Secure data transfer using legitimate QR codes wherein a warning message is given to the user if data transfer is malicious
View Patent ↗User data is securely transferred from a client device to a mobile device. Data transfer activities at the client are monitored to detect a request to transfer data via a displayed code (e.g., QR code). The data being transfer are verified as being legitimate (e.g., not compromised by malware or otherwise malicious) before the transfer. Responsive to verifying that the transfer data are legitimate, a code encoding the transfer data is displayed on a display device of the client. A user of the mobile device captures the code using a digital camera or other data scanning device and decodes the code to obtain the transfer data. The mobile device may then perform an action using the transfer data, such as connecting to a website or composing an email to an address included in the transfer data.
1. A computer-implemented method of securely transferring data using a displayed code, the method comprising:
monitoring data transfer activities at a client to detect a request to transfer data to a mobile device by displaying a quick response (QR) code on a display of the client;
determining whether the transfer data are malicious based on a reputation of an entity referenced by the transfer data;
responsive to determining that the transfer data are not malicious, permitting display of the QR code encoding the transfer data on the display of the client; and
responsive to determining that the transfer data are malicious:
preventing display of the QR code on the display of the client; and
displaying a warning message to a user of the client.
2. The method of claim 1 , wherein monitoring data transfer activities at the client comprises:
receiving transfer data explicitly provided by a user of the client.
3. The method of claim 1 , wherein monitoring data transfer activities at the client comprises:
detecting a request by a browser executing on the client to activate a module for generating a QR code encoding the transfer data.
4. The method of claim 1 , wherein determining whether the transfer data are malicious comprises:
providing the transfer data to a remote verification server, the verification server adapted to send a response to the client indicating whether the transfer data are malicious.
5. The method of claim 1 , wherein determining whether the transfer data are malicious comprises:
determining a reputation of an entity referenced by the transfer data, wherein the transfer data are determined not malicious responsive to the entity having a good reputation.
6. The method of claim 1 , wherein determining whether the transfer data are malicious comprises performing one or more steps from the group of steps consisting of:
determining whether the transfer data are on a whitelist of known legitimate transfer data; and
determining whether the transfer data are on a blacklist of known malicious transfer data.
7. The method of claim 1 , wherein permitting display of the QR code encoding the transfer data comprises:
generating a QR code comprising a machine-readable visual representation of the transfer data; and
displaying the QR code on the display of the client.
8. The method of claim 1 ,
wherein the warning message to the user of the client indicates that the transfer data are malicious.
9. A non-transitory computer-readable storage medium storing executable computer program instructions for securely transferring data using a displayed code, the computer program instructions comprising instructions for:
monitoring data transfer activities at a client to detect a request to transfer data to a mobile device by displaying a quick response (QR) code on a display of the client;
determining whether the transfer data are malicious based on a reputation of an entity referenced by the transfer data;
responsive to determining that the transfer data are not malicious, permitting display of the QR code encoding the transfer data on the display of the client; and
responsive to determining that the transfer data are malicious:
preventing display of the QR code on the display of the client; and
displaying a warning message to a user of the client.
10. The computer-readable storage medium of claim 9 , wherein the computer program instructions for monitoring data transfer activities at the client comprises instructions for:
detecting a request by a browser executing on the client to activate a module for generating a QR code encoding the transfer data.
11. The computer-readable storage medium of claim 9 , wherein the computer program instructions for determining whether the transfer data are malicious comprises instructions for:
providing the transfer data to a remote verification server, the verification server adapted to send a response to the client indicating whether the transfer data are malicious.
12. The computer-readable storage medium of claim 9 , wherein the computer program instructions for determining whether the transfer data are malicious comprises instructions for:
determining a reputation of an entity referenced by the transfer data, wherein the transfer data are determined not malicious responsive to the entity having a good reputation.
13. The computer-readable storage medium of claim 9 , wherein the computer program instructions for permitting display of the QR code encoding the transfer data comprises instructions for:
generating a QR code comprising a machine-readable visual representation of the transfer data; and
displaying the QR code on the display of the client.
14. A system for securely transferring data using a displayed code comprising:
a non-transitory computer-readable storage medium storing executable computer program modules comprising:
a monitoring module for monitoring data transfer activities at a client to detect a request to transfer data to a mobile device by displaying a quick response (QR) code on a display of the client;
a data verification module for determining whether the transfer data are malicious based on a reputation of an entity referenced by the transfer data; and
a display module for:
responsive to determining that the transfer data are not malicious, permitting display of the QR code encoding the transfer data on the display of the client; and
responsive to determining that the transfer data are malicious:
preventing display of the QR code on the display of the client; and
displaying a warning message to a user of the client; and
a processor for executing the computer program modules.
15. The system of claim 14 , wherein the monitoring module is further for:
detecting a request by a browser executing on the client to activate a module for generating a QR code encoding the transfer data.
16. The system of claim 14 , wherein the data verification module is further for:
determining a reputation of an entity referenced by the transfer data, wherein the transfer data are determined not malicious responsive to the entity having a good reputation.
17. The system of claim 14 , further comprises a code generation module for:
generating a QR code comprising a machine-readable visual representation of the transfer data; and
interacting with the display module for displaying the QR code on the display of the client.