A Novel QR Code and mobile phone based Authentication protocol via Bluetooth

Password based authentication schemes are widely used in our daily life when we log into websites. However, there are varieties of problems with the simple methods, including susceptibility to unintentional exposure via phishing and cross-sites password reuse. We present a novel mobile phone based authentication scheme, which intends to provide security and usability greater than that of traditional two-factor authentication protocols. It contains four parties, i.e. the user, the mobile phone, the current computer and the remote server. At first, a user's personal device-mobile phone-stores the key token by scanning QR code, which is sent from the server after user completes the registration phase. Secondly, the current computer can use the Bluetooth device address registered in remote server to launch a connection request and then it can communicate with the mobile phone via Bluetooth. Thirdly, when user wants to log into a website, server would transmit an OTP(One time password )to user's mobile phone through the current computer in order to verify the user. Finally, our scheme has achieved the mutual authentication via Bluetooth. Our scheme only needs lower computation. In terms of users' requirements, our scheme provides request about changing bind-phone for legal users over the email address registered during registration phase. After usability and security analysis, we can demonstrate that the new scheme fits for the complicated network environment.