Method and system for authorizing secure electronic transactions using a security device having a quick response code scanner
Methods and systems for authenticating a security device for providing a secure access and transaction authorization to a remote network location are provided. The security device is authenticated by installing private security software on the security device. In order to authorize a transaction, a transaction authorization is performed using the security device by display a QR (Quick Response) code from an authorization server on a user terminal and scanning the QR code into the security device. After scanning the QR code, an OTA (One-Time-Authorization) code is sent from the security device to the authorization server for verifying the transaction. Embodiments of the present invention provide increased security and privacy. A corresponding system for authenticating a security device and preforming secure and private transactions is also provided.
1. A method for authenticating a security device at a local network location for providing a secure access from the local network location to a remote network location, the method comprising:
at the security device, having a global unique identifier (UID), a processor, a QR (Quick Response) code scanner, and a memory:
obtaining, from the remote network location, a private security software, and causing the private security software to obtain a user selectable personal identification number (PIN), and the UID of the security device, the UID uniquely identifying the security device and being permanently associated with the security device;
forwarding the PIN, the UID and the private security software to the remote network location for generating a user-personalized credential code using the PIN, the UID and the private security software, comprising encrypting the user-personalized credential code;
at the security device, obtaining the user-personalized credential code from the remote network location, and verifying an authenticity of the user selectable PIN and the UID, without communicating over a network, comprising decrypting the user-personalized credential code;
retrieving access credentials to the remote network location upon verifying the authenticity of the user selectable PIN and the UID; and
performing a transaction authorization of a transaction using the security device and the QR code scanner.
2. The method of claim 1 wherein the performing the transaction authorization comprises:
sending a request for a QR (Quick Response) code from a transaction server to an authorization server at the remote network location;
sending the QR code from the authorization server to the transaction server;
sending the QR code to a user terminal from the transaction server and displaying the QR code on the user terminal; and
scanning the QR code into the security device using the QR code scanner.
3. The method of claim 2 wherein the sending the request for the QR code from the transaction server to the authorization server comprises:
sending the request for the QR code from the transaction server to the authorization server over a service channel.
4. The method of claim 2 wherein the sending the QR code from the authorization server to the transaction server comprises:
sending the QR code from the authorization server to the transaction server over a service channel.
5. The method of claim 2 wherein the sending the QR code to the user terminal comprises:
sending the QR code to the user terminal over a transaction channel.
6. The method of claim 1 wherein the performing the transaction authorization comprises:
sending an OTA (One-Time-Authorization) code including the user-personalized credential code from the security device to an authorization server;
verifying the OTA code at the authorization server using the user-personalized credential code;
sending a result of the verifying of the OTA code to a transaction server;
displaying the result of verifying of the OTA code on a user terminal; and
provided the result of the verifying of the OTA code is affirmed, allowing the transaction to proceed.
7. The method of claim 6 wherein the sending the OTA code from the security device to the authorization server comprises:
sending the OTA code from the security device to the authorization server over a transaction notification channel.
8. The method of claim 6 wherein the sending the result of the verifying of the OTA code to the transaction server comprises:
sending the result of the verifying of the OTA code to the transaction server over a service channel.
9. The method of claim 6 wherein the verifying the OTA code at the authorization server comprising:
verifying the OTA code at the authorization server using a server OTA code.
10. The method of claim 6 wherein the displaying the result of the verifying of the OTA code on the user terminal comprises:
sending the result of the verifying of the OTA code to the user terminal over a transaction channel.
11. A system for providing a secure access from a local network location to a remote network location, the system comprising:
a remote server computer at the remote network location; and
a security device at the local network location, the security device having a global unique identifier (UID) uniquely identifying the security device and permanently associated with the security device, a processor, a QR (Quick Response) code scanner, and a memory having computer readable instructions stored thereon, causing the processor to: obtain, from the remote server computer, a private security software;
cause the private security software to obtain a user selectable personal identification number (PIN), and the UID of the security device; the UID uniquely identifying the security device and being permanently associated with the security device; and
forward the PIN, the UID and the private security software to the remote server computer;
the remote server computer being configured to generate a user-personalized credential code using the PIN, the UID and the private security software, and to encrypt the user-personalized credential code;
the computer readable instructions being further configured to cause the processor to:
obtain the user-personalized credential code from the remote server computer;
verify an authenticity of the user selectable PIN and the UID, using the user-personalized credential code, and without communicating over a network, comprising decrypting the user-personalized credential code;
retrieve access credentials to the remote network location upon verifying the authenticity of the user selectable PIN and the UID; and
perform a transaction authorization of a transaction using the security device and the QR code scanner.
12. The system of claim 11 further comprising:
a transaction server configured to:
send a request for a QR (Quick Response) code from the transaction server to an authorization server at the remote network location,
wherein the authorization server is configured to:
send the QR code from the authorization server to the transaction server;
send the QR code to a user terminal from the transaction server and display the QR code on a user terminal; and
wherein the security device is configured to scan the QR code into the security device using the QR code scanner.
13. The system of claim 12 wherein the transaction server is configure to:
send the request for the QR code from the transaction server to the authorization server over a service channel.
14. The system of claim 12 wherein the authorization server is configured to:
send the QR code from the authorization server to the transaction server over a service channel.
15. The system of claim 12 wherein the computer readable instructions configured to cause the processor to send the QR code to the user terminal are configured to cause the processor to:
send the QR code to the user terminal over a transaction channel.
16. The system of claim 11 wherein:
the security device is further configure to:
send an OTA (One-Time-Authorization) code including the user-personalized credential code from the security device to an authorization server,
wherein the authorization server is configured to verify the OTA code at the authorization server using the user-personalized credential code, and
send a result of the verify of the OTA code to a transaction server and display the result of the verify of the OTA code on a user terminal; and
the transaction server is configure to:
provided the result of the verify of the OTA code is affirmed, allow the transaction to proceed.
17. The system of claim 16 wherein the security device is configured to:
send the OTA code from the security device to the authorization server over a transaction notification channel.
18. The system of claim 16 wherein the authorization server is configured to:
send the result of the verify of the OTA code from the authorization server to the transaction server over a service channel.
19. The system of claim 16 wherein the authorization server is configured to:
verify the OTA code at the authorization server using a server OTA code.
20. The system of claim 16 wherein the transaction server is configured to:
send the result of the verify of the OTA code from the transaction server to the user terminal over a transaction channel.