TW201349825A - Identity verification method and system using QR code - Google Patents

Abstract

The invention relates to an identity verification method using a QR code. The method is used to verify a client computer to determine whether the client computer is allowed to use internet service providing by a server. The method comprises steps of verifying an ID and a password transferring from the client computer, generating a QR code based on an unlocking code of a user data corresponding to the client computer while the ID and the password are accessed, and returning the QR code to the client computer for decoding. Then, verifying the unlocking code decoding from the QR code, and if the unlocking code is accessed, accessing the ID with the password to make the client computer being allowed to use internet service providing by the server.

Description

QR Code authentication method and system thereof

The invention relates to a website authentication mechanism, and in particular to a technique for applying a QR Code and an IMEI code to an authentication.

In today's society, access to various Internet services from the Internet through desktop computers and various portable devices such as notebook computers, mobile phones, and the like is already one of the indispensable daily activities in human life. . Websites that provide these services often have their own authentication mechanism to authenticate users who require logging in, in order to prevent illegal users from impersonating legitimate users from stealing resources on their websites.

A website's authentication mechanism traditionally only verifies an account number and a password. However, this traditional authentication mechanism is no longer safe with the advancement of hackers, Trojans, keyloggers or backdoors. . At present, in order to enhance the security of authentication, many websites not only use the traditional account and password as the first layer of authentication, but also use the so-called telephone security lock or SMS security lock (hereinafter collectively referred to as communication lock) as the second layer identity. For example, Taiwan Patent No. 200938277, 200612291, I326183, M371367, I271082, 200840305, 200109637, I288554, M354810, etc., China Patent No. 200410054863.3, 101247336, 1925397, and the like, and EP1445917, US7565297, US7657743, US7590847, and US7920851.

On the issue of enhancing the security of identity verification, the Taiwan I271082 patent case further mentions a machine code verification, that is, by verifying the MAC address, CPU serial number or other hardware serial number in a computer to confirm whether the computer is For legitimate client computers. Taiwan's 200709637 patent case mentions verifying the card number of a SIM card. The Taiwan 201135619 patent case also refers to the International Code of Conduct for Authentication (IMEI).

In addition, Taiwan 201021498 also mentioned converting a verification code into a QR code (Quick Response Code), while Taiwan 201135619 mentioned shooting and interpreting a user certificate card (credit card) by a portable electronic device. The QR code and the interpretation result (user identity data and credit card number) are submitted to an electronic transaction terminal, and similar technical contents are also mentioned in Japanese JP2008146363A, JP2009064400A and other patent cases.

The main problem with using the above communication locks as Layer 2 authentication is that more costs are required. For example, website builders need to pay high fees to rent telephone lines to telephone service providers and establish telecommunications that can make and receive calls or text messages. Device, and the user has to pay for a call or text message each time they log in to the site.

The QR Code authentication method and system thereof of the present invention can effectively solve the above problems, and the security is high, and the account password can be effectively prevented from being stolen.

More specifically, the QR Code authentication method of the present invention is used to verify a client computer to determine whether the client computer can access a network service provided by a network computer device. The database of the server computer device stores one or more user data of the user, and each user data includes an account, a password and an unlock code of a legitimate user. The method first performs a first re-authentication on an account number and a password from the client computer, and after verification, generates a QR Code according to an unlock code in the user profile corresponding to the client computer, and the QR code Code is passed back to the client computer. At this time, the user of the client computer can use an unlocking device (mobile phone) to capture and interpret the QR Code on the client computer, and transmit the unlock code decoded from the QR Code to the server device. For the second verification. When the unlock code decoded from the QR Code is the same as the unlock code in the user profile, the verification is passed, and the unlocked state of the account and password of the user profile is released, so that the client computer can be obtained. Use the network services provided by the network computer device.

Preferably, the unlock code is an IMEI code in a mobile phone of a user of the client computer, a random code calculated according to the IMEI code, or a combination of the two.

The invention also provides a network system for implementing the above method, which comprises the above server computer device, a client computer and an unlocking device. The server computer device is installed with a verification program, and can execute the above method according to the instructions of the verification program. The unlocking device is provided with a QR Code interpreter and can perform the steps of photographing and interpreting the QR Code generated in the method according to the instruction of the QR Code interpreter.

Preferably, the unlocking device automatically returns the unlock code decoded from the QR Code to the server computer device via the Internet.

Preferably, the server computer device further installs a registration code generation program, and the server computer device executes a registration code generation method according to the instruction of the registration code program, and the method first verifies an account number from the user terminal computer and a password, and after the verification is passed, an unlock code from the client computer is written into the database as an unlock code in the user profile, a registration code is generated according to the unlock code in the user profile, and the registration is transmitted. Code to the client computer. The unlock code is an IMEI code, and the registration code can be used to verify the QR Code interpreter in the unlocking device.

The present invention provides a QR Code interpreter for installing the unlocking device. The QR Code interpreting program has a registration code verification module, and the unlocking device performs a shooting when the QR Code interpreting program is started. Before the step of interpreting the QR Code, a registration code verification method is executed according to the instruction of the registration code verification module, and the method generates a local registration code based on the IMEI code in the unlocking device, and verifies whether the registration code is the same. After the local registration code is verified, the QR Code interpreter directly performs the steps of shooting and interpreting the QR Code at the next startup, and the registration verification method is no longer prioritized.

The present invention also provides another QR Code interpreter for installing the unlocking device. The other QR Code interpreting program has a registration module, and the unlocking device executes when the other QR Code interpreting program is started. Before the step of taking and interpreting the QR Code, a registration method is executed according to the instructions of the registration module. The method first transmits an account number, a password and an IMEI code of the unlocking device to the server computer device for registration verification, and when the registration success message is received from the server device, the QR Code is solved. The translation program directly performs the steps of shooting and interpreting the QR Code the next time it is launched, and the registration method is no longer prioritized.

Preferably, the server computer device is installed with a registration verification program, and after receiving the account number, password and IMEI code transmitted by the unlocking device, the registration verification method is executed according to the instruction of the registration verification program. The method first verifies the account number and password sent from the unlocking device, and after passing the verification, writes the IMEI code from the unlocking device into the database as the unlocking code in the user data, and returns the above registration. A success message is given to the unlocking device.

Other inventive aspects and more detailed technical and functional descriptions of the present invention are disclosed in the following description.

The block diagram of the first diagram shows a preferred embodiment of the system of the present invention, the system comprising at least a server computer device 1, a client computer 2 and an unlocking device 3 linked by the Internet 9. The server computer device 1 can be composed of one or more computers and installs an operating system (OS), a database, and related programs necessary for generating a network service. Preferably, the computers are server-class computers. The web service is preferably an online game service, but not limited to this. The client computer 2 can be a desktop computer, a tablet computer, a smart phone, a notebook computer, or other electronic device that can be linked to the server computer device 1 through the Internet.

The database 10 of the server device 1 stores one or more user data 100 of the user. Each user profile 100 includes an account 101, a password 102, an unlock code 103, and the like of a legitimate user. Information related to the legal user identity. Preferably, the unlock code 103 is an IMEI code (International Mobile Equipment Identity number) of a mobile phone of the legitimate user. In addition, the unlock code 103 may also be a random code randomly calculated according to the IMEI code, or a combination of the IMEI code and the random code.

When a new user wants to obtain the network service, the application is submitted to the server device 1 according to an established application procedure. Once the application is completed, the user profile 100 of the new user is written into the database 10. . If the new user applies for an account lockout service to the server device 1, the account 101 and the password 102 are locked, which means that the unlock code 103 needs to be unlocked in the future to be unlocked. The account 101 and password 102 can be used to log in to the server device 1. The unlock code 103 may be written into the database 10 by the manual input operation of the new user in the process of applying for the account lock service. However, the unlock code 103 may be retained in the step S24 shown in the third figure. This is written into the database 10, which will be described later.

A verification program 110 is also installed in a verification server 11 of the server computer device 1. The verification server 11 executes an identity verification method using the QR Code according to the instructions in the verification program 110. Any client computer 2 linked to the server device 1 of the server device must be authenticated by the method and then allowed to obtain the network service.

The unlocking device 3 is a computer device or a telephone device owned by the user, and has at least a function of capturing and interpreting a QR Code, such as a smart phone or tablet having a camera function and having a QR Code interpreter installed thereon. . Since the unlocking device 3 can perform the steps of performing shooting and interpreting a QR Code according to the instruction of the QR Code interpreter, the user can use it to capture and interpret one of the above-mentioned authentication methods. QR Code. In more detail, as shown in the second figure, the method includes:

Step S11: Receive an account number and a password from the client computer 2 via the Internet 9.

Step S12: Is the account number and the password equal to the account number 101 and the password 102 of one of the user profiles 100 in the database 10?

Step S13: When the comparison result is “No”, it indicates that the user of the client computer 2 is an illegal user, and at this time, a message indicating that the verification is failed is sent back to the client via the Internet 9 Computer 2.

Step S14: When the comparison result is YES, the unlock code 103 of one piece of user data 100 and the website address of the verification server 11 are converted into a QR Code. Preferably, the unlock code 103 of one of the user profiles 100 can be converted into a QR Code separately. At this time, the URL of the verification server 11 needs to be recorded in the QR Code interpreter installed in the unlocking device 3. .

Step S15: The QR Code is transmitted to the client computer 2 via the Internet 9.

When the client computer 2 receives the QR Code from the verification server 11, the user can use the unlocking device 3 to capture and interpret the QR Code displayed on the display of the client computer 2, and then The unlock code decoded by the unlocking device 3 is transmitted back to the verification server 11. There are two ways of returning, one is automatically returned by the unlocking device 3 via the Internet 9, and the other is that when the unlocking device 3 does not have the function of automatic returning, the unlocking device 3 is viewed by the user. The result of the interpretation is displayed, and the decoded result, that is, the unlock code or the decoding lock and the website address, is manually input into the client computer 2, and the unlock code decoded by the client computer 2 is interpreted. It is passed back to the verification server 11.

Generally, the verification server 11 gives the QR Code a survival time, and the user must return the unlocked code decoded according to the interpretation result of the QR Code by the unlocking device 3 within the survival time of the segment. When the verification server 11 expires, the verification server 11 ignores the QR Code. At this time, the user can only link the server computer device 1 through the client computer 2, and transmit an account and a password again, so that the authentication server 11 of the server device 1 can transmit the new process according to the above process. The QR Code is given to the client computer 2.

Then proceed to the following steps.

Step S16: The unlock code decoded from the QR Code is received via the Internet 9.

Step S17: Align whether the unlock code decoded from the QR Code is the same as the unlock code 103 of one of the user profiles 100 in the database 10.

Step S18: When the comparison result is "No", a message indicating that the unlocking failure is sent to the client computer 2 is returned via the Internet 9, and the account 101 and password of the one of the user profiles 100 are maintained. The locked state of 102 is such that the server computer device 1 refuses to provide the network service to the client computer 2.

Step S19: When the comparison result is "Yes", the locked state of the account 101 and the password 102 of the one of the user profiles 100 is released, so that the server computer device 1 provides the network service to the client computer 2.

As can be seen from the above description, the system of the present invention has a first re-authentication mechanism for verifying an account password and a second re-authentication mechanism for verifying an unlock code (IMEI code), and the unlock code in the second re-authentication mechanism is a QR Code. The form is transmitted back to the verified person. Therefore, the system of the present invention not only has high security but can effectively prevent illegal user intrusion, and the service provider in the system does not need to rent a telephone line and establish a telecommunication device, and the user in the system does not need to The cost of making a phone call or text message is extra for accessing the web service.

In addition, the present invention provides two third re-authentication mechanisms to further improve the security of the system, one of which is mainly designed for the unlocking device 3 without the link network function, and the other is for the network with the link. The functional unlocking device 3 is designed to be further described in the following further preferred embodiments and further preferred embodiments of the present invention. Referring to the first figure, in another preferred embodiment of the present invention, the server computer device 1 further includes a registration code generating program 111 (optionally installed on the verification server 11 or another server). The QR Code interpreter in the unlocking device 3 further includes a registration module. The server device 1 executes a registration code generation method according to the instruction of the registration code generation program 111. As shown in the third figure, the method includes:

Step S21: Receive an account, a password and an unlock code from the client computer 2 via the Internet 9. The data is manually input by the user of the client computer 2 and transmitted to the server computer device 1.

Step S22: Is the account number and password equal to the account number 101 and password 102 of one of the user profiles 100 in the database 10?

Step S23: When the comparison result is "No", it indicates that the user of the client computer 2 is an illegal user, and at this time, a message indicating that the authentication failed is returned to the client via the Internet 9 Computer 2.

Step S24: When the comparison result is "Yes", the unlock code is written into the database 10 as the unlock code 103 in the piece of user data 100;

Step S25: generating a registration code according to the unlock code 103 in the piece of user data 100;

Step S26: The registration code is transmitted to the client computer 2 via the Internet 9.

Then, the user of the client computer 2 can use the registration code to "verify" the QR Code interpreter on the unlocking device 3. In more detail, the unlock code 103 in the above step S24 is an IMEI code, and the unlocking device, when the QR Code interpreter is started, will follow the steps of “taking and interpreting the QR Code”. Before executing the registration code verification method according to the instruction of the registration code verification module, as shown in the fourth figure, the method includes:

Step S31: Receive the registration code input by the user.

Step S32: Reading an IMEI code in the unlocking device 3.

Step S33: Generate a local registration code according to the read IMEI code. Since the mechanism for generating the local registration code is the same as the mechanism for generating the registration code in step 25 above, as long as the IMEI code read is the same as the unlock code 103 (IMEI code) in step 25, then this step is performed. The generated local registration code should be identical to the registration code received in step S31.

Step S34: comparing whether the registration code received is the same as the local registration code;

Step S35: When the comparison result is "No", the QR Code interpreter is only preferentially executed when the next time the program is started; or, the QR Code interpreter is actively removed; or, Making the QR Code interpreter no longer available;

Step S36: When the comparison result is “No”, the QR Code interpreter is directly executed to perform the process of capturing and interpreting the QR Code at the next startup, and the registration code verification method is no longer preferentially executed.

As can be seen from the description of the other preferred embodiment, the system of the present invention also performs a third re-verification by the server computer device 1 according to the registration code generated by the unlock code 103 (IMEI code). It is determined whether the QR Code interpreter on the unlocking device 3 (which may not have the link network function) can be executed for capturing and interpreting a QR Code. This will of course further improve the security of the entire system.

Referring to the first figure, in another preferred embodiment of the present invention, the server computer device 1 further includes a registration verification program 112 (optionally installed on the verification server 11 or another server). The QR Code interpreter in the unlocking device 3 further includes a registration module.

In more detail, when the QR Code interpreter is activated, the unlocking device 3 performs a registration method according to the instruction of the registration module before the "step of capturing and interpreting the QR Code" described above. As shown in the fifth figure, the method includes:

Step S41: Receive an account number and a password input by the user.

Step S42: Read an IMEI code in the unlocking device 3.

Step S43: The received account number, password and the read IMEI code are transmitted to the server computer device 1 via the Internet 9 for registration verification (described later).

Step S44: When receiving the registration success message from the server computer device 1, the QR Code interpreter is directly executed to perform the above “step of shooting and interpreting the QR Code”, The registration method is executed first. In contrast, if the received registration failure message is sent, the QR Code interpreter will only preferentially execute the registration method when it is started next time; or, actively remove the QR Code interpreter; or, The QR Code interpreter can no longer be launched.

After receiving the data transmitted by the unlocking device 3 in the step S43, the server computer device 1 starts to perform a registration verification method according to the registration verification program 112. As shown in the sixth figure, the method includes :

Step S51: Receive the account number, password and IMEI code transmitted by the unlocking device 3.

Step S52: Align whether the received account number and password are the same as the account number 101 and the password 102 of one of the user profiles 100 in the database 10.

Step S53: When the comparison result is "No", the registration failure message is sent back to the unlocking device 3 via the Internet 9.

Step S54: When the comparison result is “Yes”, the received IMEI code is written into the database 10 as the unlock code 103 in the one of the user profiles 100, and is returned to the registration success message. The unlocking device 3.

As can be seen from the above description of the further preferred embodiment, the system of the present invention performs a third verification that determines the unlocking device 3 by means of the manner in which the server computer device 1 verifies the IMEI code of the unlocking device 3 ( Whether the QR Code interpreter on the link network function can be executed to capture and interpret a QR Code. This of course will improve the security of the entire system.

In any event, anyone can obtain sufficient teaching from the above description, and it is understood that the present invention is indeed different from the prior art, and is industrially usable and progressive. It is the invention that has indeed met the patent requirements and has filed an application in accordance with the law.

1. . . Server computer equipment

10. . . database

100. . . user information

101. . . account number

102. . . password

103. . . Unlock code

11. . . Authentication server

110. . . Verifier

111. . . Registration code generation program

112. . . Registration code verification program

2. . . Client computer

3. . . Unlocking device

9. . . Internet

The first figure is a block diagram of the system of the present invention.

The flowchart in the second figure is for explaining the authentication method using the QR Code of the present invention.

The flowchart in the third figure is for explaining the registration code generation method of the present invention.

The flowchart in the fourth figure is for explaining the registration code verification method of the present invention.

The flowchart in the fifth figure is for explaining the registration method of the present invention.

The flowchart in the sixth diagram illustrates the registration verification method of the present invention.

1. . . Server computer equipment

10. . . database

100. . . user information

101. . . account number

102. . . password

103. . . Unlock code

11. . . Authentication server

110. . . Verifier

111. . . Registration code generation program

112. . . Registration code verification program

2. . . Client computer

3. . . Unlocking device

9. . . Internet

Claims (11)

An authentication method using QR Code, which is applied to a verification server of a server computer device for determining whether a client computer can access the network service provided by the server device, the server computer The user database of the device stores one or more user data of the user, and each user data includes an account, a password and an unlock code of the user, and the method includes:
Receiving an account and a password from the client computer via the internet;
Whether the account number and password are the same as the account number and password of one of the user data in the database;
When the comparison result is "No", a message indicating that the verification failed is sent back to the client computer via the Internet;
When the comparison result is "Yes", the unlock code of one of the user data is converted into a QR Code;
Transmitting the QR Code to the client computer via the internet;
Receiving an unlock code decoded from the QR Code via the internet;
Comparing whether the unlock code decoded from the QR Code is the same as the unlock code of one of the user data in the database;
When the comparison result is "No", a message indicating that the unlocking failure is sent to the client computer is returned via the Internet, and the lock state of the account and password of one of the user profiles is maintained; When the result is "Yes", the lock status of the account and password of one of the user data is released. The method of claim 1, wherein the unlocking code is an IMEI code in a mobile phone of a user of the client computer, a random code calculated according to the IMEI code, or both. The combination. The method of claim 1, wherein in the step of converting the unlock code of one of the user data into the QR Code, the unlock code of one of the user data is converted together with the URL of the verification server. Into the QR Code. A network system includes a server computer device linked by an internet connection, a client computer and an unlocking device, wherein the server computer device provides a network service and has one of the verification programs installed to verify The server system and a database store one or more user data of the user, each user data includes an account, a password and an unlock code of the user, and the verification server can perform the verification according to the verification The program's instructions execute an authentication method using QR Code, which includes:
Receiving an account and a password from the client computer via the internet;
Whether the account number and password are the same as the account number and password of one of the user data in the database;
When the comparison result is "No", a message indicating that the verification failed is sent back to the client computer via the Internet;
When the comparison result is "Yes", the unlock code of one of the user data and the URL of the verification server are converted into a QR Code;
Transmitting the QR Code to the client computer via the internet;
Receiving an unlock code decoded from the QR Code via the internet;
Comparing whether the unlock code decoded from the QR Code is the same as the unlock code of one of the user data in the database;
When the comparison result is "No", a message indicating that the unlocking failure is sent to the client computer is returned via the Internet, and the lock state of the account and password of one of the user profiles is maintained; When the result is "Yes", the lock status of the account and password of one of the user data is released;
The unlocking device is installed with a QR Code interpreter and can perform the steps of capturing and interpreting the QR Code according to the instruction of the QR Code interpreter. For example, in the network system described in claim 4, the unlocking device performs the following steps according to the instruction of the QR Code interpreter:
The unlock code decoded from the QR Code is automatically returned to the server computer device via the Internet. For example, in the network system described in claim 4, the server computer device further includes a registration code generating program, and the server computer device executes a registration code generating method according to the instruction of the registration code generating program, and the method includes :
Receiving an account, a password and an unlock code from the client computer via the internet;
Whether the account number and password are the same as the account number and password of one of the user data in the database;
When the comparison result is "No", a message indicating that the verification failed is sent back to the client computer via the Internet;
When the comparison result is "Yes", the unlock code is written into the database as an unlock code in the piece of user data;
Generating a registration code according to the unlock code in one of the user profiles; and transmitting the registration code to the client computer via the Internet. The network system of claim 6, wherein the unlocking code of the one piece of user data is an IMEI code, and the QR Code interpreting program has a registration code verification module, and the unlocking device starts the When the QR Code interpreter is executed, a registration code verification method is executed according to the instruction of the verification module before the step of capturing and interpreting the QR Code, and the method includes:
Receiving the registration code entered by the user;
Reading an IMEI code in the unlocking device;
Generating a local registration code according to the read IMEI code;
Aligning whether the received registration code is the same as the local registration code; and when the comparison result is "Yes", causing the QR Code interpreter to directly perform shooting and interpreting the QR Code when it is started next time. In the step, the registration code verification method is no longer preferentially executed. The network system of claim 4, wherein the unlock code of the one piece of user data is an IMEI code, and the QR Code interpreter has a registration module, and the unlocking device starts the QR Code. When interpreting the program, a registration method is executed according to the instructions of the registration module before the step of capturing and interpreting the QR Code, the method includes:
Receiving an account number and a password input by the user;
Reading an IMEI code of the unlocking device;
Receiving the received account number, password, and the read IMEI code to the server computer device via the Internet for registration verification; and upon receiving a registration success message from one of the server computer devices, The QR Code interpreter will directly perform the steps of shooting and interpreting the QR Code the next time it is launched, and the registration method will no longer be prioritized. For example, in the network system described in claim 8, the server computer device is installed with a registration verification program, and executes a registration verification method according to the instruction of the registration verification program, and the method includes:
Receiving the account number, password and IMEI code transmitted by the unlocking device;
Comparing whether the received account number and password are the same as the account number and password of one of the user data in the database;
When the comparison result is "No", the registration failure message is sent to the unlocking device via the Internet; and when the comparison result is "Yes", the IMEI code is written into the database. As the unlock code in one of the user profiles, the registration success message is returned to the unlocking device. A QR Code interpreting program for installing an unlocking device having a camera function and storing an IMEI code, the QR Code interpreting program having a registration code verification module, and the unlocking device starts the QR Code interpreting program A registration code verification method is first executed according to the instruction of the registration code verification module, and the method includes:
Receiving a registration code entered by the user;
Reading the IMEI code in the unlocking device;
Generating a local registration code according to the read IMEI code;
Comparing whether the received registration code is the same as the local registration code; and when the comparison result is "Yes", the QR Code interpreter is directly executed to perform shooting and interpretation of a QR Code when it is started next time. In the step, the registration code verification method is no longer preferentially executed. A QR Code interpreting program for installing an unlocking device having a photo and link network function and storing an IMEI code, the QR Code interpreting program having a registration module, the unlocking device starting the QR Code solution When the program is translated, a registration method is first executed according to the instructions of the registration module, and the method includes:
Receiving an account number and a password input by the user;
Reading the IMEI code in the unlocking device;
Receiving the received account number, password and the read IMEI code via the Internet to the server computer device for registration verification; and upon receiving a registration success message from the server device In order to enable the QR Code interpreter to directly perform the steps of shooting and interpreting a QR Code at the next startup, the registration method is no longer prioritized.