Multi-factor authentication using digital images of barcodes

• US 8,910,274 B2
• Filed: 07/28/2011
• Issued: 12/09/2014
• Est. Priority Date: 07/28/2011
• Status: Active Grant

• Current Assignee: Xerox Corporation (Xerox Holdings Corp.)
• Original Assignee: Xerox Corporation (Xerox Holdings Corp.)
• Inventors: Sanders, Aaron Dale
• Primary Examiner(s): Popham, Jeffrey D
• Application Number:
  US13/192,684
• Publication Number:
  US 20130031623A1
• Time in Patent Office: 1,230 Days
• Field of Search: 726/19, 726/28, 726/30
• US Class Current: 726/19
• CPC Class Codes: G06F 21/00 Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
• CPC Class Codes: G06F 21/34 involving the use of external additional devices, e.g. dongles or smart cards
• CPC Class Codes: G06F 21/36 by graphic or iconic representation

Abstract

Methods, systems, and computer-readable media for implementing a multi-factor authentication scheme utilizing barcode images in computing devices, such as standard mobile devices and smartphones having no native hardware support for reading barcodes other than standard digital camera componentry for capturing digital images of real-world phenomena. A mobile device may be configured by software to require a user, as a first authentication factor, to present a barcode, such as a Quick Response (QR) Code for image scanning using digital camera componentry built into the mobile device. The device analyzes the digital image of the barcode to decode the barcode into its encoded character data. If the device recognizes the character data as valid, then, as a second authentication factor, the device prompts the user to enter a valid password associated with the barcode. If the user-entered barcode is also valid, then the device may grant the user access.

Claims

1. A method of implementing a multi-factor authentication scheme in a mobile telephone having a camera and one or more processors, the method comprising:

as part of a setup procedure;

providing to a remote server a character string input to a user input of the mobile telephone; and

receiving by email a security QR Code in a printable format, wherein the security QR code comprises the character string encrypted with a private key of a public-private key pair to produce an encrypted character string and subsequently encoded into the security QR Code;

maintaining, in a storage medium of the mobile telephone, a plurality of applications configured to be executed on the mobile telephone;

receiving a request from a user to access the mobile telephone;

prompting the user to present a QR Code printed onto paper corresponding to the security QR Code;

scanning the QR Code printed onto paper using the camera of the mobile telephone;

determining that the QR Code printed onto paper is associated with authorized access to the mobile telephone, wherein the determining comprises decoding the QR Code printed onto paper to derive the encrypted character string, and decrypting the encrypted character string using a public key of the public-private key pair, wherein the public key is stored on the mobile telephone;

prompting the user to enter a password;

receiving the password from the user at the user input of the mobile telephone;

determining that the received password is associated with authorized access to the mobile telephone; and

granting the user access to the plurality of applications on the mobile telephone in response to determining that the QR Code printed onto paper is associated with authorized access to the mobile telephone and determining that the received password is associated with authorized access to the mobile telephone.

2. The method of claim 1, further comprising:

receiving input from a remote server as to whether the password is associated with authorized access to the mobile telephone.

3. A mobile telephone configured to perform a multi-factor authentication scheme, the mobile telephone comprising:

a processing system comprising one or more processors;

one or more executable applications;

a camera; and

a memory system comprising one or more computer-readable media, wherein the computer-readable media contain instructions that, when executed by the processing system, cause the processing system to perform operations comprising;

as part of a setup procedure;

providing to a remote server a character string input to a user input of the mobile telephone; and

receiving by email a security QR Code in a printable format, wherein the security QR code comprises the character string encrypted with a private key of a public-private key pair to produce an encrypted character string and subsequently encoded into the security QR Code;

receiving a request from a user to access the mobile telephone;

prompting the user to present a QR Code printed onto paper corresponding to the security QR Code;

scanning the QR Code printed onto paper using the camera;

determining that the QR Code printed onto paper is associated with authorized access to the mobile telephone, wherein the determining comprises decoding the QR Code printed onto paper to derive the encrypted character string, and decrypting the encrypted character string using a public key of the public-private key pair, wherein the public key is stored on the mobile telephone;

prompting the user to enter a password;

receiving the password from the user using the user input to the mobile telephone;

determining that the received password is associated with authorized access to the mobile telephone; and

granting the user access to the one or more applications in response to determining that the QR Code printed onto paper is associated with authorized access to the mobile telephone and determining that the received password is associated with authorized access to the mobile telephone.

4. The mobile telephone of claim 3, wherein scanning the QR Code printed onto paper comprises:

capturing a digital image of the QR Code printed onto paper.

5. The mobile telephone of claim 3, the operations further comprising:

receiving input from a remote server as to whether the security QR Code or the password is associated with authorized access to the mobile telephone.

6. A non-transitory computer-readable medium tangibly embodying computer instructions for performing, by one or more processors of a mobile telephone, a method of implementing a multi-factor authentication scheme comprising:

as part of a setup procedure;

providing to a remote server a character string input to a user input of the mobile telephone; and

receiving by email a security QR Code in a printable format, wherein the security QR code comprises the character string encrypted with a private key of a public-private key pair to produce an encrypted character string and subsequently encoded into the security QR Code;

receiving a request from a user to access the mobile telephone;

prompting the user to present a QR Code printed onto paper corresponding to the security QR Code;

scanning the QR Code printed onto paper using a camera of the mobile telephone;

determining that the QR Code printed onto paper is associated with authorized access to the mobile telephone, wherein the determining comprises decoding the QR Code printed onto paper to derive the encrypted character string, and decrypting the encrypted character string using a public key of the public-private key pair, wherein the public key is stored on the mobile telephone;

prompting the user to enter a password at the user input to the mobile telephone;

receiving the password from the user;

determining that the received password is associated with authorized access to the mobile telephone; and

granting the user access to the mobile telephone in response to determining that the QR Code printed onto paper is associated with authorized access to the mobile telephone and determining that the received password is associated with authorized access to the mobile telephone.

7. The non-transitory computer-readable medium of claim 6, the method further comprising:

receiving input from a remote server as to whether the password is associated with authorized access to the mobile telephone.