User authentication is one of the fundamental
procedures to ensure secure communications and share
system resources over an insecure public network channel.
Thus, a simple and efficient authentication mechanism is
required for securing the network system in the real
environment. In general, the password-based authentication
mechanism provides the basic capability to prevent
unauthorized access. Especially, the purpose of the one-time
password is to make it more difficult to gain unauthorized
access to restricted resources. Instead of using the password
file as conventional authentication systems, many
researchers have devoted to implement various one-time
password schemes using smart cards, time-synchronized
token or short message service in order to reduce the risk of
tampering and maintenance cost. However, these schemes
are impractical because of the far from ubiquitous
hardware devices or the infrastructure requirements. To
remedy these weaknesses, the attraction of the QR-code
technique can be introduced into our one-time password
authentication protocol. Not the same as before, the
proposed scheme based on QR code not only eliminates the
usage of the password verification table, but also is a cost
effective solution since most internet users already have
mobile phones. For this reason, instead of carrying around a
separate hardware token for each security domain, the
superiority of handiness benefit from the mobile phone
makes our approach more practical and convenient.