Research On Generation And Authentication Of Credible QR Code Based On Digital Signature

QRCode,as the carrier of information,has been widely used in the fields of electronic commerce,intelligent manufacturing,financial payment and so on.However,the open market application model of QRCode leads to the frequent security problems in difficult monitoring.Therefore,it is becoming more and more important to study the security,especially for the trusted application research application of QRCode.At present,the research results of QRCode trusted scheme are mainly as follow: the signature is embedded in QRCode to be verificated by the online trusted server combining with PKI technology.These schemes ignore the conflict between the abundant contents of digital certificates and the limited capacity of QRCode,and the user interaction experience needs to be improved with the poor operation efficiency.Based on the above analysis,we believe that there are two needs in QRCode trusted scheme: improve the balance between efficiency and security caused by complexity of signature scheme,and reduce the conflict between capacity loss of embedded signature information and the limited redundant space of QRCode.To meet the above needs,this thesis proposed a trusted QRCode generation and verification scheme named "QRCodeVerify".The main research contents are as follows:(1)Considering the balance of efficiency and security,a short signature scheme is applied to QRCode trusted verification.In order to take the advantages of short signature scheme with short key and high efficiency,the trusted authentication principle and model of QRCode are given based on scheme[1].The QRCodeVerify-Scheme combined with certificate service effectively simplifys the certificate and key management in the QRCode system to reduce an additional process of public key verification,improving the balance between efficiency and safety.(2)A code and decode algorithm suitable for trusted QRCode verification is proposed combining with the scheme of information writing and extracting.The algorithm can select optimal QR version which can accommodate real information and signature information,ensuring that the QRCode has enough space to store the redundant RC signature information in coding phase.Also it can identify and decode the trusted QRCode,extract the signature according to endmark,and provide the normal decoding service for ordinary QRCode in decoding phase.(3)In order to verify the correctness of the QRCodeVerify scheme,a trusted QRCode system is implemented according to the QRCodeVerify scheme,and the system testing is carried out.The system client terminal mainly includes identity detection module,certificate operation module,trusted QRCode publishing module and QRCode scanning verification module.Server mainly includes application service supporting module,which provides certificate management services.The test results show that the system meets design requirements,it can accomplish trusted QRCode generation and decoding,and complete the certificate operation with the reliable authentication service.The QRCode space occupancy rate decreases to 4%,it decreases by 9% compared with the scheme[18];and the average time loss is in 1s,compared with the market scanning app,the time loss is controlled in the range of 0.4s.With the time loss in exchange for a credible verification of QRCode,the system can provide integrity verification and undeniable identity tracing of the QRCode.