Authentication and Transaction Verification Using QR Codes with a Mobile Device

Abstract

User authentication and the verification of online transactions that are performed on an untrusted computer or device is an important and challenging problem. This paper presents an approach to authentication and transaction verification using a trusted mobile device, equipped with a camera, in conjunction with QR codes. The mobile device does not require an active connection (e.g., Internet or cellular network), as the required information is obtained by the mobile device through its camera, i.e. solely via the visual channel. The proposed approach consists of an initial user authentication phase, which is followed by a transaction verification phase. The transaction verification phase provides a mechanism whereby important transactions have to be verified by both the user and the server. We describe the adversarial model to capture the possible attacks to the system. In addition, this paper analyzes the security of the propose scheme, and discusses the practical issues and mechanisms by which the scheme is able to circumvent a variety of security threats including password stealing, man-in-the-middle and man-in-the-browser attacks. We note that our technique is applicable to many practical applications ranging from standard user authentication implementations to protecting online banking transactions. Abstract. User authentication and the verification of online transactions that are performed on an untrusted computer or device is an important and challenging problem. This paper presents an approach to authentication and transaction verification using a trusted mobile device, equipped with a camera, in conjunction with QR codes. The mobile device does not require an active connection (e.g., Internet or cellular network), as the required information is obtained by the mobile device through its camera, i.e. solely via the visual channel. The proposed approach consists of an initial user authentication phase, which is followed by a transaction verification phase. The transaction verification phase provides a mechanism whereby important transactions have to be verified by both the user and the server. We describe the adversarial model to capture the possible attacks to the system. In addition, this paper analyzes the security of the propose scheme, and discusses the practical issues and mechanisms by which the scheme is able to circumvent a variety of security threats including password stealing, man-in-the-middle and man-in-the-browser attacks. We note that our technique is applicable to many practical applications ranging from standard user authentication implementations to protecting online banking transactions.

Online Banking User Authentication Methods: A Systematic Literature Review

“…This can complicate unauthorized access attempts, as the QR code is challenging to replicate. However, there is a risk of QR code copying or theft, which can undermine its effectiveness [61]. One-time password (OTP) authentication generates temporary and exclusive authentication tokens delivered through SMS or email.…”

State of the Art: Secure Mobile Payment

“…Many banks have enhanced their security by using One-Time Password (OTP) as another authentication method in addition to the traditional username and password method [76], [77]. Then OTP is used for transaction verification at the mobile terminal [78], [79]. Recently, Google uses the 2-step authentication framework to enhance the OTP approach [38].…”

A QR Code Watermarking Approach Based on the DWT-DCT Technique

“…The QR code has seen a variety of applications in the area of information security. For example, QR codes have been used for secret sharing [8], authentication and transaction verification [7], authenticating visual cryptography shares [36] as well as for e-voting authentication [15].…”