Secure information transfer via bar codes

A method for providing a document using a secure bar code includes encrypting the document to generate an encrypted document, and mixing together bits for a security credential with bits for the encrypted document to generate a set of mixed bits having a predetermined order. The security credential is for decrypting the encrypted document. The method further includes inserting the set of mixed bits into the secure bar code and outputting the secure bar code. A bar code reader knows the predetermined order and is configured to read the secure bar code. The bar code reader may also be configured to un-mix the mixed bits based on the predetermined order, and decrypt the encrypted document with the security credential.

BACKGROUND

Information can be shared between computing devices by a variety of techniques. For example, a first computing device displays a bar code and another computing device reads the bar code. The first computing device may insert information to be shared into the bar code and then display the bar code. The second computing device uses a bar code reading device to read the bar code and extract the information from the bar code. The two computing devices may be mobile devices in which case bar code sharing may likely occur in public places where unintended recipients can easily intercept the displayed bar code with their computing devices. Therefore, without security measures, the information may be compromised.

DETAILED DESCRIPTION

Described herein are techniques for displaying information in a secure bar code that has security features to protect the information from detection by people using bar code readers who are not the intended recipients of the information.

According to one embodiment, a method for providing a document using a secure bar code includes encrypting the document to generate an encrypted document, and mixing together bits for a security credential with bits for the encrypted document to generate a set of mixed bits having a predetermined order. The security credential is for decrypting the encrypted document. The method further includes inserting the set of mixed bits into the secure bar code and outputting the secure bar code. A selected bar code reader knows the predetermined order and is configured to read the secure bar code. The bar code reader is configured to un-mix the mixed bits based on the predetermined order to separate the encrypted document from the security credential, and decrypt the encrypted document with the security credential.

According to another embodiment, a method for providing a document using a secure bar code includes encrypting, via a computing device, the document to generate an encrypted document, and inserting, via the computing device, the encrypted document and a network address into the secure bar code. The network address identifies a network location of a security credential usable for decrypting the encrypted documents. The method further includes outputting the secure bar code on a display of the computing device. A bar code reader is configured to read the secure bar code and access the network location based on the network address to retrieve the security credential. Thereafter, the bar code reader is configured to decrypt the encrypted document with the security credential.

According to another embodiment, a method for providing a document using a secure bar code includes inserting the document into the secure bar code. The method further includes outputting, via a computing device, the secure bar code for display, and outputting, via the computing device, a masking image masking the secure bar code. The masking image masks the display of the secure bar code according to a masking technique. A bar code reader is configured to read the secure bar code and the masking image. The bar code reader is further configured to separate the masking image from the secure bar code based on the masking technique to isolate the secure bar code. Thereafter, the bar code reader is configured to extract the document from the secure bar code.

According to another embodiment, a non-transitory computer-readable storage medium includes instructions for providing a document using a secure bar code. The instructions, when executed, are for controlling a computing device to be configured for: encrypting the document to generate an encrypted document; mixing together bits for a security credential with bits for the encrypted document to generate a set of mixed bits having a predetermined order, wherein the security credential is for decrypting the encrypted document; inserting the set of mixed bits into the secure bar code; and outputting the secure bar code, wherein a bar code reader knows the predetermined order and is configured to read the secure bar code, un-mix the mixed bits based on the predetermined order, and decrypt the encrypted document with the security credential.

According to another embodiment, a non-transitory computer-readable storage medium includes instructions for providing a document using a secure bar code. The instructions, when executed, are for controlling a computing device to be configured for: encrypting the document to generate an encrypted document; inserting the encrypted document and a network address into the secure bar code, wherein the network address identifies a network location of a security credential for decrypting the encrypted documents; and outputting the secure bar code on a display of the computing device. A bar code reader is configured to read the secure bar code, access the network location based on the network address to retrieve the security credential. Thereafter, the bar code reader is configured to decrypt the encrypted document with the security credential.

According to another embodiment, a non-transitory computer-readable storage medium includes instructions for providing a document using a secure bar code. The instructions, when executed, are for controlling a computing device to be configured for: inserting the document into the secure bar code; outputting the secure bar code for display; and outputting a masking image masking the secure bar code. The masking image masks the display of the secure bar code according to a masking technique. A bar code reader is configured to read the secure bar code and the masking image. The bar code reader is further configured to separate the masking image from the secure bar code based on the masking technique to isolate the secure bar code, and extract the document from the secure bar code.

FIG. 1depicts a computing system100according to one embodiment. Computing system100includes a server105, a first computing device110, a second computing device115, and a network120. Server105may be a computing device configured to operate a server operating system. Server105includes a processor125and a storage device130. First computing device110includes a processor135, a storage device140, and a display145. Storage device140may store software150, which may be supplied from storage device140to processor135for execution. Similarly, second computing device115includes a processor155(e.g., a microprocessor, a microcontroller, control logic, etc.), a storage device160, and a reader165. Storage device160may similarly store software170, which may be supplied from storage device160to processor155for execution. Storage devices130,140, and160may be non-transitory computer readable storage mediums. First and second computing devices110and115may include a variety of devices, such as mobile devices (e.g., personal digital assistants (PDAs), smartphones, a bar code reader, etc.), a desktop computer, a laptop computer, a tablet computer, etc. Network120may include one or more communication networks, such as one or more intranets, the Internet, etc.

According to one embodiment, first computing device110displays information175(e.g., a document) that is represented in a secure bar code180on display145. Secure bar code180includes a security feature185to defeat an unauthorized computing device from extracting information175from secure bar code180if the unauthorized computing device intercepts secure bar code180. Second computing device115includes software and/or hardware that allows second computing device115to read secure bar code180and decode or otherwise disable security feature185to extract information175from secure bar code180. Embodiments of security feature185are described in further detail below.

Referring toFIG. 2, the figure depicts first computing device110displaying secure bar code180on display145.FIG. 2further depicts second computing device115using reader165to read secure bar code180from display145of first computing device110. According to one embodiment, reader165of second computing device115includes a camera that captures an image (sometimes referred to as reading) of secure bar code180. According to an alternative embodiment, reader165includes a scanner (e.g., a laser scanner) that scans secure bar code180. First computing device110and second computing device115are depicted as smartphones. However, embodiments described herein are not limited to smartphones.

Secure bar code180may be a two-dimensional bar code, such as a quick response (QR) code, as depicted inFIG. 2. Alternatively, secure bar code180may be a one-dimensional bar code.

Referring again toFIG. 1, according to one embodiment, information175is encrypted by an encryption algorithm. First computing device110may perform the encryption via an encryption module182, which may be a software module included in software150. Information175, now in encrypted form, may be incorporated in secure bar code180, for example, by first computing device110. A security credential190(e.g., a key) used for decrypting information175may also be inserted into secure bar code180, for example, by first computing device110. According to a specific embodiment, the bits composing information175and the bits composing security credential190are mixed together (i.e., scrambled) in a predetermined order, and the resulting mixed bits are inserted in secure bar code180. First computing device110may include a mixer192that mixes the bits. In one embodiment, the mixed bits of information175and security credential190constitute security feature185. An unauthorized computing device that reads secure bar code180will not know the predetermined order and thus cannot easily un-mix the mixed bits to extract information175and security credential190from security feature185, and consequently will not be able to decrypt information175to obtain a clear text version of information175.

According to one embodiment, another computing device (e.g., server105) may generate secure bar code180, as described both above and below, and transfer secure bar code180to first computing device110for storage, display, and/or further transfer to another computing device. According to an embodiment where first computing device110generates secure bar code180, first computing device110may transfer secure bar code180to another computing device, for storage, display, and/or further transfer.

According to one embodiment, second computing device115may receive and store scrambling information that specifies the predetermined order so that the mixed bits may be un-mixed by second computing device115. Second computing device115may include an un-mixer196that un-mixes the mixed bits based on the scrambling information. Reader165may capture an image of secure bar code180or otherwise scan secure bar code180, and un-mix the mixed bits based on the scrambling information. Subsequent to un-mixing, a decryption module197of second computing device115may use security credential190to decrypt information175.

First computing device110may provide the scrambling information to second computing device115. According to another embodiment, another computing device, such as server105, provides the scrambling information to first and second computing devices110and115.

According to another embodiment, the predetermined order is selected from a number of predetermined orders where each of the predetermined orders is unique. Each predetermined order is associated with a unique marker position that is located in secure bar code180. A marker that is located at a selected marker position is an indicator of a particular predetermined order which is associated with the marker position. Server105or computing device110may insert the marker in secure bar code180at the selected marker position. The selected marker position of the maker is determined by computing device115when computing device115reads the secure bar code. Thereafter, second computing device115determines that the bits composing information175and the bits composing security credential190were mixed according to the particular predetermined order based on the selected marker position of the marker.

Server105may host subscription accounts for users of first and/or second computing devices110and115for providing the scrambling information to first and second computing devices110and115. The subscription accounts may be secure accounts that are accessible via a password, a security credential, or the like. Server105may also provide software150and170to first and second computing devices110and115, respectively, where software150may be used for generating secure bar code180, and software170may be used for determining information175from secure bar code180.

FIG. 3depicts a computing system300according to an alternative embodiment. Computing system300is substantially similar to computing system100, but computing system300differs from computing system100in that secure bar code180includes a network address (e.g., a uniform resource locator (URL))195for a network location (e.g., a computing system) at which security credential190may be retrieved. More specifically, secure bar code180includes information175in an encrypted form and includes network address195where secure bar code180may be displayed on display145. Network address195may be for a network location of the subscription account held by the user of second computing device115. The subscription account may be provided by server105that may operate in conjunction with a domain controller, a user controller, or the like to provide security credential190to second computing device115. After second computing device115uses network address195to retrieve security credential190, second computing device115uses security credential190to decrypt information175. Network address195and information175may be concatenated, without mixing, as security feature185according to one embodiment. A user of a computing device that does not have access to the subscription account of the user of second computing device115will not be able to retrieve security credential190for decrypting information175. According to a further embodiment, information175and network address195may be mixed as described above in the predetermined order where second computing device115uses the scrambling information to un-mix information175and network address195.

FIG. 4depicts a computing system400according to an alternative embodiment. Computing system400is substantially similar to computing system100, but differs from computing system100in that first computing device110displays a masking image405with secure bar code180on display145according to one embodiment. Masking image405masks secure bar code180so that secure bar code180is less easily detectable than the display of secure bar code180without masking image405. Masking image405may mask secure bar code180according to a masking technique, which is one embodiment of security feature185. Masking image405may be any suitable image that can mask the display of secure bar code180. According to one embodiment, first computing device110includes a masking module410that executes the masking technique to mask secure bar code180with masking image405on display145. Masking module410may include a portion of software150and may be supplied to first computing device110by server105.

Second computing device115may include an un-masking module415, which executes an un-masking technique to un-mask masking image405from secure bar code180. The un-masking technique may use a copy of masking image405, which is stored in storage device160, to un-mask masking image405from secure bar code180. Un-masking module415may include a portion of software170and may be supplied to second computing device115by server105.

A computing device that is unaware that masking image405is masking secure bar code180may not detect secure bar code180on display145. For example, the computing device may not include un-masking module415and/or may not store a copy of masking image405that may be used by un-masking module415for un-masking secure bar code180.

Secure bar code180, masked by masking image405, may include one or more of security features185described above. For example, secure bar code180masked by masking image405may include information175in encrypted form mixed with security credential190, or may include information175in encrypted form and network address195for the network location from which security credential190is retrievable.

According to one embodiment, first computing device110retrieves masking image405from another computing device, such as server105. Masking image405may be associated with a network address that is used by first computing device110for retrieving masking image405. The network address may be a uniform resource locator (URL). First computing device110inserts the network address into bar code180.

FIG. 5depicts a high-level flow diagram of a method500for providing information175(e.g., a document) using secure bar code180according to one embodiment. The high-level flow diagram represents an example embodiment and those of skill in the art will understand that various steps of high-level flow diagram500may be combined and/or added without deviating from the scope and the purview of the embodiment.

At505, information175is encrypted to generate encrypted information. According to one embodiment, first computing device110encrypts information175. According to an alternative embodiment, first computing device110may receive the encrypted information from another computing device.

At510, the bits of security credential190are mixed (or scrambled together) with the bits of the encrypted information to form a set of mixed bits. The mixed bits have the predetermined order, which is known by second computing device115, for example, via storage of a copy of the scrambling information that specifies the predetermined order. First computing device110may perform the mixing.

At515, the mixed bits are inserted into the secure bar code180. First computing device110may insert the mixed bits into secure bar code180.

At520, first computing device110outputs secure bar code180, for example, on display145. According to alternative embodiments, first computing device110may output secure bar code180in other forms, such as in printed form on a piece of paper. Second computing device115may read secure bar code180and un-mix the mixed bits to separate the encrypted information from security credential190based on the scrambling information that specifies the predetermined order. Thereafter, second computing device115may decrypt the encrypted information using security credential190. The scrambling information that specifies the predetermined order may be a shared secret between first computing device110and second computing device115.

According to another alternative embodiment, secure bar code180may be a three-dimensional bar code. Three-dimensional bar code180may be formed in a material capable of having a three-dimensional bar code180formed therein, such as metal, plastic, etc. First computing device110may control another device to form three-dimensional bar code180in the material, or may form three-dimensional bar code180in the material.

FIG. 6depicts a high-level flow diagram of a method600for providing information175(e.g., a document) using secure bar code180according to one embodiment. The high-level flow diagram represents an example embodiment and those of skill in the art will understand that various steps of high-level flow diagram600may be combined and/or added without deviating from the scope and the purview of the embodiment.

At605, information175is encrypted to generate encrypted information. According to one embodiment, first computing device110encrypts information175. According to an alternative embodiment, first computing device110may receive the encrypted information from another computing device.

At610, the encrypted information and network address195are inserted into secure bar code180. Network address195identifies a network location of security credential190used by second computing device115for decrypting the encrypted information. According to a specific embodiment, first computing device110inserts the encrypted information and network address195into secure bar code180.

At615, first computing device110outputs secure bar code180on display145or in another form, such as in printed form. Second computing device115may read secure bar code180and extract the encrypted information and network address195from secure bar code180. Thereafter, second computing device115may use network address195to retrieve security credential190to decrypt the encrypted information.

FIG. 7depicts a high-level flow diagram of a method700for providing information175(e.g., a document) using secure bar code180according to another embodiment. The high-level flow diagram represents an example embodiment and those of skill in the art will understand that various steps of high-level flow diagram700may be combined and/or added without deviating from the scope and the purview of the embodiment.

At705, information175is inserted in secure bar code180, for example, by first computing device110.

At710, first computing device110outputs secure bar code180on display145or in an alternative form.

At715, first computing device110outputs masking image405to mask secure bar code180. It will be understood that710and715may be executed substantially simultaneously by first computing device110. Masking image405masks secure bar code180according to a masking technique. Second computing device115may read secure bar code180and masking image405and separate masking image405from secure bar code180based on the masking technique. Subsequently, second computing device115may decrypt the encrypted information using secure bar code180. The masking technique and/or masking image405may be shared secrets between first computing device110and second computing device115.

The above description illustrates various embodiments, along with examples of how aspects thereof may be implemented. The above examples and embodiments should not be deemed to be the only embodiments, and are presented to illustrate the flexibility and advantages of the teachings hereof. Based on the above disclosure and the following claims, other arrangements, embodiments, implementations, and equivalents may be employed without departing from the scope hereof, as defined by the claims.