SYSTEM AND METHOD FOR AUTHENTICATION USING QUICK RESPONSE CODE

• US 20160314462A1
• Filed: 11/13/2014
• Published: 10/27/2016
• Est. Priority Date: 12/20/2013
• Status: Abandoned Application

• Current Assignee: Secuve Co., Ltd.
• Original Assignee: Secuve Co., Ltd.
• Inventors: SHIN, Jun-Hee, HONG, Ki-Yoong
• Application Number:
  US15/104,880
• Publication Number:
  US 20160314462A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: G06F 16/22 Indexing; Data structures therefor; Storage structures
• CPC Class Codes: G06K 19/06037 multi-dimensional coding
• CPC Class Codes: G06K 19/06046 Constructional details
• CPC Class Codes: G06K 2019/06253 for a specific application
• CPC Class Codes: G06Q 20/3274 using a pictured code, e.g. barcode or QR-code, being displayed on the M-device
• CPC Class Codes: G06Q 20/38215 Use of certificates or encrypted proofs of transaction rights
• CPC Class Codes: G06Q 20/3829 involving key management
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: G06Q 2220/00 Business processing using cryptography postage metering system using cryptography G06Q2250/05
• CPC Class Codes: G09C 5/00 Ciphering apparatus or methods not provided for in the preceding groups, e.g. involving the concealment or deformation of graphic data such as designs, written or printed messages
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/77 Graphical identity

Abstract

Provided is a system and method for authenticating a user according to login and financial transactions, such as payment and transfer, and more particularly, to a system and method for authentication using a quick response (QR) code, in which a quick response (QR) code including authentication information is displayed on the computer terminal of a user, the QR code is scanned through a smart device such as a smartphone, and the authentication is performed using the scanned QR code by accessing a QR authentication server included in the QR code.

Claims

1. An authentication system using a Quick Response (QR) code, comprising:

a computer terminal for making an authentication request by transmitting a QR code authentication request signal including both user identification information of a user and authentication scheme selection information required to select at least QR code authentication, and for displaying a QR code image received in response to the authentication request;

a portable authentication terminal for scanning the QR code image and transmitting QR code information contained in the QR code image;

a legacy authentication server for requesting generation of a QR code by transmitting a QR code generation request signal, in which QR code generation information including the user identification information is contained, via QR code authentication selected using the authentication scheme selection information for a certain service when the authentication request is made, for transmitting a QR code image received in response to the request to the computer terminal, and for approving provision of the service when received results of QR code authentication indicate success; and

a QR authentication server for generating QR code information when the QR code generation request signal is received, generating a QR code image for the QR code information, providing the QR code image to the legacy authentication server, comparing the QR code information received from the portable authentication terminal with QR code information that is generated for the QR code image and is stored in a QR code generation database (DB), performing authentication based on whether pieces of QR code information match each other, and notifying the legacy authentication server of the results of the QR code authentication.

2. The authentication system of claim 1, wherein the portable authentication terminal comprises:

a terminal communication unit for performing data communication with the QR authentication server over a wired/wireless data communication network;

a scanning unit for scanning the QR code image displayed on the computer terminal and outputting the scanned QR code image;

a display unit for displaying the QR code information; and

a terminal control unit for detecting QR code information from the QR code image by scanning the QR code image through the scanning unit, displaying the QR code information on the display unit, and transmitting the QR code information.

3. The authentication system of claim 2, wherein:

the QR authentication server encrypts the QR code information using a security key, generates a QR code image corresponding to encrypted QR code information, and provides the QR code image to the legacy authentication server, and

the terminal control unit comprises;

a QR code information acquisition unit for detecting the QR code image through the scanning unit, interpreting the QR code image, and acquiring encrypted QR code information; and

a password authentication processing unit having a decryption unit for receiving a password corresponding to the security key from the user and decrypting the acquired encrypted QR code information.

4. The authentication system of claim 3, wherein the terminal control unit further comprises a QR code integrity checking unit for checking an integrity of the QR code using a hash value included in the decrypted QR code information, and transmitting the QR code information to the QR authentication server when the integrity check is passed.

5. The authentication system of claim 3, wherein the terminal control unit further comprises:

a transaction information detection unit for checking whether financial transaction information is included in the decrypted QR code information, and detecting the financial transaction information and displaying the financial transaction information on the display unit if the financial transaction information is included; and

a user approval verification unit for, after the financial transaction information has been displayed by the transaction information detection unit, displaying a message prompting the user to decide whether to approve the corresponding transaction, and for, when the user selects approval in response to the prompt message, adding details of the approval to the QR code information and transmitting the QR code information to the QR authentication server.

6. The authentication system of claim 5, wherein the user approval verification unit is configured to, when transmitting the QR code information to the QR authentication server, encrypt again the QR code information using a password and transmit the encrypted QR code information.

7. The authentication of claim 1, wherein the legacy authentication server comprises:

a legacy storage unit, including a legacy authentication information database (DB) for storing pieces of legacy authentication information for respective pieces of user identification (ID) information, and a session ID information DB, for storing authentication service information including pieces of session ID information for respective pieces of user ID information; and

a legacy control unit, wherein the legacy control unit comprises;

an authentication type determination unit for determining an authentication request scheme based on the authentication scheme selection information for the authentication request,

a legacy authentication unit for performing legacy authentication with reference to the legacy authentication information DB if the authentication request scheme is found to be legacy authentication upon a determination of the authentication type,

a QR code authentication service subscription unit for determining whether the user of the user ID information is a subscriber to a QR code authentication service through the QR authentication server if the authentication request scheme is found to be QR code authentication upon a determination of the authentication type,

a QR code issuance requesting unit for, when the user is the subscriber to the QR code authentication service, requesting issuance of a QR code by transmitting a QR code generation request signal including the user ID information, and for transmitting a QR code image received in response to the request signal to the computer terminal,

wherein the legacy control unit is configured to, when results of QR code authentication depending on transmission of the QR code image are received from the QR authentication server and indicate success, approve provision of the service.

8. The authentication system of claim 7, wherein the legacy control unit further comprises a session authentication unit for comparing session ID information of user ID information and the session ID information, which are included in the results of the QR code authentication when the QR code authentication results are received, with session ID information registered in a session ID information DB for the user ID information, and performing session authentication based on whether the pieces of session ID information match each other, wherein approval of provision of the service is determined when session authentication succeeds.

9. The authentication system of claim 7, wherein the legacy control unit further comprises a transaction information authentication unit for, when a type of authentication service for the authentication request is one of a transfer, a purchase and payment, and a stock trade, comparing financial transaction information of user ID information and the financial transaction information included in the authentication results with financial transaction information stored in the session ID information DB for the user ID information, and performing authentication of financial transaction information depending on whether the pieces of financial transaction information match each other, wherein approval of provision of the service is determined when authentication of the financial transaction information succeeds.

10. The authentication system of claim 1, wherein the QR authentication server comprises:

a QR storage unit including a QR code generation DB for storing generated QR code information; and

a QR control unit for receiving the QR code generation request signal, generating QR code information, storing the QR code information in the QR code generation DB, providing the QR code information to the legacy authentication server, comparing QR code information received from the portable authentication terminal with QR code information stored in the QR code generation DB to perform authentication, and notifying the legacy authentication server of results of the QR code authentication.

11. The authentication system of claim 10, wherein:

the QR storage unit further comprises a QR authentication service subscriber DB for storing authentication service subscription information including user information of the user and ID information and a password of a portable authentication terminal of the user, and

the QR control unit comprises;

a QR code authentication service registration unit for, when query about subscription/non-subscription to a QR code authentication service is received from the legacy authentication server in response to a QR code authentication request, determining whether subscription/non-subscription to the service has been made with reference to the authentication service subscription information in the QR authentication service subscriber DB and providing results of the determination to the legacy authentication server, and for, when a service subscription request signal including authentication service subscription information is received from the legacy authentication server, storing and registering the authentication service subscription information in the QR authentication service subscriber DB;

a QR code generation unit for, when the QR code generation request signal is received, collecting the QR code information, generating a QR code image for the QR code information, storing the QR code image in the QR code generation DB, and providing the QR code image to the legacy authentication server;

a QR authentication unit for comparing the QR code information, which is received from the portable authentication terminal, with QR code information, which is generated for the QR code image and is stored in the QR code generation DB, thus performing authentication; and

an authentication result notification unit for notifying both the legacy authentication server and the portable authentication terminal of the results of QR code authentication.

12. The authentication system of claim 11, wherein the QR code generation unit comprises:

a QR code generation information collection unit for collecting QR code generation information in response to the QR code generation request signal, wherein the QR code generation information includes a site name of a service server, an authentication service type, financial transaction information, user ID information, and session ID information;

a QR code information generation unit for generating QR code information that includes the QR code generation information, a timestamp, which is a time of issuance of the QR code, and QR ID information; and

a QR code image generation unit for generating a QR code image corresponding to the generated QR code information and transmitting the QR code image to the legacy authentication server.

13. The authentication system of claim 12, wherein:

the QR code generation unit further comprises a QR code encryption unit for encrypting the generated QR code information using a password registered in a QR authentication service subscriber DB for the user ID information of the QR code generation information,

wherein the QR code image generation unit generates a QR code image for the encrypted QR code information.

14. The authentication system of claim 1, wherein the QR control unit further comprises a terminal authentication unit for, when QR code information is received from the portable authentication terminal, performing authentication based on whether terminal ID information of the portable authentication terminal, which is received from the portable authentication terminal, matches terminal ID information, which is mapped to the user ID information of the user of the portable authentication terminal and is stored in the QR authentication service subscriber DB.

15. An authentication method using a Quick Response (QR) code, comprising:

an authentication request procedure of, while a computer terminal is using a certain service provided by a service server, requesting authentication by transmitting a QR code authentication request signal including at least user identification (ID) information and authentication scheme selection information, required to select at least QR code authentication, to a legacy authentication server;

a QR code generation request procedure of, when an authentication request is made in response to reception of a QR code authentication request signal including the authentication scheme selection information required to select QR code authentication from the computer terminal, transmitting, by the legacy authentication server, a QR code generation request signal, which includes QR code generation information including the user ID information, to the QR authentication server, thus requesting generation of a QR code;

a QR code image generation procedure of, when the QR authentication server receives the QR code generation request signal from the legacy authentication server, collecting QR code information in response to the authentication request, generating a QR code image for the collected QR code information, and providing the QR code image to the legacy authentication server;

a QR code provision procedure of transmitting, by the legacy authentication server, the QR code image to the computer terminal;

a QR code display procedure of receiving and displaying, by the computer terminal, the QR code image;

a QR code scan procedure of scanning, by a portable authentication terminal, the QR code image displayed on the computer terminal, acquiring QR code information included in the QR code, and transmitting the acquired QR code information to the QR authentication server;

a QR code authentication procedure of performing, by the QR authentication server, QR code authentication by comparing the QR code information received from the portable authentication terminal with QR code information generated for the user ID information, and transmitting results of QR code authentication to the legacy authentication server; and

a service approval procedure of, when the results of the QR code authentication received from the QR authentication server indicate success of authentication, granting, by the legacy authentication server, final approval for the service.

16. The authentication method of claim 15, wherein the authentication scheme selection information in the authentication request procedure comprises authentication selection information required to select at least one legacy authentication scheme and a QR code authentication scheme, wherein the QR code generation request procedure comprises:

a legacy authentication step of performing legacy authentication depending on legacy authentication selection information included in the authentication selection information; and

a QR code generation request step of requesting generation of a QR code by transmitting a QR code generation request signal, which includes QR code generation information containing the user ID information, to the QR authentication server when legacy authentication succeeds.

17. The authentication method of claim 15, wherein the QR code image generation procedure comprises:

a QR code generation information collection step of, when a QR code generation request signal is received from the legacy authentication server, extracting QR code generation information from the QR code generation request signal;

a QR code information generation step of generating QR code information, which includes the collected QR code generation information and information about a QR code to be generated; and

a QR code image generation step of generating a QR code image corresponding to the generated QR code information, and thereafter providing the QR code image to the legacy authentication server.

18. The authentication method of claim 17, wherein:

the QR code image generation procedure further comprises an encryption step of, when QR code information is collected at the QR code generation information collection step, encrypting the QR code information by applying a password of the corresponding user, registered in the QR authentication service subscriber DB, to the QR code information as a security key, and

at the QR code image generation step, a QR code image for the encrypted QR code information is generated.

19. The authentication method of claim 15, wherein the QR code scan procedure comprises:

a scanning step of scanning, by the portable authentication terminal, a QR code image displayed on the computer terminal;

a QR code information extracting step of analyzing the scanned QR code image and extracting QR code information; and

a QR code transmission step of transmitting the extracted QR code information to the QR authentication server.

20. The authentication method of claim 19, wherein:

in the QR code image generation procedure, the QR authentication server encrypts QR code information using a password preset for the user of the user ID information as a security key, and transmits the encrypted QR code information, and

the QR code scan procedure further comprises a decryption step of, after the QR code information has been extracted, requesting the user to input a password corresponding to the security key and receiving the password from the user, and then decrypting the encrypted QR code information using the password.

21. The authentication method of claim 19, wherein:

the QR code scan procedure further comprises an integrity checking step of performing an integrity check using a hash value included in the QR code information, and

the QR code information is transmitted to the QR authentication server only when the integrity check at the QR code transmission step is passed.

22. The authentication method of claim 15, wherein the QR code authentication procedure comprises:

a terminal authentication step of comparing terminal ID information included in a signal, containing the QR code information and received from the portable authentication terminal, with terminal ID information previously registered in a QR authentication service subscriber DB to correspond to the user ID information, thus performing terminal authentication based on whether pieces of terminal ID information match each other;

a QR code authentication step of, when terminal authentication succeeds, comparing the QR code information with QR code information previously registered for the user of the user ID information, thus performing QR code authentication based on whether pieces of QR code information match each other; and

a QR code authentication notification step of transmitting results of QR code authentication to the legacy authentication server.

23. The authentication method of claim 15, wherein the service approval procedure comprises:

a session authentication step of, when results of QR code authentication are received from the QR authentication server, performing, by the legacy authentication server, session authentication based on whether session ID information included in the results of the QR code authentication matches session ID information stored in a session ID information DB to correspond to the user authentication information included in the results of the QR code authentication; and

a service approval step of granting final approval for the service when session authentication succeeds.

24. The authentication method of claim 23, wherein:

the service approval procedure further comprises a transaction information authentication step of, when a type of authentication service in the authentication request is a financial transaction, comparing financial transaction information included in the results of QR code authentication with financial transaction information that is stored in the session ID information DB and is mapped to the session ID information, thus performing authentication of transaction information based on whether pieces of financial transaction information match each other, and

the service approval step is performed when authentication of the transaction information succeeds.