TWI495321B - Qr code authentication system combining dynamic passwords and method thereof - Google Patents

Description

QR code authentication system combined with dynamic password and method thereof

The present invention relates to a QR code (Quick Response Code) authentication service mechanism, and more particularly to a QR code authentication system for verifying that a user retrieves a QR code at a specific place and a method thereof.

With the rapid development of technology, information transmission can no longer be expressed by words or numbers. At present, it is also possible to use image hiding information, barcodes and other means for users to obtain content through different devices or methods. Reduce the amount of information presented (the required length), and have the advantages of being easy to carry and obtain.

For image hiding information, the use of mathematical conversion calculations in order to get the information hidden inside, is not common in life and is difficult to use for the average user. For bar codes, the ones that are commonly used in the past are one-dimensional bar codes, that is, patterns arranged in black and white lines, which are commonly used on product packaging to describe the country of manufacture, manufacturer, date of manufacture, etc. In the book management, the books are classified or recorded by barcodes, so the barcodes are widely used in commodities, book management, and even postal or banking. In addition, QR code (a common two-dimensional bar code) is commonly used, which is presented in a square pattern of black and white. It has a wide range of applications, including agricultural history, government/commercial activities, product content, and introduction guides. Commercial activity discounts and personal business cards, etc., are mostly used for text display or link to specific web pages for users to obtain information to be transmitted, and thus are widely used. However, because the QR code is easy to copy, for example, by photocopying, taking photos, etc. Reproduction, so the current emphasis on simple information transfer or discount volume gift, the main reason is that the current technology can not determine when and where the user scans a specific QR code, so in order to avoid speculation or inappropriate use, it is still difficult to further Deep application of QR code.

Therefore, how to provide an authentication mechanism to ensure the normal use of the QR code, while providing other auxiliary verifications when the QR code is used, to avoid the QR code being copied and used at an inappropriate time or place, or to use the QR code for others. It can improve the application range of deep application of QR code and ensure the authentication mechanism of QR code, which is the technical problem that is currently being solved.

In view of the above disadvantages of the prior art, it is an object of the present invention to provide a QR code authentication system and method for assisting QR code verification by combining with a dynamic password.

Another object of the present invention is to provide a QR code authentication mechanism to confirm that a user uses a QR code at a specific time and at a specific place to prevent the QR code from being improperly used.

To achieve the foregoing and other objects, the present invention provides a QR code authentication system combining dynamic passwords, which provides a user to perform QR code authentication on a certification platform through a user terminal device, wherein the user terminal device is configured to retrieve a QR code for analysis. The QR code further generates QR code information, and the user inputs the dynamic password, and the authentication platform includes a transmission module and a verification module, and the transmission module receives the QR code information and the dynamic password transmitted by the user equipment, and Providing data transmission of the authentication platform, and the verification module receives the QR code information and the dynamic password in the transmission module to The password is transmitted to an authentication server, and the authentication server determines the correctness of the dynamic password, and then generates a judgment information to transmit the determination information to the verification module. The verification module is based on the QR code information and the determination information. The authentication information is generated, and the authentication information is transmitted back to the client device through the transmission module.

In an implementation aspect, the authentication platform includes a login module, which is used to provide a user to log in before the QR code is authenticated.

In another embodiment, the authentication platform includes a member service module for providing the service information to the client device according to the authentication information generated by the verification module.

In another implementation, the dynamic password is generated by a dynamic password lock, and the dynamic password is generated synchronously in the authentication server.

The invention further provides a QR code authentication method combining dynamic password, which comprises the following steps: (1) receiving QR code information and dynamic password transmitted by the user equipment for authentication; (2) verifying the correctness of the dynamic password. Generating the judgment information, and generating the authentication information according to the judgment information and the QR code information; (3) returning the authentication information to the client device.

In an implementation aspect, the step (2) determines whether the dynamic password and the dynamic password generated by an authentication server are the same to generate the determination information.

Compared with the prior art, the QR code authentication system and the method thereof combined with the dynamic password are the QR code authentication assisted by the dynamic password. Since the dynamic password is generated by the dynamic password lock, the judgment can be made by Is the dynamic password entered correct to confirm whether the user is located in the QR code? In this way, the QR code can be prevented from being copied and used by others or elsewhere. Through the QR code authentication mechanism of the present invention, the service provider can provide a deeper service and data application, and for the service provider and the user. Business services are indeed quite helpful.

The technical contents of the present invention will be described below by way of specific embodiments, and those skilled in the art can easily understand the advantages and effects of the present invention from the contents disclosed in the present specification. However, the invention may be embodied or applied by other different embodiments.

Please refer to FIG. 1 , which is a schematic diagram of a system of a QR code authentication system combining dynamic passwords according to the present invention. As shown in the figure, the QR code authentication system 1 of the present invention in combination with the dynamic password mainly provides the user to perform the authentication of the QR code 200 on the authentication platform 3 through the user device 2, wherein the client device 2 can be, for example, a smart mobile device. Or the portable electronic device or the like to provide the retrieval and data input of the QR code 200, so that the user can retrieve the QR code 200 through the user device 2 and parse the QR code 200 to generate the QR code information, and the user terminal device 2 A program for the user to input a dynamic password 100 generated by a dynamic password lock (OTP Token) for subsequent QR code authentication.

The authentication platform 3 is used for verification of the QR code 200 and provides related business services, and includes a transmission module 30 and a verification module 31.

The transmission module 30 receives the QR code information and the dynamic password 100 transmitted by the client device 2, and provides data transmission of the authentication platform 3. In detail, the transmission module 30 is an interactive communication channel with the client device 2, so the client device 2 transmits the QR code information parsed from the QR code 200. And the dynamic password 100 to the transmission module 30 for subsequent authentication.

The verification module 31 will receive the QR code information and the dynamic password 100 from the transmission module 30, and transmit the dynamic password 100 to the authentication server 4, and the authentication server 4 determines the correctness of the dynamic password 100. Determining the information to transmit the determination information to the verification module 31. Further, the verification module 31 generates the authentication information according to the QR code information and the determination information, and causes the authentication information to be transmitted back to the transmission module 30. Client device 2. Specifically, the authentication server 4 is responsible for determining the correctness of the dynamic password 100. The dynamic password 100 can be generated by a dynamic password lock set in the store. Since the dynamic password is changed within a certain period of time (for example, one minute), the use can be ensured. After the dynamic password is used, the verification module 31 transmits the dynamic password 100 to the authentication server 4 to determine the correctness of the dynamic password 100, and then generates the judgment information, and then the verification module 31 returns the information according to the QR code information and the authentication server 4. The authentication information is transmitted to generate authentication information, and the authentication information is transmitted back to the client device 2 through the transmission module 30 to notify the user whether the authentication is successful.

In addition, the authentication server 4 in the foregoing embodiment is disposed outside the authentication platform 3, and the authentication server 4 may be disposed in the QR code authentication system 1 combined with the dynamic password if necessary, so the authentication in this embodiment The settings of the server 4 are merely illustrative and not limiting.

The dynamic password lock can be set in the store, and the dynamic password can be changed at a specific time. For example, the dynamic password 100 can be changed once every minute, so that the user can only use the dynamic password 100 at present, and the dynamic password can be avoided. 100 was copied and transferred to others. In addition, for certification The server 4 determines the mechanism, that is, the authentication server 4 and the dynamic password lock both generate the same dynamic password 100 synchronously under time synchronization, so that when the client device 2 transmits the dynamic password 100 to the authentication server 4 By judging whether the two dynamic passwords are the same (correct), it is known whether the user is the dynamic password 100 obtained at a specific location and at a specific time.

Through the above-mentioned authentication mechanism, the QR code in the store cannot be used for copying even if it is copied. For example, the store provides the user to scan the QR code to a special place to send the discount, and the person who is interested may copy the QR code and distribute it in large quantities. This makes it impossible to make people go to specific locations. If the authentication mechanism is used to set the dynamic password to a specific location, the user inputs the dynamic password after the QR code is retrieved. At this time, the user can only authenticate on the spot and authenticate the current password. QR code, otherwise entering the dynamic password afterwards will produce inconsistent errors, so it can prevent the QR code from being copied and used improperly.

In a specific implementation, the store may set a plurality of dynamic password locks to generate a plurality of different dynamic passwords, so as to supply a plurality of users to simultaneously scan the service of the QR code, and a dynamic password is invalidated after being used for authentication, and the user needs to Wait for the next dynamic password or use a dynamic password generated by another dynamic password lock. In addition, the period of the dynamic password change time can be set according to requirements, for example, the weekend store family can change 30 seconds when the tide is too high.

Please refer to FIG. 2, which is a system diagram showing another embodiment of the QR code authentication system incorporating the dynamic password of the present invention. As shown in the figure, the QR code authentication system 1 combined with the dynamic password also provides the user through the client. The device 2 performs authentication of the QR code 200 on the authentication platform 3, wherein the functions of the client device 2, the transmission module 30 of the authentication platform 3, the verification module 31, and the authentication server 4 are the same as those of the embodiment shown in FIG. Therefore, it will not be repeated. The specific embodiment mainly illustrates that the authentication platform 3 includes a login module 32 and a member service module 33.

The login module 32 provides the user with a member login before the QR code 200 is authenticated. In order to enable the user to obtain more services after scanning the QR code 200, in the embodiment, the establishment of the member database (not shown) can be used after the user logs in and scans the QR code 200 after the member logs in. At the same time, it records the QR code 200 that the user (member) has read. Therefore, the user logs in through the login module 32 to perform identity authentication before scanning the QR code 200, and then the user can scan the QR code 200 after the member data. The library records the QR code 200, time and other information that the user has scanned, which can also assist in providing other services to the user.

The member service module 33 provides a service message to the client device 2 according to the authentication information of the verification module 31. Specifically, the member service module 33 can store the QR code 200 related information, such as the coupons that can be returned, the additional information, and the like. Therefore, after the verification module 31 verifies, the service information is returned according to the authentication information. To the client device 2. It should be noted that the service message described here is only an example, and may be a coupon, a product message or a store message, etc., so that the user can provide more services than the QR code information.

It can be seen from the above that the QR code authentication system combining the dynamic password of the present invention not only provides a more complete authentication mechanism, but also through the member database. The combination of the user can provide other information to the user in a timely manner. Therefore, the authentication mechanism of the present invention not only ensures the use of the QR code, but also gives the user more services.

In order to specifically describe the QR code authentication system incorporating the dynamic password of the present invention, functions such as authentication and service are performed, and the contents shown in FIG. 3 will be described next with the contents described in the first and second figures.

As shown in FIG. 3, it is a schematic diagram illustrating a specific implementation of the QR code authentication system incorporating the dynamic password of the present invention. In the figure, in addition to the QR code 200 for the user to scan in the store 6, there is at least one dynamic password lock 60, that is, the QR code 200 and the dynamic password lock 60 are disposed at the same place (such as a store). 6), wherein the dynamic password lock 60 changes its dynamic password 600 within a set period of time, and the user can scan the QR code 200 by using the client device 2' and input the dynamic password 600, the QR code 200 and the dynamic password 600. The QR code 200 will be parsed and input by the client device 2' to generate QR code information, which will be transmitted together with the dynamic password 600 to the authentication platform 3, and the authentication platform 3 will be the dynamic password. 600 is sent to the authentication server 4 to determine the correctness of the dynamic password 600. The authentication server 4 returns the determination information to the authentication platform 3, and generates authentication information according to the QR code information and the judgment information. Finally, the authentication platform 3 will authenticate. The information is transmitted back to the client device 2', thereby combining the dynamic password to complete the QR code authentication process, wherein the authentication server 4 has the same software or operation mechanism as the dynamic password lock 60. I.e., both can be synchronized to produce the same dynamic password 600, thus generating the dynamic password to verify the client device 2 OTP 'transmitted with the authentication server 600 4 Is it correct (if it is judged whether it is the same).

In order to allow the user to obtain more services after scanning the QR code 200, the user terminal device 2 can perform member login verification before scanning the QR code 200, and the user terminal device 2' captures the QR code 200 after the member logs in. Enter the dynamic password 600. In this way, the backend member service server 5 can provide other services besides the QR code message, such as product offer information or store information. Preferably, the member set can be combined with the previous member login mechanism. Point function, so that users get more services after logging in to the member. In contrast, the service provider can also collect user usage habits (likes) and promote other charging services.

In addition, the user can log in, share the event information or punch the card through the social network website 7, and record information such as sharing or punching in the authentication platform 3, so that the user service server 5 can accumulate dividends or cash to promote the user. The message of the store 6 is actively delivered, so that the user (possibly the consumer) or the store 6 is in a win-win state.

It can be seen from the above that the QR code authentication system incorporating the dynamic password of the present invention is not limited to the preferential service of the store 6, and can be applied, for example, to whether the user has visited a specific place or not, and the type of the store 6 For non-restricted general stores, it can also be a public unit that needs to confirm the user's location to a specific location. In other words, especially for the purpose of verifying whether the user has been to a specific location, the advantages of the QR code authentication system can be highlighted.

In conjunction with the QR code authentication system incorporating the dynamic password shown in the above FIGS. 1-3, a flow chart of the steps of the QR code authentication method combining the dynamic password of the present invention will be described below using FIG.

In step S401, the QR code information and the dynamic password transmitted by the client device are received for authentication. Specifically, in order to ensure that the user scans the QR code at a specific location, the user is required to input a dynamic password in addition to the QR code through the user equipment, wherein the foregoing dynamic password is generated by the dynamic password lock. And it is set in the store, so the QR code information and dynamic password generated after parsing the QR code are used for subsequent authentication. Proceeding to step S402.

In step S402, the verification information is generated after verifying the correctness of the dynamic password, and the authentication information is generated according to the determination information and the QR code information. In detail, the back-end system determines the correctness of the dynamic password, and determines whether the dynamic password is a dynamic password generated at the point in time to confirm the correctness of the dynamic password, that is, to determine the dynamic password generated by the dynamic password lock. Whether the dynamic password generated by the external (or remote) authentication server is the same, wherein the method for generating the same dynamic password is described above, and details are not described herein. Finally, the authentication information is generated based on the judgment information and the QR code information. Then it proceeds to step S403.

In step S403, the authentication information is returned to the client device. In this step, the authentication information, such as the authentication success or the authentication failure message, is transmitted back to the client device to inform the user of the result of the authentication.

In a specific embodiment, the user is required to perform the member login before the step S401. In detail, in order to provide users with more service content, this embodiment performs membership authentication before scanning the QR code, so that the subsequent scanning QR code action will be recorded, so as to provide more offers to the user of the service provider. .

In another specific embodiment, after step S403, the method further includes providing the preferential information to the client device according to the authentication information. In other words, after the user authenticates, because the back-end system has recorded the relevant member information, it can provide preferential information that matches the user's preferences or habits, or other product information, store information or accumulated consumption, or even combined with the service. Provides bonus accumulation or point accumulation.

Compared with the prior art, the QR code authentication system and method combining the dynamic password of the present invention enhances the QR code authentication procedure by using the dynamic password. Since the dynamic password can only be obtained at a specific place, it can be confirmed whether the user is The scanning QR code is also located at the location, which further provides a strict check mechanism. For example, the manufacturer provides the activity of returning the feed to the store to scan the QR code. Through the QR code authentication mechanism of the dynamic password combined with the present invention, it is possible to avoid the QR code being copied and abused by providing the QR code to other unseen persons after photographing. Case. Therefore, under the authentication mechanism of the present invention, the service provider can make use of the member information to provide deeper services, and thus it is indeed helpful to the service provider and the user.

The above-described embodiments are merely illustrative of the principles of the invention and its effects, and are not intended to limit the invention. Modifications and variations of the above-described embodiments can be made by those skilled in the art without departing from the spirit and scope of the invention. Therefore, the scope of protection of the present invention should be as set forth in the scope of the claims described below.

1‧‧‧ QR code authentication system combined with dynamic password

2, 2'‧‧‧Customer device

3‧‧‧ Certification Platform

30‧‧‧Transmission module

31‧‧‧ verification module

32‧‧‧ Login Module

33‧‧‧Member Service Module

4‧‧‧Authenticated server

5‧‧‧Member Service Server

6‧‧‧Store

60‧‧‧Dynamic password lock

7‧‧‧Community website

100, 600‧‧‧ dynamic password

200‧‧‧ QR code

S401~S403‧‧‧Steps

1 is a schematic diagram showing a system of a QR code authentication system incorporating a dynamic password according to the present invention; 2 is a schematic diagram showing a system of another embodiment of a QR code authentication system incorporating a dynamic password according to the present invention; FIG. 3 is a schematic diagram showing a specific implementation of a QR code authentication system incorporating a dynamic password according to the present invention; and FIG. A flow chart showing the steps of the QR code authentication method of the present invention in combination with a dynamic password.

1‧‧‧ QR code authentication system combined with dynamic password

2‧‧‧Customer device

3‧‧‧ Certification Platform

30‧‧‧Transmission module

31‧‧‧ verification module

4‧‧‧Authenticated server

100‧‧‧ dynamic password

200‧‧‧ QR code

Claims (10)

A QR code authentication system combining dynamic passwords includes: an authentication server; a client device for extracting a QR code to parse the QR code to generate QR code information, and for the user to input dynamic changes over time And a certification platform, comprising: a transmission module, which receives the QR code information and the dynamic password transmitted by the client device, and provides data transmission of the authentication platform; and a verification module receives the transmission module The QR code information and the dynamic password are transmitted to the authentication server, and the authentication server determines the correctness of the dynamic password, and generates a judgment information to transmit the judgment information of the dynamic password to the verification mode. And the verification module generates the authentication information according to the QR code information and the judgment information of the dynamic password, so that the authentication information is transmitted back to the client device through the transmission module. The QR code authentication system combined with the dynamic password according to the first aspect of the patent application, wherein the authentication platform further includes a login module, and the user is provided to perform the member login before the QR code authentication. The QR code authentication system according to the first aspect of the patent application, wherein the authentication platform includes a member service module, and the authentication information generated by the verification module is used to provide a service message to the user. End device. The QR code authentication system according to claim 1, wherein the dynamic password is generated by a dynamic password lock, and the dynamic password is synchronously generated in the authentication server. The QR code authentication system combined with the dynamic password according to claim 4, wherein the dynamic code lock and the QR code are set at the same place. A QR code authentication method combining dynamic passwords includes the following steps: (1) inputting a dynamic password changed over time by a user equipment, and receiving, by the authentication platform, the QR code information transmitted by the user equipment and the dynamic password (2) after the authentication server verifies the correctness of the dynamic password, the judgment information is generated to transmit the judgment information of the dynamic password to the authentication platform, and the authentication platform is based on the judgment information of the dynamic password and the QR code. Information to generate authentication information; (3) the authentication platform returns the authentication information to the client device. The method for authenticating a QR code in combination with a dynamic password as described in claim 6 wherein the user performs a member login before the step (1). For example, the QR code authentication method combined with the dynamic password described in claim 6 of the patent application includes the step (4), and provides a preferential message to the client device according to the authentication information. QR code identification combined with dynamic password as described in item 6 of the patent application scope The method of claim, wherein the dynamic password described in the step (1) is generated by a dynamic password lock, and the dynamic password is synchronously generated in the authentication server. The QR code authentication method according to claim 9 , wherein the step (2) determines whether the dynamic password and the dynamic password generated by the authentication server are the same to generate the determination information. .