GB2501874A

GB2501874A - Authenticating a barcode using non-barcode data

Info

Publication number: GB2501874A
Application number: GB1207935.6A
Authority: GB
Inventors: Harold Robert Holt
Original assignee: Individual
Current assignee: Individual
Priority date: 2012-05-06
Filing date: 2012-05-06
Publication date: 2013-11-13
Also published as: GB201207935D0

Abstract

A method for authenticating a two-dimensional barcode data uses additional non-barcode data. The additional data could be hidden or embedded in or near the barcode, and may take the form of pictorial data. The barcode data may also be cross-referenced with an authenticated database to improve security. The aim is to provide a means of indentifying secure two-dimensional codes, and perhaps allowing the user to access only websites that are found to be secure.

Description

METHOD FOR AUTHENTICATING A BAR CODE

Images displayed as two dimensional bar codes called QR Codes originally designed for the manufacturing sector are increasingly being used for marketing purposes and in particular for use with mobile smartphones the codes are scanned by a mobile device's camera and launch the device's browser to open the webpage that they are linked to. The code alone gives no indication of the end destination such as a webpage which may contain code that can hijack devices and steal data, the result of this increased use for marketing has meant that an opportunity for the mobile phones security measure to be easily breached by persons with malicious intent has arisen, therefore there is a need to combat this security vulnerability ideally at source thus maintaining the mobile devices integrity and therefore eliminating any such threat.

The present invention being a method for authenticating two dimensional code data using hidden data and or cross referencing two dimensional codes data with an authenticated remote database entry to improve the security of two dimensional codes and to overcome the negative issues already described above and has as its object to provide a two-dimensional code which may be made secure by an authentication method to provide a good distinction between a non-secure two dimensional code and a secured one.

In order to achieve the above objective, in one aspect, there is provided a two-dimensional code having hidden data embedded within the two dimensional code's border or within the codes matrix or alternatively the hidden data may be juxtaposed to the code's borders.

Said hidden data may be a readable image capable of being scanned by a bar code reader the data or image may be encrypted, for the sake of clarity the words hidden data' herein means not discernible by a human viewing a two dimensional code of any colour In another aspect a secure two dimensional code herein referred to as a 2D code' is generated via a code creation software programme so that a dedicated code reader being provided with a means to decode the hidden data, said data may authenticate the generated two dimensional code being clicked on, scanned or read. In this example a 2D code being created by the software code creation program this program may generate a 2D code security data matrix which may be automatically embedded into a 2D code base matrix to form one harmonious 2D code which may be scanned/read by a software reader program both reader and code creation programs having a security encryption algorithm inbuilt in the case of a code creation program and decryption means for the code reader and both programmes being suitable for use with computers and mobile devices.

In a further aspect the code creation program may have an algorithm to produce a character string said algorithm using random numbers to select the characters that form random passwords these being pronounceable and unpronounceable, such random passwords would be highly secure and extremely difficult to crack or guess due to an optional combination of lower and upper case letters, numbers and punctuation symbols.

In yet another aspect of the authentication method the user enters their data using an interface such as a computer or mobile device from this imputed data the code creation software produces a 2D code together with the embedded security hidden data, typically where the code is used for marketing the data may include a link to a destination such as a website, however as previously described the user has no way of knowing if the destination website is a safe place to visit unless they recognise the website address, even then there is no guarantee that the website address has not been forged, one example given herein will overcome this problem, the user who has generated the 2D code has been previously vetted, this vetting process confirms that the person or entity are legitimate, once this is established, any user scanning a code created in this way will have the satisfaction of security as the vetting actions will have been preformed prior to the user scanning or clicking the 2D code. In it's simplest form the 2D code may have appended to it or suitably placed on the code within the code perimeter so as to be readable and compared to an authentic image stored locally or remotely for example an image logo that is recognisable as meaning that the associated code is secured for example an open lock symbol is replaced with a locked symbol this authentication may take place under a secure environment providing an indication of the legitimacy of the codes author this operation may be undertaken on the fly. In a further example a digital checking of the 2D code starts when a person clicks the code they receive a visual message and an audible warning may also be appropriate, the visual message may take the form of characters or an image such as "Validated By QRSURE" in certain circumstances a link may also be provided to a website page where the QRSURE authentication process is explained, a further check of the links destination address is carried out by reference to a database entry this may be on a remote this sever may be secured by a digital certificate the database entry being input previously by the action of a person creating the code this parsing of the database for a data match may be carried out on the fly and the visual message and or audible message may be omitted so as to provide a seamless flow from the initial user accessing the code to the destination which in this example is a website address. The parsing of data to authenticate the codes validity also allows for further enchantments to provide a more secure environment for users of 2D codes. In this aspect a code is created by a user in the manner described herein, howeveG 2D codes are usually associated with one action, for example they may contain a link to a website, provide a telephone numbeç plain text, and other information, once a 2D code has been generated the information that the code contains cannot be changed, this means that there are times when a code will have data that is no longer relevant or the data is void i.e. (if the code contained a destination web page address that no longer existed) then this would mean any user accessing this code will receive an error or be given information held in the 2D code which is not relevant, this code redundancy may lead to a 2D code being hijacked and used for unsavoury purposes, therefore in these circumstances the ability to parse a database before delivering the information to the user means that there is a mechanism for updating a code with changed information so as to contain the most up to date and reliant data furthermore this means that only one 2D code needs to be created as the information provided to the user may be updated at any time via a suitable interface.

Claims

CLAIMS1. Method for authenticating a bar code in which there is a means to identify the status of a two dimensional bar code by referencing the bar code's data with non bar code data, specifically for the purpose of authentication of the said two dimensional bar code.
2. Method for authenticating a bar code according to claim 1 in which the means to identify the status of a two dimensional bar code is encrypted or not.
3. Method for authenticating a bar code according to claim 1 in which the bar code contains additional data that is specifically used to identify the specific bar code so as to provide a validity checking of said bar code, thereby providing the status of the said bar code.
4. Method for authenticating a bar code according to claim 1 in which the bar code has an embedded identifier that can be read by a bar code reader so as to validate the said embedded identifier data.
5. Method for authenticating a bar code according to any of the preceding claims in which the bar code data is cross-referenced with a database entry, said cross-referencing obtaining a data match between the database data and the bar code data confirms the codes validity.
6. Method for authenticating a bar code according to any of the preceding claims in which the bar code contains pictorial data which is used to validate the bar code's authenticity.
7. Method for authenticating a bar code according to any of the preceding claims in which the bar code has additional data juxtaposed to the code's border which is used to validate the bar code's data.
8. Method for authenticating a bar code according to any of the preceding claims in which the bar code has encrypted data which is specifically used to validate the bar code's data.
9. Method for authenticating a bar code according to any of the preceding claims in which the bar code has additional data embedded in the bar code's border.
10. Method for authenticating a bar code according to any of the preceding claims in which the bar code data is cross-referenced with a database entry either locally or remotely, said cross-referencing obtaining a data match allows for different data to be presented other than that of the original bar code's data.
11. Method for authenticating a bar code according to any of the preceding claims in which the authentication bar code data is matched with a database entry to validate a two dimensional code before processing the bar code's data.
12. Method for authenticating a bar code according to any of the preceding claims in which the validation of a two dimensional code is carried out by a code reader said code reader being local or remote to the said bar code.
13. Method for authenticating a bar code according to any of the preceding claims in which the status check of a two dimensional code is carried out by a bar code reader, said bar code reader having a decryption algorithm, said algorithm being specifically for validating the status of a generated two dimensional bar code said validation checking being carried out before any other action.
14. Method for authenticating a bar code according to any of the preceding claims in which the validation of a two dimensional code is carried out by a connection from a mobile device to a remote server on the fly.
15. Method for authenticating a bar code according to any of the preceding claims in which the validation to produce a status check of a two dimensional code is carried out by an encryption and decryption algorithm.
16. Method for authenticating a bar code according to any of the preceding claims in which a status check of a two dimensional code is carried out by a comparison algorithm.