USING QR CODES FOR AUTHENTICATING USERS TO ATMS AND OTHER SECURE MACHINES FOR CARDLESS TRANSACTIONS

• US 20130124855A1
• Filed: 08/29/2012
• Published: 05/16/2013
• Est. Priority Date: 11/14/2011
• Status: Active Grant

• Current Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Original Assignee: CA, Inc. (d/b/a CA Technologies) (Broadcom, Inc.)
• Inventors: VARADARAJAN, Rammohan, MALPANI, Ambarish
• Granted Patent: US 8,924,712 B2
• Time in Patent Office: Days
• US Class Current: 713/155
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06Q 20/3276 using a pictured code, e.g. barcode or QR-code, being read by the M-device
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G07F 19/20 Automatic teller machines [ATMs]
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 9/3228 One-time or temporary data, i.e. information which is sent for every authentication or authorization, e.g. one-time-password, one-time-token or one-time-key
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/71 Hardware identity
• CPC Class Codes: H04W 12/77 Graphical identity

Abstract

Systems, apparatus, methods, and computer program products for using quick response (QR) codes for authenticating users to ATMs and other secure machines for cardless transactions are disclosed. Embodiments of the present disclosure read an image displayed on a display of an external device using a mobile device associated with a user authorized to access a secure resource, decode transaction information encoded in the image, transmit the transaction information and an identifier of the mobile device from the mobile device to an authentication system, and grant access to the secure resource if the transaction information and the identifier satisfy an authentication test performed at the authentication system.

Claims

1. An apparatus for authenticating a transaction, the apparatus comprising:

a memory configured to store an identifier of the apparatus;

a communication interface configured to facilitate communications between the apparatus and an authentication system;

a first input device configured to read an image displayed on a display of an external device; and

a processor configured to recover the identifier of the apparatus from the memory and to transmit the identifier of the apparatus, together with transaction information encoded in the image, to the authentication system via the communication interface.

2. The apparatus of claim 1, wherein:

the identifier of the apparatus comprises a seed key; and

the memory is configured to store the seed key in a secure manner utilizing a key protection technique.

3. The apparatus of claim 2, wherein:

the key protection technique comprises cryptographic camouflaging; and

the image displayed is a matrix barcode.

4. The apparatus of claim 3, wherein the processor is configured to utilize the seed key to generate a password and to transmit the password, together with transaction information encoded in the image, to the authentication system via the communication interface.

5. The apparatus of claim 4, further comprising a second input device configured to receive input required by the key protection technique to recover the seed key from the memory.

6. The apparatus of claim 1, wherein:

the communication interface is configured to facilitate communications between the apparatus and the external device when the apparatus is within close proximity of the external device; and

the communications between the apparatus and the external device are configured to cause the external device to display the image on its display based on those communications.

7. The apparatus of claim 1, wherein:

the identifier of the apparatus comprises a seed key;

the image displayed is a barcode; and

the processor is configured to decode transaction information encoded in the image and to generate a password with the seed key before transmitting the password, together with transaction information encoded in the image, to the authentication system via the communication interface.

8. A method for authenticating a transaction comprising:

reading an image displayed on a display of an external device using a mobile device associated with a user authorized to access a secure resource;

decoding transaction information encoded in the image;

transmitting the transaction information and an identifier of the mobile device from the mobile device to an authentication system; and

granting access to the secure resource if the transaction information and the identifier satisfy an authentication test performed at the authentication system.

9. The method of claim 8, wherein:

the identifier of the apparatus comprises a seed key; and

the memory is configured to store the seed key in a secure manner utilizing a key protection technique.

10. The method of claim 9, wherein:

the key protection technique comprises cryptographic camouflaging; and

the image displayed is a matrix barcode.

11. The method of claim 10, further comprising utilizing the seed key to generate a password and transmitting the password, together with transaction information encoded in the image, to the authentication system via the communication interface.

12. The method of claim 11, further comprising:

receiving input required by the key protection technique to recover the seed key from the memory;

recovering the seed key from the memory when the required input is received; and

recovering an incorrect key from the memory when some other input is received.

13. The method of claim 8, further comprising:

establishing communications between the apparatus and the external device when the apparatus is within close proximity of the external device; and

causing the external device to display the image on its display based on those communications.

14. The method of claim 8, wherein:

the identifier of the apparatus comprises a seed key;

the image displayed is a barcode;

the method further comprises;

decoding transaction information encoded in the image; and

generating a password with the seed key before transmitting the password, together with transaction information encoded in the image, to the authentication system via the communication interface.

15. A computer program product comprising a computer-readable storage medium having computer-readable program code embodied therewith, the computer-readable program code being configured to be executed by an apparatus with a memory that stores an identifier of the apparatus and comprising:

computer-readable program code configured to read an image displayed on a display of an external;

computer-readable program code configured recover the identifier of the apparatus from the memory; and

computer-readable program code configured to transmit the identifier of the apparatus, together with transaction information encoded in the image, to an authentication system via the communication interface.

16. The computer program product of claim 15, wherein:

the identifier of the apparatus comprises a seed key; and

the memory is configured to store the seed key in a secure manner utilizing a key protection technique.

17. The computer program product of claim 16, wherein:

the key protection technique comprises cryptographic camouflaging; and

the image displayed is a matrix barcode.

18. The computer program product of claim 17, further comprising computer-readable program code configured to utilize the seed key to generate a password and to transmit the password, together with transaction information encoded in the image, to the authentication system via the communication interface.

19. The computer program product of claim 18, further comprising:

computer-readable program code configured to receive input required by the key protection technique to recover the seed key from the memory;

computer-readable program code configured to recover the seed key from the memory when the required input is received; and

computer-readable program code configured to recover an incorrect key from the memory when some other input is received.

20. The computer program product of claim 15, further comprising:

computer-readable program code configured to establish communications between the apparatus and the external device when the apparatus is within close proximity of the external device; and

computer-readable program code configured to cause the external device to display the image on its display based on those communications.

21. The computer program product of claim 15, wherein:

the identifier of the apparatus comprises a seed key;

the image displayed is a barcode;

the computer program product further comprises;

computer-readable program code configured to decode transaction information encoded in the image; and

computer-readable program code configured to generate a password with the seed key before transmitting the password, together with transaction information encoded in the image, to the authentication system via the communication interface.