Abstract:
The disclosed invention provides ways to prevent a user of mobile device from being deceived into disclosing sensitive personal information from scanning a machine-readable two-dimensional barcode that contains a URI.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS 
       [0001]    This United States patent application claims the benefit of U.S. Provisional Patent Application No. 62/032,518, filed Aug. 1, 2014, which is herein incorporated by reference in its entirety. 
     
    
     FIELD OF THE INVENTION 
       [0002]    The disclosed invention relates to machine-readable two-dimensional barcodes. More specifically, it relates to the security of machine-readable two-dimensional barcodes. 
       BACKGROUND OF THE INVENTION 
       [0003]    Two-dimensional barcodes are machine-readable barcodes that have data encoded (stored) within them. Early teachings of two-dimensional barcodes include U.S. Pat. No. 4,939,354. Simplistically stated, U.S. Pat. No. 4,939,354 teaches of an optically scannable two-dimensional barcode (“2-D barcode”) comprised of a collection of individual black squares and white squares (“cells”) arranged together to form a two-dimensional matrix. Depending on a given cell&#39;s color, it corresponds to a bit value of either a 0 (zero) or a 1 (one). 
         [0004]    2-D barcodes are a technology preceded by one-dimensional (“1-D”) barcodes. A 1-D barcode is comprised of a scannable row of black bars separated by white spaces. A ubiquitous embodiment of a 1-D barcode is the Universal Product Code (“UPC” or “UPC-A”). UPCs began appearing on consumer package goods in the 1970&#39;s, and every sighted person that has visited a grocery store since then has seen countless of them. A UPC is what, for example, allows a cash register clerk to ring up an item for purchase merely by waving its barcode over or in front of an optical scanner, or by waving a handheld optical scanner over or in front of an item&#39;s barcode. 
         [0005]    For all of their indisputable utility, UPCs are extremely limiting in that they can store only 12 numeric digits. In contrast, some embodiments of 2-D barcodes actually allow for storing thousands of numeric digits in comparable physical space. Furthermore, some embodiments of 2-D barcodes are also capable of storing different types of data besides numeric digits, for example raw bit/byte values, alphanumeric characters and Kanji characters. 
         [0006]    An increasingly common embodiment of 2-D barcodes in use today is known as a Quick Response Code (“QR Code” or “QRC”). A reader skilled in the art will appreciate that there are actually many different embodiments of 2-D barcodes in use today besides QRCs, for example, Aztec Codes, ColorCode, DataGlyphs, Data Matrix, and d-Touch to name just a few. Without a doubt, many more shall be invented; for example, in some embodiments, the cells might be multi-colored rather than simply black and white. They all share the common trait of somehow storing information, machine-readably, in two-dimensions. For the most part, what distinguishes one type from another is its “encoding,” or exact manner in which its matrix of cells is interpreted. 
         [0007]    At the time of the present disclosure, at least 40 different versions of QRCs have been implemented. Many of them have been adopted as international standards published by the International Standards Organization under specification ISO/IEC 18004. Different versions of QRCs accommodate various types and various amounts of data. For example a Version 40 QRC can store up to 7089 numeric digits (which is more than 500 times that of a UPC-A code), or 4296 alphanumeric characters, or 2953 bit/byte values, or 1817 Kanji characters, or some combination thereof in lesser amounts of each. 
         [0008]    Since QRCs can store alphanumeric data, and Universal Resource Identifiers (“URIs”) can be encoded alphanumerically, it follows that QRCs can store URIs. In fact, QRCs can store any type of URI, including but not limited to what is currently their most common embodiment, Universal Resource Locators (“URLs”). So, for example, a QRC might contain the string “http://www.example.com”. 
         [0009]    Before proceeding further, it will aid the reader to understand what is meant by the terms “mobile device,” “scan” and “hypermedia object.” 
         [0010]    The term “mobile device” (also “mobile communication device”) is intended to mean a computing device small and light enough to be held in a hand. It will have a CPU, a memory, a display screen, a touch input and/or miniature keyboard, a network interface (usually wireless), a battery power source, an optical scanner (generally implemented as a camera), an operating system capable of running hypermedia applications (“apps”), and perhaps more features besides. 
         [0011]    The term “scan” is intended to mean an action taken with an optical scanner to capture visual information (e.g., a barcode) and translate it to a digital form understandable by a computer. 
         [0012]    The term “hypermedia object” (or “hypermedia document”) is intended to mean any medium of information characterized by the use of hyperlinks (“links”). That includes text, markup languages (e.g., HTML), scripting languages (e.g., JavaScript), applets (e.g., Flash), graphics, audio, video, and more besides. Hyperlinks are “pointers” that refer to other hypermedia objects through the use of URIs. 
         [0013]    In the preferred embodiment of the present invention, the 2-D barcode is a QR Code; the cells comprising the 2-D barcode are black and white; the URI stored within the QR Code is a URL; the hypermedia object pointed to by the URL is a web page; the mobile device is a smartphone running an operating system such as, but not limited to, Android, Apple iOS, Blackberry OS, Windows Phone; the optical scanner is implemented as a camera on a mobile device; and the URI stored within a hyperlink is a URL. 
         [0014]    This being said, other embodiments can exist for any or all of these variables, and more, without departing from the spirit and scope of the present invention. 
         [0015]    For brevity, in the remainder of this paper, the term “QRC” should be understood to mean “a 2-D barcode containing a URI” in the general case, and in the preferred embodiment, it should be understood to mean “a QR Code containing a URL.” 
         [0016]    Merely one example of how a QRC can be used is as follows: A user encounters a QRC on a surface, say, a poster mounted on a wall, although on any flat or semi-flat surface will suffice (e.g., side of a box, television screen, computer monitor, roadside billboard, side of a building, tattoo, etc.). A user with a mobile device running a suitable app scans the QRC, which contains a URL. The app might or might not ask the user if he wants to view the web page residing at the URL. The app, either itself or with the aid of a web browser, then presents the user with the web page residing at the URL, which ostensibly contains content related to what is displayed on the poster or other flat or semi-flat surface. 
         [0017]    A reader skilled in the art will come to appreciate that QRCs and hyperlinks share at least four traits in common that are pertinent to the present invention: 
         [0018]    A first trait that QRCs and hyperlinks share is that they both contain URLs that point to hypermedia objects. 
         [0019]    A second trait that QRCs and hyperlinks share is that they both need to be “activated” to access the hypermedia objects that they point to. A hyperlink, for example, can be activated when a user clicks on it. A QRC, for example, can be activated when a user scans it. Other means of activation are possible. 
         [0020]    A third trait that QRCs and hyperlinks share is that it is frequently onerous, even to skilled users, to understand where their URLs are pointing, without actually activating them. In the case of a hyperlink, to determine its URL prior to activating it, the user might need to open and decode the hypermedia object&#39;s markup (e.g., HTML) to sift out the hyperlink and its respective URL, or even worse, the user might even need to analyze a script (e.g., JavaScript) that constructs the URL dynamically. In the case of a QRC, to determine its URL prior to activating it, the user would need to accomplish the profound feat of mentally decoding the matrix of cells that represent the URL. 
         [0021]    A fourth trait that QRCs and hyperlinks share is that users cannot reasonably predict whether the hypermedia objects that their URLs point to are safe to access. Any reader of newspaper headlines in recent years will appreciate that even the most highly skilled users can be deceived when they encounter a hypermedia object, for example a web page, that mimics the traits of one published by a legitimate entity, but in reality is actually published by a fraudster. Indeed, in an article published by the Telegraph, on Mar. 14, 2009, Tim Berners-Lee—the veritable founder of the World Wide Web—admitted to being conned by a fraudulent web page and losing money as a result (http://www.telegraph.co.uk/technology/news/4990442/World-Wide-Web-creator-Sir-Tim-Berners-Lee-fell-victim-to-online-fraud.html). 
         [0022]    The aforementioned at least four traits shared by QRCs and hyperlinks present many troublesome phenomena, two examples of which are described below. Many more are troublesome phenomena are possible. 
         [0023]    A first case of such troublesome phenomenon is commonly known as “phishing.” In one illustrative case of phishing, a user encounters a hyperlink in, say, an email message or social media posting. The hyperlink points to a website that has the deceptive appearance of being Legitimate.bank, but in reality has the (unlikely but illustrative) name Evil.bank. After clicking on the hyperlink, and landing on Evil.bank, the user unwittingly divulges to the fraudster some of his personally identifying information (“PII”), say, his name, address and credit card number, thereby subjecting himself to financial loss, identity theft, and/or other problems. 
         [0024]    A second case of said troublesome phenomenon is commonly known as “drive-by malware.” In one illustrative case of drive-by malware, a user encounters a hyperlink in, say, an email message or social media posting. The hyperlink points to a website that has the deceptive appearance of being Legitimate.bank, but in reality has the (again, unlikely but illustrative) name Evil.bank. After clicking on the hyperlink, Evil.bank presents malevolent content that triggers a bug in the user&#39;s browser that allows malware to be silently installed on the user&#39;s computer or mobile device, after which the user&#39;s browser is silently redirected to Legitimate.bank. From the user&#39;s visual perspective, he never visited Evil.bank. Thereafter, the malware is able, in one example, to record the user&#39;s keystrokes at Legitimate.bank, or perhaps at any other websites the user visits, where he unwittingly divulges to the fraudster some of his PII, thereby subjecting him to financial loss, identity theft, and/or other problems. 
         [0025]    In the foregoing two examples of troublesome phenomenon, and countless others like them, the hyperlinks in question are said to have served as “attack vectors.” An attack vector is a means by which an attacker can gain access to a computer system or network in order to perform malicious acts. It follows that QRCs, having what they do in common with hyperlinks, can also be used as attack vectors in comparable fashion. 
         [0026]    In one example, on Jun. 19, 2015, the Huffington Post ran an article titled “Heinz Apologises After Ketchup QR Code Redirects To Hardcore Porn Site” (http://www.huffingtonpost.co.uk/2015/06/19/heinz-apologises-after-ketchup-qr-code-redirects-to-hardcore-porn-site_n — 7621620.html). The H. J. Heinz Company, founded in 1869, manufactures thousands of food products and markets them in more than 200 countries and territories, and its ketchup market share exceeds 50% in the U.S. This news article discusses how a QRC printed on a ketchup bottle contained a URL pointing to an Internet domain name that Heinz owned at the time that the ketchup was bottled, but had abandoned before the bottle was sold. In the interim, a fraudster had registered the domain name for himself, and used the website to serve pornographic content to people who scanned the QRC on their ketchup bottles. 
         [0027]    In another example, it is easy to envision a completely feasible scenario in the not distant future whereby a single fraudulent QRC can serve as a successful attack vector against literally tens or even hundreds of millions of people in one episode. According to the BBC, more than one billion TV viewers were expected to watch the 2015 Woman&#39;s World Cup (http://www.bbc.com/sport/0/footbal1/33019625). For a future World Cup, it is entirely feasible that an attacker could hack into one or more of the computers of one or more of the television stations covering the games. If the stations display a QRC on the screen intended to promote a special website, the attacker could substitute the QRC with his own fraudulent one. Any viewers of those stations that scan the QRC will be taken to a fraudulent website that, for example, installs drive-by malware on their mobile devices. 
         [0028]    Attack vectors are also leveraged for compromising national security and cyberwarfare. According to an op-ed written by U.S. Senator Ben Sasse on Jul. 9, 2015, “a malicious attacker—likely the Chinese government—breached government databases and stole information on some 21 million federal employees. This included personal information like addresses and Social Security numbers. Most of these people held security clearances and for them it also included nearly 150 pages of material [. . . ] which detail nearly every aspect of their lives [. . . ] China may now have the largest spy-recruiting database in history.” (http://www.wired.com/2015/07/senator-sasse-washington-still-isnt-taking-opm-breach-seriously/). This situation has direct ties to phishing. According to the U.S. Computer Emergency Readiness Team (US-CERT) on Jun. 30, 2015, “US-CERT is aware of suspicious domain names that may be used in phishing campaigns masquerading as official communication from the Office of Personnel Management (OPM) or the identity protection firm CSID [. . . ] which is responsible for identity protection services for those affected by the recent data breach.” 
         [0029]    Now equipped with an understanding of some of the shortcomings of the pre-existing art, the reader is prepared to understand some of the aims of the present invention. 
         [0030]    It is one aim of the present invention to reduce the likelihood that a QRC can be used as an attack vector against a user of a mobile device. 
         [0031]    It is another aim of the present invention to provide a user with ways to determine where a QRC is pointing, without having to first access the hypermedia object to which the QRC is referring. 
         [0032]    It is another aim of the present invention to provide a user with ways to determine the publisher of a hypermedia object being referred to by a QRC, without having to first access the hypermedia object to which the QRC is referring. 
         [0033]    It is another aim of the present invention to provide a user with ways to determine whether the publisher of a hypermedia object being referred to by a QRC is a legitimate entity, without having to first access the hypermedia object to which the QRC is referring. 
         [0034]    It is another aim of the present invention to provide a user with ways to determine whether a hypermedia object being referred to by a QRC is safe to access. 
         [0035]    It is another aim of the present invention to provide a user with ways to decide based on fact, rather than on common and naïve assumptions, about whether or not it is safe to access a hypermedia object being referred to by a QRC. 
         [0036]    The aims stated above should not be construed as being exhaustive, since other aims may exist within the scope and spirit of the present invention. 
       BRIEF SUMMARY OF THE INVENTION 
       [0037]    The present invention provides methods and apparatuses for reducing the risk posed to a user as a result of scanning or anticipating scanning a QRC. In the preferred embodiment, the present invention accomplishes this by presenting the user, before he actually accesses the hypermedia object being referred to by a QRC, with a plurality of authoritative facts about the hypermedia object. In this way, the user can rely on hard facts, rather than common and naive assumptions, about whether it is safe to proceed and access the hypermedia object. 
         [0038]    It important for the reader to understand what is meant by the term “plurality of authoritative facts.” The Merriam-Webster dictionary defines the term “fact” to mean “a true piece of information.” It also defines the term “authority” to mean “(1): a citation (as from a book or file) used in defense or support, (2) the source from which the citation is drawn.” Thusly, in this paper, “plurality authoritative facts” means “plurality of true pieces of information about a hypermedia object, said true pieces of information being stated by the owner or publisher of said hypermedia object.” It makes sense that the owner or publisher of a document is, after all, best situated to authoritatively state facts about it. 
         [0039]    A legitimate website publisher will find utility in stating a plurality of authoritative facts about a hypermedia object such as a web page. The facts might include the publisher&#39;s own identity (e.g., Legitimate.bank); that the publisher is a legitimate business entity recognized by a state government; that the hypermedia object is a web page (vs. a different type of hypermedia object); the purpose of the web page (e.g., a loan promotion); details about the promotion (e.g., 0.5% interest, starting on a first date and ending on a second date); some of the PII that will be elicited from the user (e.g., name, address, social security number); and potentially more besides. By learning this plurality of authoritative facts before actually accessing the web page, the user can be assured that the web page is safe to access and the promotion is legitimate. 
         [0040]    For other types of hypermedia objects, say a movie to be streamed, other useful authoritative facts can exist. For example, for a movie to be streamed, the authoritative facts might include the title; the director; people starring in the film; date of release; and potentially more besides. 
         [0041]    Useful authoritative facts can also exist about other types of hypermedia objects. The present invention accommodates any type and number of hypermedia objects and any type and number of authoritative facts. 
         [0042]    The present invention contemplates the existence of at least three entities. The first entity is what this paper terms a “user.” The second entity is what this paper terms a “legitimate merchant.” The third entity is what this paper terms a “Certifier.” Explanations of these terms are provided next. 
         [0043]    In the preferred embodiment of the present invention, a “user” is a person who possesses a mobile device capable of scanning a QRC. 
         [0044]    In the preferred embodiment of the present invention, a “legitimate merchant” is an entity that sells products and/or services via the Web, wherein the entity&#39;s legitimacy can be established according to certain “legitimacy criteria”. The present invention accommodates any number, types and combinations of legitimacy criteria that are useful for establishing legitimacy. For example, in some embodiments, an entity that is legally licensed to conduct business by a state or federal regulatory agency might be considered legitimate. In some embodiments, a publicly traded company might be considered legitimate. In some embodiments, a company sanctioned by the Better Business Bureau might be considered legitimate. In some embodiments, a company allowed a listing in the Yellow Pages might be considered legitimate. In some embodiments, a company that has had a product tested by Consumer Reports might be considered legitimate. In some embodiments, a company that has an actual physical presence in the United States or one of its territories might be considered legitimate. In some embodiments, a non-profit organization recognized by a government might be considered legitimate. In some embodiments, an individual can define his own legitimacy criteria, say, a business owned or known by a friend or family member. In some embodiments, a company might be need to meet more than one of the above criteria, and/or an entirety or subset of many more criteria besides, to be considered legitimate. In some embodiments, some or all of the legitimacy criteria are determined by the user&#39;s employer. 
         [0045]    In the preferred embodiment of the present invention, a “Certifier” is an entity that, among other things, is considered trustworthy by both users and legitimate merchants alike. The purpose of this trust will be made clear shortly. 
         [0046]    In the preferred embodiment of the present invention, a Certifier fulfills a number of duties, some of which are highlighted below. Various other duties may exist in various other embodiments. 
         [0047]    One duty of a Certifier is to receive an application from an entity (“applicant”) claiming to be a legitimate merchant. According to some embodiments, the application might be submitted through physical means (e.g., paper forms, in-person visits, phone calls, etc.). According to some embodiments, it might be made through digital means (e.g., fax, email, filling out a webform, etc.). According to some embodiments, it might be made through a combination of some physical and some digital means. 
         [0048]    Another duty of a Certifier is to decide what legitimacy criteria it will use to establish whether an applicant is a legitimate merchant. 
         [0049]    Another duty of a Certifier is to enroll an applicant as an enrolled merchant. This paper uses the term “enrolled merchant” to mean “a legitimate merchant that is enrolled with a Certifier.” The criteria that the Certifier uses when deciding whether or not to enroll a legitimate merchant is termed “enrollment criteria.” The reader is asked to appreciate that an enrolled merchant is by definition a legitimate merchant, but a legitimate merchant might not meet all of the criteria to qualify as an enrolled merchant. For example, an enrollment criterion might be that the applicant is licensed to conduct business specifically in the State of Washington. In this case, a company incorporated in the State of California, yet not licensed to conduct business in the State of Washington, might be a perfectly legitimate merchant but not qualify as an enrolled merchant. Other enrollment criteria can exist, for example, finer-gained refinements of some of the aforementioned legitimacy criteria. 
         [0050]    Another duty of a Certifier is to determine which hypermedia objects the enrolled merchant is authorized by the Certifier to state a plurality of authoritative facts about. In the preferred embodiment, an enrolled merchant is authorized to state a plurality authoritative facts about a web page if it is published through a website owned and/or controlled by the enrolled merchant. Other embodiments of authorizations can exist, for example, the Certifier and the enrolled merchant might agree on an explicit list of web pages, or web pages in a given sub-tree of the website, and so forth. 
         [0051]    Another duty of a Certifier is to certify a QRC. The meaning of “certify” is foundational to the present invention and will soon be made clear, but for now, let it be understood that a certified QRC has a plurality of authoritative facts associated with the hypermedia object referred to by the QRC. 
         [0052]    Another duty of a Certifier is to communicate to a requestor whether or not a QRC is certified. 
         [0053]    Another duty of a Certifier is to communicate to a requestor the plurality of authoritative facts associated with a hypermedia object referred to by the QRC. 
         [0054]    For an applicant to enroll with the Certifier, it must first submit an enrollment application to the Certifier. Upon receipt of the enrollment application, the Certifier uses the aforementioned legitimacy criteria and enrollment criteria to determine if the applicant qualifies to be an enrolled merchant. 
         [0055]    If the Certifier determines to enroll the applicant as an enrolled merchant, the Certifier mutually agrees with the enrolled merchant in some algorithmic fashion upon a plurality of “security parameters.” The purpose of the security parameters includes for the Certifier and the enrolled merchant to securely authenticate one to the other, and/or to securely encrypt communications between them. In some embodiments, the security parameters include a unique identifier (“UID” or “GUID”) for representing the enrolled merchant to the Certifier. In some embodiments, the security parameters include a GUID for representing the Certifier to the enrolled merchant. In some embodiments, the security parameters include one or more symmetric encryption keys shared between the Certifier and the enrolled merchant. In some embodiments, the security parameters include one or more public/private (asymmetric) encryption keypairs. In some embodiments, the security parameters include one or more X.509 formatted certificates, for example, one or more SSL certificates. Other security parameters may exist, so long as they play a part in securing communications between the Certifier and the enrolled merchant. 
         [0056]    In the preferred embodiment of the present invention, the security parameters are generated by the Certifier, and they include a GUID for representing the enrolled merchant to the Certifier, a GUID for representing the Certifier to the enrolled merchant, an asymmetric keypair and an associated SSL certificate belonging to the Certifier, and an asymmetric keypair and an associated SSL certificate belonging to the enrolled merchant. Upon generation, the Certifier supplies the enrolled merchant with the Certifier&#39;s GUID, the Certifier&#39;s public key, the Certifier&#39;s SSL certificate, the enrolled merchant&#39;s GUID, the enrolled merchant&#39;s public and private keypairs, and the enrolled merchant&#39;s SSL certificate. The Certifier and enrolled merchant then have what they need to communicate securely. 
         [0057]    In other embodiments, the Certifier and enrolled merchant might agree on the security parameters in a different fashion. In some embodiments, the enrolled merchant might take a more active role in generating the security parameters. For example, the Certifier and the enrolled merchant might exchange keys using a key exchange algorithm such as that known as Diffie-Hellman. 
         [0058]    Once enrolled, and the security parameters have been established, the enrolled merchant may securely request that the Certifier certify a QRC. It does this by submitting a “certification request” to the certifier. The certification request is made securely, using the aforementioned security parameters. The certification request includes the QRC&#39;s URL, and a plurality of authoritative facts that the enrolled merchant wishes to have associated with the hypermedia object residing at the URL. The Certifier uses its certification criteria to determine whether or not it should honor the certification request, and if so, to associate the plurality of authoritative facts with the hypermedia object referred to by the QRC. 
         [0059]    Thereafter, when a user with a mobile device running a mobile application (or “mobile app”) encounters the QRC, the mobile application is free to ask the Certifier to supply the plurality of authoritative facts associated with the hypermedia object referred to by the QRC. If the user finds comfort in the plurality of authoritative facts, he may conclude that it is safe to proceed and access the hypermedia object. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS  
         [0060]    The following drawings and examples are exemplary of the preferred embodiment of the present invention. As such, they should not be misconstrued as limiting the scope and spirit of the present invention, as other embodiments may exist. 
           [0061]      FIG. 1  depicts a UPC-A barcode containing the numeric digits 123456789999. 
           [0062]      FIG. 2  depicts how the UPC-A barcode of  FIG. 1  was generated. 
           [0063]      FIG. 3  depicts a legitimate QRC containing a legitimate URL of “http://legitimate.bank/promo123”. 
           [0064]      FIG. 4  depicts how the legitimate QRC of  FIG. 3  was generated. 
           [0065]      FIG. 5  depicts a fraudulent QRC containing a fraudulent URL of “http://evil.bank/promo123”. The reader will appreciate the exceeding visual resemblance between this fraudulent QRC and the legitimate QRC of  FIG. 3 . 
           [0066]      FIG. 6  depicts how the fraudulent QRC of  FIG. 5  was generated. 
           [0067]      FIG. 7  depicts a mobile application scanning the legitimate QRC of  FIG. 3 , and the ensuing presentation of a legitimate web page residing at the legitimate URL of  FIG. 3 . 
           [0068]      FIG. 8  depicts a mobile application scanning the fraudulent QRC of  FIG. 5 , and the ensuing presentation of a fraudulent web page residing at the fraudulent URL of  FIG. 5 . The reader will appreciate the identical visual appearance between this fraudulent web page and the legitimate web page of  FIG. 7 . 
           [0069]      FIG. 9  depicts an applicant applying to, and being accepted by, a Certifier to become an enrolled merchant. 
           [0070]      FIG. 10  depicts a flowchart performed by the Certifier of  FIG. 9  to determine if the applicant of  FIG. 9  qualifies as legitimate. 
           [0071]      FIG. 11  depicts a flowchart performed by the Certifier of  FIG. 9  to determine if the applicant of  FIG. 9  qualifies for enrollment. 
           [0072]      FIG. 12  depicts an enrolled merchant (prior to enrollment, known as the applicant of  FIG. 9 ) requesting the Certifier of  FIG. 9  to certify the legitimate QRC of  FIG. 3 . 
           [0073]      FIG. 13  depicts a plurality of authoritative facts that the enrolled merchant of  FIG. 12  is asking the Certifier of  FIG. 9  to associate with legitimate web page of  FIG. 7 . The plurality of authoritative facts happens to be marshaled as a JSON (JavaScript Object Notation) data structure, which contains the legitimate URL of  FIG. 3 . Other marshaling embodiments can just as easily be used, such as Extensible Markup Language (XML), Comma Separated Values (CSV), External Data Representation (XDR), key-value arrays, proprietary formats, and so forth. 
           [0074]      FIG. 14  depicts a flowchart performed by the Certifier of  FIG. 9  to determine if the legitimate QRC of  FIG. 3  qualifies to become certified. 
           [0075]      FIG. 15  depicts the mobile application of  FIG. 7  requesting the Certifier of  FIG. 9  to resolve the legitimate QRC of  FIG. 3 . By “resolve” it is meant that the Certifier supplies the mobile application with the plurality of authoritative facts of  FIG. 13  that were associated with the legitimate web page of  FIG. 7 . 
           [0076]      FIG. 16  depicts a behavior of the mobile application of  FIG. 7  when scanning the fraudulent QRC of  FIG. 5 . 
           [0077]      FIG. 17  depicts a behavior of the mobile application of  FIG. 7  when scanning the legitimate QRC of  FIG. 3  after it was certified. 
           [0078]      FIG. 18  depicts the mobile application of  FIG. 7  rendering the plurality authoritative facts of  FIG. 13 . 
       
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
       [0079]    The following drawings and examples are exemplary of the preferred embodiment of the present invention. As such, they should not be misconstrued as limiting the scope and spirit of the present invention, as other embodiments may exist. 
         [0080]      FIG. 1  depicts a UPC-A barcode  1  containing the 12-digit string 123456789999 2. 
         [0081]      FIG. 2  depicts how the UPC-A barcode  1  of  FIG. 1  was generated. The 12-digit string 123456789999 2 of  FIG. 1  is provided as input to a UPC-generating computer algorithm  3  that yields the UPC-A barcode  1  of  FIG. 1  as output. 
         [0082]      FIG. 3  depicts a legitimate QRC  11  containing a legitimate URL  12  of “http://legitimate.bank/promo123”. 
         [0083]      FIG. 4  depicts how the legitimate QRC  11  of  FIG. 3  was generated. The legitimate URL  12  of  FIG. 3  is provided as input to a QRC-generating computer algorithm  13  which yields the legitimate QRC  11  as output. 
         [0084]      FIG. 5  depicts a fraudulent QRC  21  containing a fraudulent URL of “http://evil.bank/promo123”  22 . The reader will appreciate the striking visual resemblance between this fraudulent QRC  21  and the legitimate QRC  11  of  FIG. 3 . 
         [0085]      FIG. 6  depicts how the fraudulent QRC  21  of  FIG. 5  was generated. The fraudulent URL  22  of  FIG. 5  is provided as input to the QRC-generating computer algorithm  13  of  FIG. 4  which yields the fraudulent QRC  21  as output. 
         [0086]      FIG. 7  depicts the legitimate QRC  11  of  FIG. 3  being scanned by a mobile app  32  running on a mobile device  31 , resulting in a legitimate web page  33  being displayed on the mobile device  31 . 
         [0087]      FIG. 8  depicts the fraudulent QRC  21  of  FIG. 5  being scanned by the mobile app  32  of  FIG. 7  running on the mobile device  31  of  FIG. 7 , resulting in a fraudulent web page  43  being displayed on the mobile device  31 . The reader will appreciate the identical visual appearance of this fraudulent web page  43  and the legitimate web page  33  of  FIG. 7 . It is from this identical visual appearance that the aforementioned troublesome phenomena of phishing and drive-by malware are known to occur. 
         [0088]      FIG. 9  depicts an applicant  100  applying to a  102  Certifier to enroll as an enrolled merchant. The applicant  100  sends an enrollment application  101  to the Certifier  102 . The Certifier  102  possesses legitimacy criteria  103  to be used to determine if the applicant  100  qualifies to be recognized as legitimate. The Certifier  102  also possesses enrollment criteria  104  to be used to determine if the applicant  100  qualifies to become enrolled. If the applicant  100  meets the legitimacy criteria  103  and the enrollment criteria  104 , the Certifier  102  determines that the applicant  100  has become an enrolled merchant  250 . In other words, the applicant  100  and the enrolled merchant  250  are the same entity, yet that entity is referred to by a first name (applicant  100 ) before enrollment and by a second name (enrolled merchant  250 ) after enrollment. The logic that the Certifier  102  will use to determine whether or not the applicant  100  meets the legitimacy criteria  103  and the enrollment criteria  104  will soon be made clear in  FIG. 10  and  FIG. 11  respectively. 
         [0089]    Further to  FIG. 9 , when the Certifier  102  determines that the enrolled merchant  250  is enrolled, the Certifier  102  generates security parameters comprised of Certifier security parameters  105  (represented by the left facing keys) and enrolled merchant security parameters  106  (represented by the right facing keys). The Certifier  102  transmits to the enrolled merchant  250  the enrolled merchant security parameters  106 , and at least a portion of the Certifier security parameters  105  sufficient to empower the enrolled merchant  250  and the Certifier  102  to enable to communicate securely. By at least a portion, it is mean that, for example, if the enrolled merchant  250  and the Certifier  102  will be using asymmetric encryption to secure their communications, then the Certifier  102  would include in the transmission to the enrolled merchant  250  the Certifier&#39;s  102  public key but not the corresponding private key. Once the enrolled merchant  250  receives the enrolled merchant security parameters  106  and the at least a portion of the Certifier security parameters  105 , the enrolled merchant  250  and the Certifier  102  have what they need to communicate securely with each other. 
         [0090]      FIG. 10  depicts a subroutine flowchart performed by the Certifier  102  of  FIG. 9  to determine if the applicant  100  of  FIG. 9  meets the Certifier&#39;s legitimacy criteria  103  of  FIG. 9 . In this example, there are two legitimacy criteria  103 : the applicant  100  must be legally incorporated, and the applicant  100  must be traded on a public stock exchange. The subroutine is entered at step  200 . Procession is made to step  201  where it is determined whether or not the applicant  100  is legally incorporated. If the applicant  100  is not legally incorporated, procession is made to step  204  where it is determined that the legitimacy criteria  103  is not met, and further procession is made to step  205  where the subroutine returns. 
         [0091]    Further to  FIG. 10 , if it was determined at step  201  that the applicant  100  is legally incorporated, procession is made to step  202  where it is determined whether or not the applicant  100  is traded on a public stock exchange. If the applicant  100  is not traded on a public stock exchange, procession is made to step  204 , where it is determined that the legitimacy criteria  103  is not met, and further procession is made to step  205  where the subroutine returns. 
         [0092]    Further to  FIG. 10 , if it was determined at step  202  that the applicant  100  is traded on a public stock exchange, procession is made to step  203  where it is determined that the legitimacy criteria  103  is met, and further procession is made to step  205  where the subroutine returns. The reader will appreciate that is at this point that the Certifier  102  would determine that the applicant  100  qualifies as being legitimate. 
         [0093]      FIG. 11  depicts a subroutine flowchart performed by the Certifier  102  of  FIG. 9  to determine if the applicant  100  of  FIG. 9  meets the Certifier&#39;s enrollment criteria  103  of  FIG. 9 . In this example, there are two enrollment criteria  103 : the applicant  100  must be licensed to conduct business in the State of Washington, and the applicant  100  must be accredited by the Better Business Bureau (BBB). The subroutine is entered at step  300 . Procession is made to step  301  where it is determined whether or not the applicant  100  is legally licensed to conduct business in the state of Washington. If the applicant  100  is not legally licensed to conduct business in the state of Washington, procession is made to step  304  where it is determined that the enrollment criteria  103  is not met, and further procession is made to step  305  where the subroutine returns. 
         [0094]    Further to  FIG. 11 , if it was determined at step  301  that the applicant  100  is legally licensed to conduct business in the state of Washington, procession is made to step  302  where it is determined whether or not the applicant  100  is accredited by the BBB. If the applicant  100  is not accredited by the BBB, procession is made to step  304 , where it is determined that the enrollment criteria  103  is not met, and further procession is made to step  305  where the subroutine returns. 
         [0095]    Further to  FIG. 11 , if it was determined at step  302  that the applicant  100  is accredited by the BBB, procession is made to step  303  where it is determined that the enrollment criteria  103  is met, and further procession is made to step  305  where the subroutine returns. The reader will appreciate that it is at this point that the Certifier  102  would determine that the applicant  100  has become the enrolled merchant  250  of  FIG. 9 . 
         [0096]      FIG. 12  depicts the enrolled merchant  250  of  FIG. 9  requesting the Certifier  102  of  FIG. 9  to certify the legitimate QRC  11  of  FIG. 3 . The enrolled merchant  250  sends a certification request  150  to the Certifier  102 . The certification request  150  includes the legitimate URL  12  of  FIG. 3 , and a plurality of authoritative facts  151  about the legitimate web page  33  of  FIG. 7  residing at the legitimate URL  12 . The Certifier  102  possesses certification criteria  152  to be used to determine if the legitimate QRC  11  qualifies to become certified. If the legitimate QRC  11  qualifies to become certified, the Certifier  102  associates the plurality of authoritative facts  151  with legitimate web page  33 . The reader will appreciate that it is at this point that the Certifier  102  would consider the legitimate QRC  11  to be certified. 
         [0097]      FIG. 13  depicts the plurality of authoritative facts  151  of  FIG. 12  that the enrolled merchant  250  wants the Certifier  102  to associate with the legitimate web page  33  of  FIG. 7 . The plurality of authoritative facts  151  is marshaled in a JSON (JavaScript Object Notation) data structure  153 . Other marshaling embodiments can just as easily be used, such as Extensible Markup Language (XML), Comma Separated Values (CSV), External Data Representation (XDR), key-value arrays, proprietary formats, and so forth. The plurality of authoritative facts  151  happen to specify to the URI type (a URL), the actual legitimate URL  12  of  FIG. 3 , the certification date (2015 Mar. 9), a descriptive representation of some of the PII (NAME, ADDRESS, SOCIAL_SECURITY_NUMBER) that will be elicited from the user by the legitimate web page  33  residing at the legitimate URL  12 , or by an ensuing web page also residing at that website. In other words, the PII might be elicited from the user by a second or later web page that trails the legitimate web page  33 . 
         [0098]      FIG. 14  depicts a subroutine flowchart performed by the Certifier  102  to determine if the legitimate QRC  11  of  FIG. 3  qualifies for certification. In this example, there are three certification criteria  152 : the enrolled merchant  250  must still be enrolled, the enrolled merchant  250  must own the domain name at which the legitimate web page  33  of  FIG. 7  resides, and the legitimate web page  33  must actually exist. The subroutine is entered at step  400 . Procession is made to step  401  where it is determined whether or not the enrolled merchant  250  is still enrolled. If it is determined that the enrolled merchant  250  is not still enrolled, procession is made to step  405  where it is determined that the certification criteria  152  is not met, and further procession is made to step  406  where the subroutine exits. 
         [0099]    Further to  FIG. 14 , if it was determined at step  401  that the enrolled merchant  250  is still enrolled, procession is made to step  402  where it is determined whether or not the enrolled merchant  250  owns the Internet domain name at which the legitimate web page  33  resides. If it is determined that the enrolled merchant  250  does not own the Internet domain name at which the legitimate web page  33  resides, procession is made to step  405  where it is determined that the certification criteria  152  is not met, and further procession is made to step  406  where the subroutine exits. 
         [0100]    Further to  FIG. 14 , if it was determined at step  402  that the enrolled merchant  250  owns the domain name at which the legitimate web page  33  resides, procession is made to step  403  where it is determined whether or not the legitimate web page  33  actually exists. The Certifier  102  might determine this, for example, by attempting to access the legitimate web page  33 . If it is determined that the legitimate web page does not exist, procession is made to step  405  where it is determined that the certification criteria  152  is not met, and further procession is made to step  406  where the subroutine exits. 
         [0101]    Further to  FIG. 14 , if it was determined at step  403  that the hypermedia object exists, procession is made to step  404  where it is determined that the certification criteria  152  is met, and further procession is made to  406  where the subroutine returns. The reader will appreciate that it is at this point that the Certifier  102  would determine that the legitimate QRC  11  is certified. 
         [0102]      FIG. 15  depicts the mobile application  32  of  FIG. 7 , running on the mobile device  31  of  FIG. 7 , requesting the Certifier  102  of  FIG. 9  to resolve the legitimate QRC  11  of  FIG. 3 . The mobile application  32  transmits a message comprising the legitimate URL  12  of  FIG. 3  to the Certifier  102 . The Certifier  102  transmits the authoritative facts  151  of  FIG. 13  to the mobile application  32 . 
         [0103]      FIG. 16  depicts a behavior of the mobile application  32  of  FIG. 7  when encountering the fraudulent QRC  21  of  FIG. 5 . The message being displayed indicates that the fraudulent QRC  21  is not certified, and that it might therefore be risky to proceed to access the fraudulent web page  43  of  FIG. 8 . If the proceed button  160  is pressed, the fraudulent web page  43  will be accessed. If the cancel button  161  is pressed, the fraudulent web page  43  will not be accessed. 
         [0104]      FIG. 17  depicts a behavior of the mobile application  32  of  FIG. 7  when encountering the legitimate QRC  11  of  FIG. 3  that has been certified. The message being displayed indicates that the legitimate QRC  11  is certified and offers the opportunity to view the plurality of authoritative facts  151  of  FIG. 12 . If the yes button  162  is pressed, the JSON data structure  153  will be rendered for viewing. If the no button  163  is pressed, the JSON data structure  153  will not be rendered for viewing. 
         [0105]      FIG. 18  depicts the mobile application  32  of  FIG. 7  rendering the JSON data structure  153  of  FIG. 13 . If the proceed button  164  is pressed, the legitimate web page  33  of  FIG. 7  will be accessed. If the cancel button  165  is pressed, the legitimate web page  33  will not be accessed. 
         [0106]    The foregoing drawings and examples are exemplary of the preferred embodiment of the present invention. As such, they should not be misconstrued as limiting the scope and spirit of the present invention, as other embodiments may exist.