent section; the other function module 102 implements functions required for electronic money or electronic money derivatives, and no related claims are made in the present invention.

In the method for displaying the barcode, (for simplicity, a conventional barcode (barcode) and a 2-dimensional code Matrix (2D) barcodes are simply referred to as barcodes), since the barcodes must be read by screen representation, Secure channel cannot be established as in NFC communication, and thus secret communication is performed. In this case, the bar code representation must be protected from being stolen and copied. The invention adopts a method for generating disposable bar codes.

FIG. 3 composition of disposable bar code

The information of the bar code includes

1. A user ID110, which is not encrypted, as a generally readable information (playcontext) representation transfer

2. The dynamic authentication code (dynamic AuthCode)111 for authentication contains a password 1111 and a variable part 1112. To ensure that the information of the bar code is not leaked in the representation process, MD5 and SHA series hash values are adopted. Further, the content can be easily implemented by using the HMAC function.

For simplicity, the model in apostrophe is used.

Authcode user authentication code

The UID, the user ID110,

pwd is the password 1111, and the invention adopts a common secret key which is kept in the encryption field of the mobile phone.

Variable portion 1112, where T takes the current time of day as an example. Considering that there may be an error between the current time of the handset terminal 1 and the current time in the server 3, Δ T is adopted as a variable part in the present invention, where Δ T = T_current –T_duration T_currentFor the current time, T_durationIs a period of blurring.

For ease of understanding, a further example is when the current time is 2013/4/1011: 08:34.234 and the ambiguity period is 10 minutes

Δ T' = 2013/4/1011: 08: 34.234-0000/00/0000: 08:34.234 = 2013/4/1011: 00:00.000, and finally, in the format of a character string

△T = 201304101100

The example is only for describing the implementation method, other derivation methods can be provided under the same design idea, and the variable part includes but not limited to time.

AuthCode = Hash (UID ≧ P ≧ Δ T), where the Hash function may be a Hash function of the MD, SHA series.

BarCode = {UID, AuthCode}

Also, AuthCode can be handled using HMAC to enhance security, in the same manner as the hash. The HMAC value was calculated according to the following formula.

${\mathrm{HMAC}}_K(\mathrm{Pwd},\mathrm{\ΔT})=h\left((\mathrm{Pwd}\⊕\mathrm{opad})\right||\left((\mathrm{Pwd}\⊕\mathrm{ipad})\right|\left|\mathrm{\ΔT}\right))$

Wherein,

h-hash function, which is referred to herein as a composite hash function using MD5(SHA-1), any other hash function may be used as an equivalent alternative.

Pwd-is the password 1111 and,

Δ T is a variable portion 1112, so the result differs for each AuthCode

opad is the constant number 0x36, which is continuous for 64 times

ipad is given by the constant number 0x5C, and is continuously processed 64 times

For XOR arithmetic and computation

The actual code can refer to http:// www.atoam.com/proxy/HMAC, and the HMAC is a cryptographic method defined by RFC-2104, so the mathematical demonstration of the security strength can refer to the related papers. Belore (1996) dying hash functions for message authentication

Due to the irreversibility of MD5 and SHA-1, HMAC is guaranteed_K(m) while transmitting, the authentication code passes through the POS, but the POS cannot interpret the password contained in the AuthCode, and recent studies on the security vulnerability of MD5 have shown that the mere conflict of MD5 makes it no longer secure to use MD5 alone, so the composite hash function of MD5(SHA-1) is used in the present invention.

FIG. 4 dynamic Bar code Generation step

The dynamic bar code generation processing program is deployed at the mobile phone terminal, and the generation steps are as follows:

g1 obtains user ID (110)

G2 get password 1111

G3 calculates variable portion 1112

G4 uses hash function to generate dynamic authentication code, this step can also use pad filling mode of HMAC function to increase security intensity.

G5 concatenates the above to generate an image of the barcode. The bar code image generation method has various generation tools at present, such as android^TMUnder the platform, bar code libraries such as Zxing can be directly utilized.

And the generated bar code image is displayed on a screen of the mobile phone, the display time is controlled, and the bar code image is stopped when the time exceeds a preset time period. And regenerating the barcode image of the next time period according to the method. Therefore, each bar code is guaranteed to have timeliness, and the bar code without timeliness cannot be used as an ID to pass the authentication of the server side.

FIG. 5 Bar code based ID authentication Process flow

Taking the electronic money payment process as an example, in a system including the barcode recognizer 5, the POS terminal 4, and the server 3, the flow of ID authentication process based on the barcode is as shown in the figure:

a1 user displays bar code through mobile phone; the barcode reader 5 reads the displayed barcode;

a2 Bar code recognizer for converting read image into character string

A3 bar code recognizer for transmitting the character string to POS terminal 4;

a4 POS terminal 4 transmits the character string to server 3

A5 Server 3 authenticates character string according to authentication method of succeeding chapter

A6 Server 3, transmitting the authentication result to POS

The a7 POS notifies the user of the successful payment by screen image and sound.

The above steps illustrate an authentication processing flow based on a barcode, and different from the patent application number US2012185317, a method of inputting a PIN for confirmation in a payment process by a user instead of using a barcode effective in a short time is adopted. Such processing can reduce the time required for payment with the same degree of security. Optionally, a PIN verification step may be added to further increase security strength.

In step a3, the barcode identifier 5 and the POS4 are connected by interfaces such as USB and bluetooth, and when they are integrated, data are exchanged by a data transfer method provided by the OS.

FIG. 6 authentication processing method

In the server 3, a barcode authentication processing program 31 is deployed, and the authentication processing method is as shown in the figure:

a51 obtains the authentication character string { ID, Authcode }

A52 obtains and holds the ID and Authcode from the authentication text column, which are used for comparison in subsequent steps

A53 obtaining password from server

A54 calculates variable part from server according to current time in the same way

A55 dynamic authentication code was generated from the server in the same manner as above and saved as Authcode'

A56 compares Authcode ' obtained from barcode recognizer with Authcode ' calculated by server '

A57 if the results are consistent, setting the authentication to pass

A58 if the results are not consistent, setting the result as authentication failure

In the steps a 53-a 55, the processing method is the same as the method for generating the authentication code at the mobile phone terminal. Because the mobile phone end and the server end store the same common secret key, no third party can generate the same authentication code on the premise that the secret key is kept secret. Meanwhile, because of the adoption of the irreversible hash function, the safety problem of information leakage can not occur in the transmission process, thereby realizing the same safety as the Secure Channel.

In the step a58, if the results are inconsistent, it may be that the authentication code is stale, and considering availability, the last time unit may be compromised, and the authentication result may be recalculated and determined.

Through the above processing, the generation and authentication processing of the dynamic barcode is completed. In practical applications, the barcode ID authentication method provided by the present invention can be used in authentication processing applied to electronic money, and discount coupons, merchandise tickets, merchandise points, and the like related to electronic money.

In practical applications, there are different examples of using various kinds of barcodes.

FIG. 7 application of different kinds of barcodes

For a 2D barcode 71 represented by a QR code, generally, each barcode may represent 7089 numbers, or 4296 characters, and one barcode may include an ID and a dynamic authentication code.

For the global unified conventional one-dimensional barcode 72 with the UPC conforming to the ISO/IEC 15420 standard, since one barcode can only represent 13 digits, the dynamic authentication code also needs to be Hex-converted and a certain number of digits are cut to be represented. In order to ensure the safety, the invention adopts two sections of bar codes to represent the ID and the dynamic authentication code, at this time, the bar code representing the ID is fixed, and the dynamic authentication code is a variable bar code with timeliness.

Through the implementation method, the invention realizes the purpose of completing the identification and authentication of the ID by using the mobile phone in a bar code mode.

The above description has been made of specific embodiments of the present invention, and the description of the embodiments is only used to help understanding the method and core idea of the present invention; also, for those skilled in the art, variations may be made in the embodiments and applications without departing from the spirit of the invention, such as

1. The structure of the invention is slightly modified, and the non-important units are increased/reduced and are integrated or independent from the related units;

2. combining a bar code recognizer and a POS (point of sale), and adopting integrated equipment, wherein the structure and the processing method are the same;

3. the same processing method is placed in other servers, and separation is carried out meaninglessly;

4. carrying out micro-adjustment of the step sequence, such as exchanging the treatment without the sequence;

5. the encryption or necessary security processing is cancelled, and unsafe inferior services are simply provided;

6. the name of the constituent element is changed, and the technical content is changed, such as changing the electronic money server to the gift certificate server.

Therefore, the present disclosure should not be construed as limiting the invention, and any modifications, equivalent substitutions, or alterations to the additional steps that are within the spirit and principle of the invention are intended to be included within the scope of the invention.

Claims (9)

1. A system for representing bar code by mobile phone and completing authentication by bar code is characterized in that the authentication system comprises

(1) User's mobile phone for generating and representing bar code

(2) Network for communication between a server and a POS terminal

(3) A server for storing electronic records such as electronic money and performing bar code authentication

(4) POS terminal for completing payment function

(5) And the bar code recognizer is used for recognizing the bar code.

2. The user's handset of claim 1, comprising a display screen, a CPU, memory as hardware, and a standard OS as a software platform.

3. The server according to claim 1, comprising a CPU, a memory, a storage, and a NIC as hardware, and a standard OS as a software platform.

4. The bar code identifier and POS terminal of claim 1, wherein the two forms are independent and integrated.

5. A bar code generation/representation method is realized by a bar code generation module deployed in a mobile phone.

6. The bar code of claim 5, comprising a user ID and a dynamic authentication code, wherein the dynamic authentication code is time sensitive and the authentication code that is not time sensitive cannot be used for user ID authentication.

7. The dynamic authentication code according to claim 6, wherein the authentication code includes a common secret key encrypted by a hash function and a variable part of information, and the dynamic authentication code has an irreversible characteristic and cannot recover the transmitted information such as the common secret key from the authentication code.

8. A bar code authentication method is realized by a bar code authentication program deployed in a server.

9. The method of authenticating a bar code according to claim 8, comprising the step of

(1) Get the authentication text column, { ID, Authcode }

(2) Obtaining and holding ID and Authcode from authentication character column

(3) Obtaining a password from a server

(4) The variable part is calculated from the server in the same way according to the current time

(5) The dynamic authentication code is generated from the server according to the same method and stored as Authcode'

(6) Authcode ' obtained from barcode recognizer is compared with Authcode ' calculated by server '

(7) If the results are consistent, the authentication is set to pass

(8) And if the results are inconsistent, setting the result as authentication failure.

Images