A QR Identification System with SMS Notification

Implementing Secure Hash Algorithm 256 (SHA-

256)
Ria Clarisse M. Sy Mark Philip M. Sy Julius N. Abucejo
Department of Information Technology Department of Information Technology Department of Information Technology
Cavite State University Cavite State University Cavite State University
Indang, Philippines Indang, Philippines Indang, Philippines
[email protected] [email protected] [email protected]
2023 International Conference on Computational Intelligence, Networks and Security (ICCINS) | 979-8-3503-1379-6/23/$31.00 ©2023 IEEE | DOI: 10.1109/ICCINS58907.2023.10450008

Kevin Alli Aquino Patrick B. Bongalos Lawrence Neil C. Limboc

Department of Information Technology Department of Information Technology Department of Information Technology
Cavite State University Cavite State University Cavite State University
Indang, Philippines Indang, Philippines Indang, Philippines
[email protected] [email protected] [email protected]

Abstract— The system for identification in most universities victims of identity theft, a growing number of Filipinos are
and campuses of manual checking of identification cards is suspicious of frauds and scams as a result of the rise in digital
prone to fault and less secured. The aim of this study was to banking within the country [5]. Many student identity cards
integrate the Secure Hash Algorithm-256 (SHA-256) into a QR include volatile information that is simple to obtain. Most
identification system with SMS notification and evaluate its universities unintentionally disclose this information to the
performance based on the ISO 25010 standard. The system was public, resulting in cyber threats. To avoid this, it is good to
designed as a web application for automated attendance use emerging technologies to help improve the existing
tracking using hashed QR codes and SMS notifications for practices [6], such as hashing the QR codes to make the data
students' emergency contacts. The system consists of four
more private and secure. The Secure Hash Algorithm (SHA)-
modules namely, account management module for handling and
256 algorithm is a much more secure way of securing data [7].
managing different system accounts and account processes, QR
module for generating and scanning unique hashed QR codes It consists of numeric and string combinations output with a
for each student, record management module for handling fixed length that represents the original data. Using the
students and attendance data records and notification module algorithm will prevent the disclosure of confidential
for handling different system notifications and sending of SMS information and prevent hacking because it will be difficult to
alerts. The evaluation phase involved IT specialists, university attack [8].
security personnel, and students who thoroughly assessed the
The QR identification system incorporates the use of
performance of the system in the following criteria, functional
SHA-256, a highly secure cryptographic hashing algorithm, to
suitability, performance efficiency, compatibility, usability,
reliability, security, maintainability, and portability. The
ensure the privacy and security of sensitive information [9].
evaluation results showed excellent ratings across all software By leveraging SHA256, the system effectively safeguards
criteria, with an average score of 4.89 for non-technical users against cryptographic attacks by producing a fixed-length
and 4.55 for technical users. Through this paper, a system using hash value that is extremely difficult to reverse-engineer,
a hashed QR code that can be implemented in schools and while ensuring the integrity of the information and promptly
universities is discussed. detecting any unauthorized changes or tampering attempts
[10]. The additional layer of security significantly reduces the
risk of exposing confidential data, providing robust protection
Keywords—cryptography, QR code, SHA-256, identification against identity theft and potential cyber threats [11]. It is
system, SMS alert
worth noting that the choice to utilize SHA-256 aligns with
I. INTRODUCTION established security standards, such as those defined in the
government's FIPS 180-4, ensuring compliance with widely
There are several automated attendance systems, including recognized security protocols [12]. While SHA-256 provides
biometric and radio frequency identification (RFID) substantial benefits, it is important to adopt a comprehensive
technologies. However, the systems mentioned need a piece security approach that incorporates additional measures.
of equipment that is neither inexpensive nor low maintenance. These may include encryption techniques, strict access
The price range for a biometric system is between 7,500 and controls, and regular security audits [13]. By incorporating
67,500 pesos. The price range for RFID scanners is between SHA-256 into the QR identification system, the proponents
2,600 and 78,000 pesos. On the other hand, the QR code is an effectively bolster overall security, offering heightened
efficient and secure alternative for these devices available on protection for sensitive information [14]. This reassures
the market [1]. The QR code is a type of barcode that stores stakeholders and users alike, instilling confidence in the
information as a series of pixels in a square-shaped grid. It is system's ability to safeguard their data in today's digital
read in two directions: top to bottom and right to left [2]. This landscape.
allows it to store significantly more data compared to standard
barcodes that can only be read in one direction, from top to In this paper, an identification system that can track QR
bottom [3]. As easily accessible information comes in handy code interaction is presented. The generated QR code is
with the use of QR codes, it is also prone to exposing sensitive secured through the implementation of SHA-256 to the
information such as birthdays, emails, addresses, and contact sensitive information of the records. A module for attendance
numbers [4]. With 5 million people claiming to have been management is included in the scope of the study with the
capability to send SMS in every interaction of the QR code.

XXX-X-XXXX-XXXX-X/XX/$XX.00 ©20XX IEEE

Authorized licensed use limited to: Zhejiang University. Downloaded on December 17,2024 at 06:58:41 UTC from IEEE Xplore. Restrictions apply.
 II. RELATED WORKS designing, development and testing methods. The system was
the result of the methods and inputs used to get there. Impact
A. QR Code refers to practical implications and applications of the study.
According to Gregersen [15], a quick response code or QR This includes the ways in which the system can be used and
Code is a sort of barcode composed of black-and-white printed affects stakeholders such as students, parents, and educational
squares that represent numbers from 0 to 9 and letters from A institutions.
to Z or non-Latin characters, used to encode data and read by
computer systems. QR codes were mainly used for product
tracking but nowadays, it can also be used in other industries
due to it taking less time and greater storage than barcode
technologies [16]. This technology can offer a lot of purpose
thanks to the developments in wireless and mobile
technologies [17]. A QR code can contain various data
encoded into it, which makes it a great key that can be scanned
and acquire data from [18]. In the paper of Liew and Tan [19],
a QR code-based attendance system was proposed to prevent
attendance cheating. Primarily, QR scanners are now a
popular feature of smartphones which can make a system
implementing it simple and affordable [20]. Utilizing it in
attendance systems can also lead to a faster process of
checking the attendance, especially in a large classroom,
where the teacher can use the saved time to focus on teaching
[21].
B. Attendance Management Fig. 1. Conceptual Framework of the study
The first step in creating successful schools is encouraging
students and making sure they consistently attend school [22]. B. Respondents
Recent years show that there have been significant changes in A software evaluation was conducted to assess the
the way that student attendance is managed and tracked in functionalities of the system. It involved 140 participants from
schools. As more classes have moved to a hybrid or digital Cavite State University – Don Severino de las Alas Campus,
model, the methods of tracking attendance have also evolved consisting of 10 IT/CS specialists and 130 non-technical users.
[23]. According to Classter [24], regular attendance benefits Software Requirements.
the academic performance of the students as well as their
personal and emotional growth, enhancing their sense of The system was mainly built and developed using React
belonging to their classmates and communities. JS, Express JS and MySQL. React was used to create
dynamic front-end components of an application. Express JS
C. Automated Attendance Management Systems
on the other hand is a popular JavaScript library for building
According to Khan [25], manual and traditional attendance web applications and APIs built on top of Node.js, which is a
systems can be used in manipulation of data or the act of JavaScript runtime environment built on Chrome's V8
altering data in order to achieve a desired outcome. As JavaScript engine. MySQL was used to store, manage,
described by BasuMallick [26], an attendance management manipulate, and retrieve data for the application. This enables
system is any tool that aids in keeping track of time spent at
the system to efficiently store and retrieve large amounts of
work or school. According to Kandra [27] an automated
data, while also providing us with the ability to query and
attendance management system can help improve attendance
by incentivizing rather than penalizing students. Bellana [28] manipulate the data as needed. For the SMS notification,
stated that a top-notch attendance management system, Twilio was used to facilitate the sending of messages.
regardless of the hardware utilized must have the following C. Hardware Requirements
necessary features. Among these features are clock in and
clock out tracker that properly documents, record the time, The system aims to provide an inexpensive and secure
location of entry, and identity or code used to identify the user identification system. This includes integration of QR
ID. scanner for system process. Fig. 2 shows the scanner that was
used. It uses CCD optical imaging scanning technology that
III. METHODOLOGY is researched and developed independently that can identify
This section presents different factors, technology, and screen code, incomplete code, and fuzzy code. Along with the
materials in the development of the system. The data QR scanner, it will be connected to a system unit running the
gathering technique, design, and the system architecture are system.
shown and discussed.
A. Conceptual Framework
Different methods, processes, and requirements to develop
the system are listed in Fig. 1. It includes different inputs,
processes, and output components. The input section includes
different knowledge, software, and hardware requirements.
Process refers to methods and techniques used to employ and
produce the desired output. These methods include planning, Fig. 2. . QR Scanner – Logicowl MP6200

Authorized licensed use limited to: Zhejiang University. Downloaded on December 17,2024 at 06:58:41 UTC from IEEE Xplore. Restrictions apply.
D. System Architecture IV. SYSTEM IMPLEMENTATION
This section presents the architectural framework of the In this section, the screenshot from the system is shown
system. The conceptual model that the proponents have along with the evaluation result from the respondents.
developed represents how each module is interconnected
with the others. The modules were created to match the A. Screenshot from the Prototype
overall functionality and key features of the system. The The landing page for the system is shown in Fig. 4. It
following duties are accomplished by the four modules, displays the login page where the user can enter to use the
which consist of an account management module, record functionalities of the system. This page serves as the entry
management module, notification module, and QR module. point for the users to access the different functionalities of the
The administrator will first access the account management system.
module, which oversees user authentication. Upon successful
account authentication, the system dashboard will be
presented to the user which enables and gives total system
control and access to other different modules. The record
management module, this module is divided into two major
system processes namely the student record management
which is in charge of managing data records of students. The
administrator has the capability to add, change, delete, and
view student data. The other process is attendance record
management which handles and supervises managing the
attendance records of the students, including adding,
updating, deleting, and viewing records. This module also
relies on the QR Code scanning process under the QR module
to add attendance records automatically. The next module
will be the notification module, that is responsible for sending
Fig. 4. Log in interface
message notifications to the family of students during the
identification process, as shown in Fig. 3. This module also
The administrator account can easily access the different
handles the system notifications by invoking alerts that will
interfaces of the system. One of which is student records
display details, status, and results of certain system processes.
interface showing different actions that can be performed
And lastly, the QR module, the key module of the system that
(Fig.5). It displays the lists of currently registered students in
handles the QR code generation processes. This module
the system. Viewing a student account can be performed and
performs SHA-256 implementation on certain student
adding students either manually or in bulk add using the
information before it generates corresponding QR codes to
Upload CSV feature.
ensure that the data of students are protected and secured
when scanned by other scanning devices outside the system.
This module is also mostly where the attendance system is
automated. This module utilizes a QR scanner, that adds
records to the attendance of students as well as triggers the
SMS module, notifying the family of students. The system is
a web-based application that aims to identify students
entering and exiting an educational institution using QR
codes. On successful scanning process, the application
records the time of entry and exit of the authorized students.
It will send an SMS notification to the phone number of their
guardians containing necessary status information.

Fig. 5. Student records, and management interface

In the QR module, the main purpose of generating a code

is performed using sensitive information that is hashed to
increase privacy and security. The QR code shown in Fig. 6
is an example of a hashed code. The code can then be used to
record the attendance by being scanned by an external
scanner. An SMS will be sent after the QR is scanned
containing the student information and the time the
interaction was recorded.

Fig. 3. System Architecture of the study

Authorized licensed use limited to: Zhejiang University. Downloaded on December 17,2024 at 06:58:41 UTC from IEEE Xplore. Restrictions apply.
Fig. 6. QR Generator functionality interface under QR Module Fig. 9. Account and API management interface of the system

When a valid QR code is scanned in the system, it will B. Evaluation Result

automatically check the data of the code and subsequently The evaluation form used was aligned on the ISO 25010
show the information of a student. Fig.7 shows an example standard. The software was evaluated based on various
of a QR code scanned using the system. Various information criteria, including functional suitability, performance
about the student can be found. efficiency, compatibility, reliability, usability,
maintainability, and portability. Non-technical evaluators
mainly consist of students from different courses and
departments, security personnel and guardians. The technical
evaluators included 6 professors from the College of
Engineering and Information Technology (CEIT), 1 IT
Support specialist, 2 backend developers, and 1 full stack
developer. The rating scale used five (5) as the highest score
and one (1) as the lowest score for each assessment. Based on
the evaluation results shown in Table I, the application
received an excellent rating across all software criteria. The
average system evaluation score was 4.89 for non-technical
users and 4.55 for technical users. The standard deviation for
each criterion is also shown in the table below.

TABLE I. SUMMARY OF THE RESULTS OF THE EVALUATION

Fig. 7. QR Scan interface of the system as part of the QR Module
Standard
Indicators Mean Interpretation
The administrator along with the staff with proper Deviation
privileges can easily view and create reports regarding the Functional Suitability 4.76 0.44 Excellent
attendance of the students. Fig. 8 shows the interface where Performance Efficiency 4.66 0.51 Excellent
records regarding the event of scanning a QR code in the
Compatibility 4.45 0.75 Excellent
system is saved.
Usability 4.75 0.47 Excellent

Reliability 4.70 0.52 Excellent

Security 4.79 0.43 Excellent

V. CONCLUSION
The aim of the paper was to establish a secure method of
student identification and automation of attendance. The
system incorporates key features such as a secure hashing
algorithm, record management, automation of records, and
integration of SMS message notifications, ensuring a
comprehensive and secure identification process for students.
Fig. 8. Attendance records, and management interface Moreover, the findings of the study demonstrate that
combining SHA-256 and QR identification forms a strong
To configure the access level and scope of the accounts, solution to enhance the security of student identification
Fig.9 shows the interface where it is performed. systems. By leveraging the SHA-256 algorithm, the
Configuration for the gateways used in the system is also proponents ensure the integrity and authenticity of the data
included in this interface. stored within the QR codes. This cryptographic hash function
provides a high level of security, making it exceedingly
challenging for unauthorized individuals to tamper with or
forge the information contained in the QR codes. Furthermore,

Authorized licensed use limited to: Zhejiang University. Downloaded on December 17,2024 at 06:58:41 UTC from IEEE Xplore. Restrictions apply.
using QR codes and scanners offers several advantages over [12] N. I. of S. and Technology, “Secure Hash Standard (SHS),”
other identification methods. QR codes are cost-effective to csrc.nist.gov, Aug. 04, 2015.
https://csrc.nist.gov/publications/detail/fips/180/4/final
produce and can be easily printed on various mediums, such
[13] P. Callaghan, “Why You Should Use SHA-256 in Evidence
as ID cards or smartphones. Scanners, which are widely Authentication,” blog.pagefreezer.com.
available and affordable, can quickly read and decode the https://blog.pagefreezer.com/sha-256-benefitsevidence-authentication
information stored in QR codes. This eliminates the need for [14] V. Papaspirou et al., “A Novel Authentication Method That Combines
expensive biometric devices or RFID systems, making the Honeytokens and Google Authenticator,” Information, vol. 14, no. 7,
implementation of the proponents' solution financially p. 386, Jul. 2023, doi: https://doi.org/10.3390/info14070386.
feasible for different universities, schools, and interested [15] E. Gregersen, “QR Code | barcode,” Encyclopedia Britannica, Feb. 23,
organizations. 2022. https://www.britannica.com/technology/QR-Code
[16] S. V. Sai Harsith Reddy et al., “Design of QR Based Smart Student
ACKNOWLEDGMENT Attendance System,” IEEE Xplore, Feb. 01, 2023.
https://ieeexplore.ieee.org/abstract/document/10044175 (accessed Jul.
The authors would like to thank Cavite State University 27, 2023).
for the opportunity to conduct the study. Special thanks to [17] M Mallegowda et al., “Fake Product Identification System Using
Department of Science and Technology- Science Education Blockchain,” Dec. 2022, doi:
Institute (DOST-SEI) for supporting one of the authors in https://doi.org/10.1109/i4c57141.2022.10057923
pursuit of their degree. [18] J. D. Ebin et al., “Utilizing QR Codes for Smart and Low-cost Student
Attendance Acquisition and Monitoring System in Eastern Visayas
REFERENCES State University, Philippines,” IEEE Xplore, Dec. 01, 2022.
https://ieeexplore.ieee.org/abstract/document/10109484 (accessed Jun.
[1] G. Eason, B. Noble, and I. N. Sneddon, “On certain integrals of 01, 2023).
Lipschitz-Hankel type involving products of Bessel functions,” Phil.
[19] K. J. Liew and T. H. Tan, “QR Code-Based Student Attendance
Trans. Roy. Soc. London, vol. A247, pp. 529–551, April 1955.
System,” 2021 2nd Asia Conference on Computers and
(references)
Communications (ACCC), Sep. 2021, doi:
[2] G. Ramanan, P. Gandhi, L. Dsouza, and Kailas Devadkar, “Smart https://doi.org/10.1109/accc54619.2021.00009.
Attendance Management System Using Encrypted QR Codes and Load
[20] Aishwarya Varadannanavar, A. Nair, A. Kumar, Panimozhi K, and
Balancing,” Dec. 2022, doi:
Antara Roy Choudhury, “Automatic Attendance System Using
https://doi.org/10.1109/icast55766.2022.10039574.
Biometric Authentication and Varying QR Code,” Dec. 2022, doi:
[3] S. Prasad, M. P, R. Adhyapak, A. N. Pai, V. Gadad, and S. Rajendran, https://doi.org/10.1109/icac3n56670.2022.10074099.
“Design and development of information management system using
[21] A. Nuhi, A. Memeti, F. Imeri, and B. Cico, “Smart Attendance System
QR code based technique,” IEEE Xplore, Jan. 01, 2023.
using QR Code,” IEEE Xplore, Jun. 01, 2020.
https://ieeexplore.ieee.org/abstract/document/10091058 (accessed
https://ieeexplore.ieee.org/abstract/document/9134225/references#ref
Aug. 08, 2023).
erences
[4] A. Arun, “Are QR Codes Safe? Best Practices to Ensure QR Code
[22] G. Staff, “Why attendance matters,” Parenting, Aug. 11, 2011.
Security,” learn.g2.com, Apr. 21, 2022. https://learn.g2.com/qr-code-
https://www.greatschools.org/gk/articles/school-attendance-issues/
security
[23] SEAtS, “A Guide to Student Attendance Management,” SEAtS
[5] T. J. C. Piad, “Up to 5M Filipinos claim to be identity theft victims,”
Software, Sep. 05, 2022.
INQUIRER.net, Aug. 25, 2022.
https://www.seatssoftware.com/2022/09/05/a-guide-to-student-
https://business.inquirer.net/358961/up-to-5m-filipinos-claim-to-be-
attendance-management/
identity-theft-victims
[24] Classter, “How a Student Attendance System Can Improve the
[6] M. P. Sy, R. Marasigan Jr., and E. Festijo, “Hyperledger-Operated
Educational Experience for K12 Schools,” Classter, May 20, 2019.
Blockchain Integration: Writing, Deploying and Testing Custom
https://www.classter.com/blog/all-posts/student-attendance-system-
Chaincode,” in 2023 Sixth International Symposium on Computer,
k12-schools/ (accessed Oct. 30, 2023).
Consumer and Control (IS3C), Jun. 2023. doi:
https://doi.org/10.1109/is3c57901.2023.00048. [25] S. Khan, “Manual Attendance System: An Unbiased Knowledgebase,”
hrone.cloud, Jul. 04, 2022. https://hrone.cloud/manual-attendance-
[7] P.-Y. Lin, W.-S. Lan, Y.-H. Chen, and W.-C. Wu, “A Confidential QR
system/
Code Approach with Higher Information Privacy,” Entropy, vol. 24,
no. 2, p. 284, Feb. 2022, doi: https://doi.org/10.3390/e24020284. [26] C. BasuMallick , “10 Key Features of Attendance Management
Systems,” Spiceworks, Mar. 15, 2022.
[8] Q.-A. Kester and H. Blankson, “A Hybrid Data Logging System Using
https://www.spiceworks.com/hr/workforce-
Cryptographic Hash Blocks Based on SHA-256 and MD5 for Water
management/articles/features-of-attendance-management-systems/
Treatment Plant and Distribution Line,” May 2019, doi:
https://doi.org/10.1109/icsiot47925.2019.00009. [27] M. KANDRA, “Advantages of Automated Attendance Management
System,” Kandra.pro, 2022. https://kandra.pro/info/advantages-of-
[9] Avni Rustemi, Vladimir Atanasovski, and Aleksandar Risteski,
automated-attendance-management-system/
“Identification During Verification Of Diplomas In The Blockchain
System,” Jun. 2023, doi: [28] C. Bellana, “Attendance Management System: Everything You Need
https://doi.org/10.1109/iwssip58668.2023.10180241. to Know – GoSchooler,” GoSchooler, Jul. 13, 2021.
https://goschooler.com/attendance-management-system/
[10] N-able, “SHA-256 Algorithm,” N-able, Sep. 12, 2019. https://www.n-
able.com/blog/sha-256-encryption
[11] “Chapter 6 -- Information Security, from Safeguarding Your
Technology, NCES Publication 98-297 (National Center for Education
Statistics),” nces.ed.gov.
https://nces.ed.gov/pubs98/safetech/chapter6.asp

Authorized licensed use limited to: Zhejiang University. Downloaded on December 17,2024 at 06:58:41 UTC from IEEE Xplore. Restrictions apply.