EVENT ATTENDANCE SYSTEM USING

ONE-TIME PASSWORD(OTP)

NURUL FARHANA BINTI BASAR

BACHELOR OF COMPUTER SCIENCE

(NETWORK SECURITY)

UNIVERSITI SULTAN ZAINAL ABIDIN

2018

EVENT ATTENDANCE SYSTEM USING ONE-TIME PASSWORD (OTP)

NURUL FARHANA BINTI BASAR

Bachelor of Computer Science (Network Security)

Faculty of Informatics and Computing

Universiti Sultan Zainal Abidin, Terengganu, Malaysia

MAY 2018

i

DECLARATION

I hereby declare that this report is based on my original work except for quotations and

citations, which have been duly acknowledged. I also declare that it has not been previously

or concurrently submitted for any other degree at Universiti Sultan Zainal Abidin or other

institutions.

________________________________

Name: ..................................................

Date: ..................................................

ii

SUPERVISOR ENDORSEMENT

I have read this project report, and in my opinion, this report fulfils the requirement for

CSB 35102 Academic Project Proposal for Degree of Computer Science (Network Security).

________________________________

Supervisor name: Dr Mohamad Afendee Bin Mohamed

Date: ..................................................

iii

DEDICATION

Assalamualaikum w.b.t, firstly I would like to express my gratitude to Allah the Almighty for

his grace and the Mercy in completing my project.

Then, I would like to thank my supervisor for this Final Year Project, Dr. Mohamad Afendee

Bin Mohamed for being a responsible and supporting lecturer to guide and aid me towards

the accomplishment of this project. Thank you for brainstorming the ideas along the solution

together for me illustrate the main idea and help in understanding my project more.

Next, I would like to appreciate to all member of panels for their valuable feedback and their

comment on improving my project for better purpose especially during my project

presentation. All the comments and feedback help me improve a lot of my presentation skills

and my project progress.

Last but not least, a lot of thanks to my beloved family and friends for never ending support,

encouragement and advice for brightening my spirit to complete this final year project. A

great thanks again for all of those who are involved in my Final Year Project.

iv

ABSTRACT

In universities, there are many events that have been organized to the student. This

event helps the student to improve their knowledge and skill. By attending the event, student

shows that they are not only academically concerned but also curriculum-oriented. Merit is

important to universities students as their point to stay in college. Most of these events are

awarded with merit, so students who are attentive to their merits may attend events held by

universities to improve their merits. Normally, the event attendance is using manual

recording by using a piece of paper and pen. This way is not systematically enough and not

efficient. There are many problems arise when using the manual recording. This manual

recording consumes more time because the attendees need to queue for a long time just to

sign the attendance. Besides, the event organizer also might spend hours checking and

waiting the attendees to sign at the door with a piece of paper or spreadsheet. As an

alternative to overcome the difficulties, Event Attendance System for Students Using

One-Time Password (OTP) is being developed so that there is no use of manual recording.

The event organizer does not need to provide paper and pen to do the manual recording. The

time also will be saved because the students do not need to queue just to sign the attendance.

This proposed system is using One-Time Password (OTP) and also Quick Response (QR)

code. OTP is a password that is valid for only one login session. While QR code is the

trademark for a type of matrix barcode (or two-dimensional barcode) which contains the

information about the item to which it is attached. The attendance system is based on web

system and also mobile application. OTP is being used when student want to register for a

first time. When the students are done doing the registration, they will be given a password or

code that valid only once to connect them to the system. For recording the attendance, this

system implemented QR code. Once the students have scanned the QR code that being

displayed at the event, their attendance will be saved to the database automatically. As a

conclusion, event attendance system for student using OTP will be more efficient, accurate

and systematic than manual recording. This system also will contribute in improving the

event attendance system for students because of having the security element and also the

good authentication technique.

v

No Content Page

0

DECLARATION

SUPERVISOR ENDORSEMENT

DEDICATION

ABSTRACT

TABLE OF CONTENTS

LIST OF FIGURES

LIST OF TABLES

LIST OF ABBREVIATIONS / TERMS /SYMBOLS

i

ii

iii

iv

v-vi

vii

vii

viii

1

CHAPTER 1: INTRODUCTION

1.1 Project Background

1.2 Problem Statement

1.3 Objectives

1.4 Scopes

1.5 Limitation of works

1.6 Expected Result

1

2

2

3-4

4

4

2

CHAPTER 2: LITERATURE REVIEW

2.1 Introduction

2.2 Project and Research

2.3 Summary of Research Paper

5

6-19

19-26

3

CHAPTER 3: METHODOLOGY

3.1 Introduction

3.2 System Requirement and Specification

3.2.1 Hardware

27

28

28

vi

3.2.2 Software

3.3 System Design

3.3.1 Framework Design

3.3.2 Process Model

3.3.3 Data Model

3.4 Algorithms

3.5 Summary

29

30

30-31

32-36

37

38-40

40

4

CHAPTER 4: RESULTS AND DISCUSSION

4.1 Implementation and Output

4.1.1 Deployment / Configuration

4.1.2 Interfaces

4.2 Summary

41

42-45

46

6

REFERENCES

47-48

vii

LIST OF FIGURES

Figure Title Page

3.3.1.1 and 3.3.1.2 Framework Design

30-31

3.3.2.1 Context Diagram (CD)

32-33

3.3.2.2 Data Flow Diagram (DFD) Level 0

33-34

3.3.2.3

Data Flow Diagram (DFD) Level 1

34-36

3.3.3.1 Entity Relationship Diagram (ERD)

37

4.1.1 Event Homepage

41

4.1.2 Admin Login Page

41

4.1.3 Admin Interface (Add Event)

42

4.1.4 Admin Interface (Update Event)

42

4.1.5 Admin Interface (Delete Event)

43

4.1.6 User Interface (View event and participate the event)

43

4.1.7 User Interface (Event Participation Detail)

44

4.1.8 Feedback Interface

44

LIST OF TABLES

TABLE

TITLE PAGE

2.2.7.1 Summary comparison between time-based vs event-

based OTP.

14

2.3.1 Summary of research paper 19-26

3.2.1.1 List of hardware requirement

28

3.2.2.1 List of Software Requirement

29

viii

LIST OF ABBREVIATIONS / TERMS / SYMBOLS

CD

Context Diagram

DFD Data Flow Diagram

ERD Entity Relationship Diagram

FYP Final Year Project

OTP One-Time Password

QR Code Quick Response Code

1

CHAPTER 1

INTRODUCTION

1.1 Project Background

Traditionally, event attendance for students has been tedious, troublesome and slow,

as it uses the manual and traditional way of monitoring the attendance of the students as

regards to the event they will be attending. The attendees need to queue to wait for their turns

in order to check their name and matric number, also their sign using pen and paper as a

proof of their attendance in the event. The queues of students in registration area cause delay

of monitoring the attendance. Manual recording usage is still applicable although they are not

systematic and efficient enough to record the attendance of students in the event. But now,

almost every event attendance system can be modernized. No more use of manual recording

using pen and paper.

Due to the problems that arise, this paper has proposed a system which is Event

Attendance System Using One-Time Password (OTP). It comes with web based system and a

mobile application to record the attendance of students at the event systematically, accurately

and effectively. It implemented security element and algorithm approach which are One -

Time Password (OTP) and Quick Response Code (QR code). The registration is based on

One-Time Password. For recording the attendance, this system implements QR code. This

system acts as platform to monitor and manage the student attendance in the event efficiently

so that the students can be given with merit on every event that they are attended. The merit

also will be easy to calculate with this system. Then, with this application, the student

attendance can be recorded efficiently and easy to monitor.

2

1.2 Problem Statement

The problem that occurs makes this application develop which are:

i. The event attendance for student is taken manually using a pen and a piece of paper

that needed the student to check their name, matric no and do their sign at the right

place as a proof of their attendance in the event.

ii. The use of manual recording consumes more time because the attendees need to

queue for a long time just to sign the attendance. Sometimes, congestion occurs at the

attendance counter.

iii. The students that have been registered might absent and cheating by asking their

friends to sign for them to just get the merit point without attending the event.

Because of this problem, a system and an application may be needed in order to record the

event attendance of the students more accurately without have to record it manually. No more

use of paper and pen. One-time password will be given on each registration that has been

made by the students while QR code will be displaying at the event hall. This system will

record the attendance of the student automatically and saved into the databases when the

students are scanning the QR code using their smartphone. This system saved time, more

efficient and also systematic.

1.3 Objectives

The objective is important to achieve the goal. The main objectives for this project are:

i. To study the feasibility of One-Time Password (OTP) and Quick Response Code

(QR code) technology in Event Attendance System.

ii. To develop the Event Attendance System for Students using One-Time Password

(OTP) and Quick Response Code (QR code).

iii. To evaluate the usability of Event Attendance System using One-Time Password.

3

1.4 SCOPE

1.4.1 Scope of User

This application involves the admin and user.

1. Admin

- Insert, Create, Update and Delete the information of event

- Generate new code to verify and record attendance of the students

- View the details of student that have made the registration

2. End User

- Get up to date about new event and upcoming event that will be held

- Update the attendance to the event

- View the information related to event

- Scan the QR code that is being displayed

1.4.2 System Scope

The scope of system is:

1.4.2.1 User Registration

In the student registration form, the student has to enter phone number. The users only

register once using SMS verification and do not needs to login after complete the verification.

1.4.2.2 Event Management System

Event Management System is a system which manages information of an event.

- This system shows event in the interface.

- Admin is allowed to add new event into the database

- Admin is able to edit event information in the database

- Admin is allowed to delete event information in the database

4

1.4.2.3 College event

The student can able to keep up to date the event management activities while admin can

keep update the new event and manage the college activity and event.

1.4.2.4 Event Attendance

Student can able to scan the QR code as their proof attending the event while Admin can

able to view and display the name of the students attending the event

1.5 Limitation of Work

Every application has their limitations which are:

i. Wi-Fi or Data Connectivity. This application can be access only when there is a Wi-Fi

connection or any data connectivity for performing client server process, OTP and QR

code authentication.

1.6 Expected Result

i. A secure event management application using OTP and QR code.

ii. Provide an easy access for the admin and student involve reaching for the

information about the event.

5

CHAPTER 2

LITERATURE REVIEW

2.1 Introduction

This chapter will discuss and portrays the literature review for the Event Attendance

System for Students Using One-Time Password (OTP) that being developed. Firstly,

we need to understand what literature review is. A literature review is about past

research or recent research or what need to search or seek the truth for the purpose

portraying or illustrate the research problem, solutions and the importance of seeking

a solution. A literature review is not about information gathering. In a given subject or

chosen topic area, the literature review shows in-depth grasp and summarize prior

research that linked to the research subject. Literature review involves the process of

reading journals, articles, book and research paper and later on analyzing, evaluating,

and summarizing scholarly materials about a specific topic. It can be guideline to

develop a new system so that the new system can provide a better and more functional

than the existing systems. The discussions about the new system are done based on

the literature review guidelines.

6

2.2 Project and Research

2.2.1 Event Management System

This paper [1] proposed to maintain the College Event information and organize the event

and to send the Student Registration time through sums with verification code to the student

using mobile application based on Android App. The Application is mainly focused on Event

based service to the company, College network in mobile application. This application also

helps to maintain the users account and its various details. The main advantage of using this

application is it reduces the direct communication to student and avoids the mall function of

the student to event join and participating for android to android where ever it is. The

database design and coding techniques has highly enhanced and optimized. This makes the

application an overall user friendly and easy for naive users. This application being as a

platform to know the events, to apply for the events, and this application automatically

generates Token Number to the students via SMS during the registration of students

including scheduled timings. To understand use of this application, consider the flow of

actions happening, by this application college can register the students, after registering,

college can login, after login, college can post the Technical fest / event details including

name, logo, address, venue of the event, date, event conducting time, cost of events to

participate etc. students who are participating in the event can view details posted by the

colleges. Below is the module description for this project:

Admin Login: In the Admin login form, the administrator has to enter the username

and password to login into the event management system menu form.

Main Menu: In the event management system main menu form, the menus are split

into event details, registration, token details and reports.

Event Details: In the event details form, it includes the event id, event name, event

organizer, and event fee and event contact number.

Student Registration: In the student registration form, the student has to enter the

student name, department, college name, email identification and the phone number.

The student details are allowed to store in the centralized database with an automatic

generated event id.

Token details: In the token details form, once the user enters the event id and clicks

the search button. The submitted query will be processed with the server and the event

name is displayed in the page screen.

7

As mentioned above, the event management system is useful for the students that help the

user to provide information regarding the event that are conducted in college. This project

also proposed a scope for future enhancements which are to add additional functions to

Android application such as improved user interface is deployment on the Android market

and to develop the event management application for the Blackberry OS using principles of

code reuse.

2.2.2 Android Application for Event Management System

This paper [2] discusses android application for event management system. The proposed

system is an application that is designed to manage and handle the events of an organization.

Mobile registration is the next generation of registration that leads attractive way of event

details delivery especially used in an organization. The application provides portability as it is

used on a mobile device and can be carried anywhere. Since the application is used on

android device, it improves connectivity between the participants and the coordinators, thus

the institution will be to provide with more transparent system altogether. Not only does the

connectivity improve, the application also decreases a substantial amount of paperwork that

is otherwise needed for the daily tasks in an institution. It is a useful tool that can be used by

all the members of the institution, anywhere, anytime on an Android mobile device. Since the

mobile device makes all the tasks, there is no paperwork involved and it provides direct

access to the participants and coordinators. Direct access, here, means that the participants

can clarify their event details with the coordinators irrespective of where they are at a given

time. To design proposed project, smart phones with android operating system are chosen

because navigation rate of android OS is 70 percent. It is open source and free ware. The

application is consistent with all Android versions ranging from Gingerbread 2.3 to Lollipop

5.0.1, so that students who cannot afford to buy high end mobiles and institutes located in

remote, rural area can also take the advantage of this application. The projects aim at

designing an event app which could effectively manage the events in an organization. This

application contains the database which has the details of the participants, their name, and the

events they are willing to participate, their registration id, and event details like day, venue,

time, etc. Participants instead of registering in the websites or using paperwork, they can

simply use this mobile application to register.

8

After the comparisons done by the administrator they are provided with the unique id. The

advantage of application is that the existing system has been taken and made portable by

creating an application that can be used on a mobile device, both by participants and

organizers. Convenience is not only the key advantage for portability, it also reduces the

amount of paperwork by a substantial margin. Basically, the main objective of android based

event management system is to obtain the advantages on hand-held devices like mobile

devices which allow accessing the events at anywhere and anytime by the participants. The

application will not only help the participants to obtain notifications from the admin, but it

will also help the organizers by providing a convenient system to communicate with the

participants and inform them about upcoming submissions and events.

2.2.3 UNIVERSITY SEMINARS ATTENDANCE CHECKING SYSTEM USING QR

CODE IMAGE SCANNER

This paper [3] discussed about seminars at universities or at any other organizations that

required having checking attendance list for their participant. From this way, teachers and

students can register their name for specified seminar at the same time that they attend in the

seminar hall. This new technique can be done by using QR Code Image scanner and Mobile

Smart Phone, which scan the displayed QR Code image on the seminars Screen, before

seminars Start. There are many drawbacks when using old system or manual system. One of

these drawbacks that can be seen through using old system is that the attendees must wait till

the sheet list of names reached to their desk. Moreover, in some cases the list of the names

may lose, and all the participants lose their registration process. Another weakness point in

this old technique is that required that sometimes there are not enough spaces for other people

to write put in their names, which means lack of spaces. Also to those problems that face

current registration process there are some other main important issues that face this system:

1. Most of the universities in Kurdistan Region of Iraq (KRG), from example University

of Sulaimani, it is required as an obligation that their teaching staff must attend

seminars for collecting points for their QoS.

2. In some faculties, their QoS center still work with lots of papers and documents. Also,

each teacher that is a member of teaching the community in the faculty must name

which is stored in the QoS Database.

9

3. The number of paper works may exceed more than hundred teachers profile in some

colleges or faculties, and some them of the have more than five departments. Also, in

each department there are lots of teachers.

In the new proposed system, university academic staff must have their mobile smartphones

have been registered into the university's database. Thus, it is required that the information of

each university member staff mobile phone must be stored including MAC Address and

Phone number. All this information will be stored in the central database that contains all the

academic data, for instance, teachers and employee’s personal information. Also, there will

be a QR Code image will be displayed on seminars screen before the seminar starts about 5 to

10 minutes. Moreover, this opportunity will be given due to give sometimes for attendees to

scan the displayed QR code. This process of scanning the QR system can be held through

mobile applications that specified for scanning and decoding the Image. The purpose of doing

image scanning in beginning and the end of seminars is to restrict the attendees to stick to the

seminars to the end of the session. This is because of many attendees leave the seminars just

5-10 minutes of starting seminars, which, in fact, the seminars session will last to 1 hour to

1hour and a half. There are also purposes of quality assurance (QAS) system. This system is

applied to all teachers in the many education organizations. So, it is required from them to

collect points as passive and active. With passive points, they must attend as many seminars

as possible to collect many points. In this research, it has been concluded that the number of

smartphone users is increased in different countries and continents. This is the main reason

that leads developers and research to include most of their software development

smartphones as mobile technologies. The researcher has investigated that using QR Code

scanning through Smartphones for absent checking is valuable. Thus, due to capabilities to

hold and interpret data according the owner of the mobile devices. It means that every teacher

in the university will have their encoded data. So, the researcher reached to a point in

research to restrict to make fraud with seminar attendances and to make the restriction that

attendees must stick to the seminars session time completion. This paper also proposed future

work that will be possible to enlarge this system to cover a wider area of QAS for example,

teachers can check their point on a daily basis or weekly or even monthly. This will help

them to track their lack of points.

10

2.2.4 One-Time Password via SMS

This paper [4] describes a method of implementing two factor authentication using

mobile phones. The proposed system involves using a mobile phone as a software token

for One Time Password generation. SMS-based OTP is one of the most user friendly

multi-factor authentication mechanisms today that does not require an additional device.

One time passwords, or OTP, are used (as the name indicates) for a single session or

transaction. OTP SMS provides a 2 stage security while utilizing Internet Banking. By

using a one-time password that is sent to our mobile phone in addition to our user ID and

static password, you have a high level security. The passwords generated by the OTP

SMS are one time passwords. Meaning that the OTP SMS password we have used for one

of our transactions can't be used for a second time by us or another person. One-time

passwords sent over SMS (text messages) were designed to prevent replay attacks and

add an additional layer of log on security. A unique password or code is sent to the user

via text, and that code must be entered along with a traditional username and password

combination to allow access to a site or authorize a transaction. OTP over SMS is a form

of multi-factor authentication. There are basically three types of one-time passwords. The

first uses a mathematical algorithm to generate a new password based on the previous

password. The second is based on time synchronization between the authentication server

and the user providing the password. The third uses a mathematical algorithm, but the

new password is based on a challenge and a counter. Below is a list of these five different

solutions, which serves as a representative sample of all the different solutions that exist

which are SMS authentication with Session ID verification, One-time password from PC

to SMS, One-time password from SMS to PC, SIM strong authentication via mobile

phone and Software token in the mobile phone. This paper also shows the implementation

issue on how the software generates a one-time password. First the user registers in the

system control panel software that is installed on a server. Then the user by pressing the

request key (on the software installed on mobile embedded) one-time password request is

sent to the server. After a few moments the user request is received by the server and then

it will be checked and user authentication process begins. After approval of the user

identity, the server responds to user requests and the user password requested will code

by encryption algorithms, and it sent to the user. Software installed on the user's phone

has received one-time password and then decode it and show it to the user. And the end,

the user types the password received in own panel. Server processes the user OTP

11

password and in the case the accuracy that allows the user to login to the user’s page. For

conclusion, in this paper, they have presented an application for one-time password

generation and transaction between server and mobile handset. The advantage of this

application compared to the similar software is using of highly complex and non-return

encryption algorithm, which relationship between user and network security is fully

guaranteed and the high flexibility of the software, enabling it to different communication

methods such as SMS and USSD.

2.2.5 Two Factor Authentication Using Smartphone Generated One Time Password

This paper [5] explains a method of how the two factor authentication implemented using

SMS OTP or OTP generated by Smartphone- One Time Password to secure user accounts.

The proposed method guarantees authenticating online banking features are secured also this

method can be useful for e-shopping & ATM machines. The proposed system involves

generating and delivering a One Time Password to mobile phone. Smartphone can be used as

token for creating OTP or OTP can be send to mobile phone in form of SMS. The generated

OTP is valid for only for short period of time and it is generated and verified using Secured

Cryptographic Algorithm. A typical solution is based on giving the user a hardware token

that generates one-time-passwords, i.e. passwords for single session or transaction usage.

Moreover, token also have disadvantages which include the cost of purchasing, issuing, and

managing the tokens or cards. In this paper, we propose a securely generated and verified

OTP using smartphone. Installing third-party applications allows mobile phones to provide

expanded new services other than communication. The use of mobile phone as a software

token will make it easier for the customer to deal with multiple two-factor authentication

systems and will also reduce the cost of manufacturing, distributing and maintaining millions

of hardware tokens. Sometimes OTP is sent to user mobile phone as a SMS with Transaction

details. For system design and implementation, they propose a computer-based software

token. This is supposed to replace existing hardware token devices. The System involves

generation of Secured OTP using Cryptographic algorithm and delivering it to user’s mobile

in the form of SMS or user can able to create his own OTP using smartphone and validating

the OTP using same Cryptographic algorithm. The proposed system is secured and consists

of two parts: (1) the server software, (2) the client software: Client application on PC for

transaction & android application on smartphone for creating OTP. Two factor authentication

12

methods have recently been introduced to meet the needs of organizations for providing

stronger authentication options to its users. The proposed work focuses on the

implementation of two-factor authentication methods using mobile phones. It provides an

overview of the various parts of the system and the capabilities of the system. The proposed

system has two option of running, either using a free and fast connection-less method or a

slightly more expensive SMS based method. This paper also discussed about future

deployments that include a more user friendly GUI, extending the algorithm to work on

various mobile phone platforms. In addition to the use of Bluetooth and WLAN features on

mobile phones for better security and cheaper token generation.

2.2.6 TrustOTP: Transforming Smartphones into Secure One-Time Password (OTP)

Tokens

Nowadays, in this era of technology, there is an increasing number of enterprise employees

who need to remotely access the corporate networks and by the end of 2015, more than 1.3

billion workers worldwide will routinely work beyond the traditional office environment.

Moreover, around the same time, more mobile devices are being widely used to perform

business transactions by mobile workers. But usually, enterprise have traditionally used two-

factor authentication to secure employee’s remote access to corporate resources. Due to this,

OTP is widely adopted by the enterprise in their two-factor authentication solutions. Time-

based OTP (TOTP) and HMAC-based OTP (HOTP) that is event based are the most popular

OTP used. Software-based OTP solutions cannot guarantee the confidentiality of the

generated passwords or even the seed when the mobile OS is compromise. Moreover, they

also suffer from denial-of-service attacks when the mobile OS crashes. In the other hand,

hardware-based OTP token can solve these security problems in the software-based OTP,

however, it is inconvenient for the users to carry physical tokens with them. So in summary,

this paper [6] proposed a new design of secure OTP Tokens using smartphones which

provides the flexibility of the software tokens and hardware tokens. It's also capable of

prevent all type of attacks from the malicious mobile OS and still can continue to display the

OTP even if the mobile crashes. This new design also will provide trusted graphical user

interface that display the OTP on the same screen. This new design is already being

implemented with TrustOTP prototype and the evaluation results show that TrustOTP can

work efficiently using just a small amount of power consumption.

13

2.2.7 Time versus Event Based One-Time Password

In this paper [7], the researcher compares the two main approaches to one-time passwords

(OTP) which are time-based OTP and event-based OTP. Their main conclusion is that they

are very similar from both a security and usability perspective (with each having slight

advantages of a different nature). It is a well-known fact that plain password-based

authentication is highly problematic. Beyond the fact that many users are not aware of the

adversarial threats that exist and therefore engage in insecure behaviour, it is often impossible

for a user to remember all of her passwords. A number of different authentication

mechanisms are used today in order to alleviate this problem. One-time-password

authentication (or OTP) is just one of these mechanisms. In this method, login is performed

using a different, essentially random password each time. The passwords are generated by a

device, most commonly a hardware token associated with the user, and so the password is not

based on the user’s memory. This greatly increases security. Furthermore, by adding a

personal secret PIN or password that the user needs to provide in order to authenticate, strong

two-factor authentication is achieved. There are two main approaches to OTP. In the first

approach, called time-based OTP, the one-time password changes at frequent intervals (say,

every two minutes). In the second approach, called event-based OTP, the one-time password

is generated by pressing a button on the OTP device. The cryptographic mechanism

underlying both approaches is the same. Each one-time password is generated by applying a

random-looking cryptographic function to a unique series value. In the time-based case, the

value is the current time. In the event-based case, the value is a sequence number that is

incremented with each button click. We stress that each device is initialized with a secret key

that makes prediction of the one-time passwords infeasible to an outside attacker. The

researcher also stress that the current time and sequence numbers are not secret and the

security rests on the inability to predict the output of the cryptographic function on the

current number due to the secret key. Lastly, the researcher concludes that both OTP

approaches greatly enhance security beyond password-based authentication. From both a

security and usability perspective, time-based and event-based OTP mechanisms have

distinct relative advantages and ultimately we regard them as being equally effective. Below

is the summary of comparison between time-based versus event-based OTP.

14

Table 2.2.7.1 Summary comparison between time-based vs event-based OTP.

Security Convenience

Time-based OTP Pro: OTP values are valid for a

short period of time

Con: OTP values can be

obtained easily by a by-stander

Pro: The OTP value can be simply

read off the screen

Con: The OTP value may change

while it is being entered

Event-based OTP Pro: An attacker would need

undetected physical access to the

device

Con: An OTP value is valid

until a new OTP value is used

Pro: The OTP value is generated at

the user’s request; no value change

after a short amount of time

Con: The user must press a button

to generate the OTP value

2.2.8 Development of the online student attendance monitoring system (SAMS™) based

on QR-codes and mobile devices

This paper [8] thus outlines the development of an online student attendance monitoring

system (named (𝑆𝐴𝑀𝑆𝑇𝑀)) based on QR codes and mobile devices. This design was chosen

due to its simplicity and cost-effectiveness. The only equipment required by the user

(lecturers and students) is a mobile internet device such as a tablet computer or a smartphone.

This paper describes the overall architecture as well as the flow of its implementation in the

class room. The method of surveying the effectiveness and user feedback of the system is

also discussed. The main advantage of the system is a more accurate and quicker method of

recording and monitoring student attendance. With this system, it will be quantitatively easier

to discern the students based on their diligence in attending classes, and thus also predict their

performance due to the correlation between attendance and academic performance. The

researcher propose a QR-code based system, in combination with mobile devices to display

and scan the QR-codes. This thus removes the need for any additional hardware, noting that

in Malaysia there is high ownership of mobile internet-capable devices, especially in the form

of smart-phones as well as high mobile internet usage, with an increasing aerial coverage and

penetration over time. This paper also discussed the early anecdotal and response to this plan

as well as initial performance tests and comparison with other systems. For the design of the

15

online Student Attendance Monitoring System (𝑆𝐴𝑀𝑆𝑇𝑀), the researcher utilizes two

technologies widely used at present, namely the Internet-enabled mobile devices and QR

codes. Student interaction with the system is through a unique QR code that is reserved for

each student. A QR code (quick response code) is basically a two dimensional bar code. The

QR codes that are generated for each student can be displayed using a smartphone or printed if

the student does not have a smart phone. When students attend classes, the code will be

scanned by lecturers using mobile devices such as smartphones and tablets. The scanned QR

codes will directly interact with the web-based (𝑆𝐴𝑀𝑆𝑇𝑀) system and record the student

attendance. The Student Attendance Monitoring System (𝑆𝐴𝑀𝑆𝑇𝑀) itself consists of two

main components the (𝑆𝐴𝑀𝑆𝑇𝑀) server and the (𝑆𝐴𝑀𝑆𝑇𝑀) app. Access to the system is via

a user name and corresponding password. This is for security and also enables access for

different categories of users to the online system, for example a lecturer or system

administrator. The main page also offers a hint if a user forgets the user name or password.

After the student information has been updated, a unique QR code can be generated for each

student. The QR code is sent via email. Once all students have received their QR codes, it can

thus be used to record their attendance. The (𝑆𝐴𝑀𝑆𝑇𝑀) app is a dedicated software

application intended for better integration of QR code scanning with the (𝑆𝐴𝑀𝑆𝑇𝑀) systems

as a whole. An initial performance test has been performed by measuring the response time of

scanning QR codes on commercial mobile devices over various networks. The tests were

performed using a Ninetology Black Pearl II smartphone over Wi-Fi and HSDPA as well as

using a Samsung Galaxy Note II device over 4G LTE. The response time depends on many

factors such as the screen size (larger screens may take longer), mobile device processing

speed, network speed, camera speed and user handling. In conclusion, with this system, the

technology that is presently widely used can be utilised so that students can benefit more

from lessons by their presence without burdening the instructors.

2.2.9 A Students Attendance System Using QR code

This paper [9] proposes a system that is based on a QR code, which is being displayed for

students during or at the beginning of each lecture. The students will need to scan the code in

order to confirm their attendance. The paper explains the high level implementation details of

the proposed system. It also discusses how the system verifies student identity to eliminate

16

false registrations. With the widespread of smartphones among university students, this paper

addresses the problem of such a waste in the lecture time and proposes a system that offers to

reduce it. The proposed solution offers a QR code for the students to scan it via a specific

smartphone application. The code along with the student identity taken by the application will

confirm the students’ attendance. This way, the system will save not only time but also

efforts that were supposed to be put by instructors during each lecture. It will speed up the

process of taking attendance and leave much time for the lecture to be given properly. The

proposed system also takes care of preventing unauthorized attendance registration using

multi-factor authentication. The proposed system lies between online learning and traditional

learning as a facilitation for the attendance record-keeping process, in a way that enriches the

lecture time so that it can better be utilized in giving useful materials rather than wasting the

time taking attendance. The system requires a simple login process by the class instructor

through its Server Module to generate an encrypted QR code with specific information.

During the class, or at its beginning, the instructor displays an encrypted QR code to the

students. The students can then scan the displayed QR code using the system Mobile Module,

provided to them through the smartphone market by the university. Along with the student’s

facial image captured by the mobile application at the time of the scan, the Mobile Module

will then communicate the information collected to the Server Module to confirm attendance.

The whole process should take less than a minute for any student as well as for the whole

class to complete their attendance confirmation. Smartphones may communicate with the

server via either the local Wi-Fi coverage offered by the institution or through the internet.

the system is composed of two modules which are the Server and the Mobile Modules. The

Server Module performs the following tasks which mediates students’ attendance requests

with the eLearning system, generates a QR code for the instructor, runs Identity check and

runs Location check. The Mobile Module is the part that students usually install on their

smart phones. The proposed system will need three steps from each student. These steps are

opening the application, capturing the face, and scanning the QR code. The system uses

multi-factor authentication to authenticate students. As conclusion, the researchers have

proposed a way to automate this process using the students’ devices rather than the

instructor’s device. The proposed system allows fraud detection based on the GPS locations

as well as the facial images taken for each student.

17

2.2.10 Android Application for Event Management and Information Propagation

This paper [10] intends to solve the problems of propagating news and information, and also

alleviate the problem of traditional event managing procedures such as lots of paper work, or

long queue at the registration desk. The objective of this project is to develop an android

application which provides interesting news and events. Moreover, users will be able to

manage their event participation, such as reserving their seats in events, registering at the

event site, and so on. More importantly, this application uses QR code to provide an easy

way to verify participants’ identity in an event. This application focuses on solving problems

of event registration and management by using QR code, and also providing news,

information of events, and project ideas which are the given senior project topics for

university students. First of all, users will be able to reserve and manage their event

participation via this application, also receive the QR code to participate in each event after

reservation. Additionally, this application provides significant information and news of many

interesting events from the event provider. In conclusion, this application will help the event

providers by using QR code in verification. Moreover, it will provide significant information

of each event and project topics to users to be able to reach from anywhere, any time. This

application system consists of two main components which are front-end system and back-

end system. The Front-end System is the information displaying section which queries the

data from the remote database and also able to send data to be stored in the database.

Moreover, the staff side front-end system will send the participant information to the server

to verify their identity. The Back-end System is the database management section which

always interacts with the front-end system. Additionally, it will send the required data to

the front-end system whenever the request is sent. This application consists of six main

modules which are Authentication System, Member Management System, News

Management System, Event Management System, Project Ideas Management System, and

Administrator Management System. As conclusion, this application will provide significant

information of events in order to be easily reached by users and will be able to manage their

event participation. Additionally, this application can be used from everywhere, anytime.

More importantly, integrating QR code will provide more convenience to handle events

because it able to complete authentication in one scan.

18

2.2.11 QR code based secure OTP distribution scheme for authentication in

Net-Banking

In this paper [11], the researcher is presenting a new authentication scheme for secure OTP

distribution in net banking through QR codes and email. One Time Passwords (OTP) is

passwords which are valid only for a session to validate the user within

a specified amount of time. Hence for each session the user will be validated using new OTP.

They are also helpful in preventing replay attacks, phishing attacks and other attacks on basic

static passwords. QR codes are used to store textual information in the form of images that

can be read by any smart device including most mobile phones. QR codes can be considered

as two-dimensional bar codes. System consists of a web service that will generate alpha-

numerical OTPs using pseudo-random numbers and current timestamp. Use of timestamp

further assures security and uniqueness of OTP. The alpha-numerical password string is then

encrypted using Advanced Encryption Standard (AES). The key for the algorithm will be

ATM pin of the user since it is unique for every user and can be obtained by Bank Server in

every login session through account number. The AES algorithm is used here since not only

it provides higher security but also it improves performance in such critical systems. The

encrypted string is then converted to QR image by the Bank Server. It is then sent to the

concerned user using email as transmission medium via SMTP. User then downloads the QR

code image and uploads it in standard application that is made available to him by net-

banking provider. The application provides space for QR image to be uploaded and user then

enters his ATM pin which is used to decrypt the string read from QR code. The validation of

the pin is carried out by sending request to the bank server. If the ATM pin is entered

correctly, application displays the OTP that was generated for the session. User then enters

the OTP for net-banking and completes authentication. Then any type of transaction can be

carried out online on the service provider website. Proposed scheme has higher degree of

complexity than all existing systems and clearly the time required to crack the scheme will be

more than the useful lifetime of OTPs. OTPs are generated for a session

and have a short lifetime. It’s not possible to use the OTP after their expiry. Popularity of QR

codes makes the method user friendly. the proposed system satisfies the high security

requirements of the online users and protects them against various security attacks. Also the

system does not require any technical pre-requisite and this makes it very user-friendly.

Hence, QR code proves to be versatile at the same time beneficial for both the customers in

terms of security and vendors in terms of increasing their efficiency.

19

2.2.12 Online Banking Authentication System using Mobile-OTP with QR code

In this paper [12], the researcher proposes a new Online Banking Authentication system. This

authentication system used Mobile OTP with the combination of QR-code which is a variant

of the 2D barcode. The researcher propose Online Banking Authentication System use

Mobile OTP, one of the OTP generate device which has same security as the existing OTP

and with the convenience of mobile features, and the used of semi-permanent. This reduction

in acquisition costs as well as easy to download the brother deployment, if the introduction of

financial. In addition, user does not require a separate cost except for the initial download

costs.

2.3 Summary of the Research paper

Table 2.3.1 Summary of research paper

Author Title Description Advantage Disadvantage

M.Mahalakshmi

, S.Gomathi and

S.Krithika

(2016)

Event

Management

System

The main idea of this

project is used to

maintain the College

Event information and

organize the event.

To send the Student

Registration time

through sums with

verification code to

the student using

mobile application

based on Android

App.

It reduces the direct

communication to

student

Avoid the mall

function of the student

to event join and

participating for

android to android

where ever it is.

Need internet

connection for

some

applications

20

R Deepika1, R

Gayathri2, T

Saravanakumar3

, K

Vigneshwaran4,

K Vignesh5,

(2016)

Android

Application for

Event

Management

System

-The proposed system

is an application that

is designed to manage

and handle the events

of an organization.

-The projects aim at

designing an event

app which could

effectively manage the

events in an

organization.

-the main objective is

to obtain the

advantages on hand-

held devices like

mobile devices which

allow accessing the

events at anywhere

and anytime by the

participants.

-The existing system

has been taken and

made portable by

creating an application

that can be used on a

mobile device,

both by participants

and organizers.

-The application will

help the participants to

obtain notifications

from the admin.

-It will also help the

organizers by

providing a

convenient system to

communicate with the

participants and

inform them about

upcoming submissions

and events.

-It reduces the amount

of paperwork by a

substantial margin.

-

21

Miran Hikmat

Mohammed,

Baban, (2015)

University

Seminars

Attendance

Checking System

Using

QR Code Image

Scanner

In the new proposed

system, teachers and

students can register

their name for

specified seminar at

the same time that

they attend in the

seminar hall.

-This new technique

can be done by using

QR Code Image

scanner and Mobile

Smart Phone, which

Scan the displayed QR

Code image on the

seminars Screen,

before seminars Start.

-using QR Code

scanning through

Smartphones for

absent checking is

valuable.

-Thus, due to

capabilities to hold

and interpret data

according the owner

of the mobile devices.

-Teachers

cannot check

their point on a

daily basis or

weekly or even

monthly.

-They cannot

track their lack

of points.

Mohsen

Gerami-Satar

Ghiasvand

(2016)

One-Time

Passwords via

SMS

-This paper describes

a method of

implementing two

factor authentication

using mobile phones.

-The proposed system

involves using a

mobile phone as a

software token for

One Time Password

generation.

-Have a high level

security

-Prevent replay

attacks and

add an additional layer

of log on security.

-Use of highly

complex and

non-return encryption

algorithm

The shorter the

OTP message,

the easier it is

to be hacked.

22

Sagar Acharya1,

Apoorva

Polawar2,

P.Y.Pawar3,

(2013)

Two Factor

Authentication

Using

Smartphone

Generated One

Time Password

-This paper explains a

method of how the

two factor

authentication

implemented using

SMS OTP or OTP

generated by

Smartphone- One

Time Password to

secure user accounts. -

-The proposed method

guarantees

authenticating online

banking features are

secured

-The proposed system

involves generating

and delivering a One

Time Password to

mobile phone.

Smartphone can be

used as token for

creating OTP or OTP

can be send to mobile

phone in form of

SMS.

-The generated OTP is

valid for only for short

period of time and it is

generated and verified

using Secured

Cryptographic

Algorithm.

-The use of mobile

phone as a software

token will make it

easier for the customer

to deal with multiple

two-factor

authentication systems

-Reduce the cost of

manufacturing,

distributing and

maintaining millions

of hardware tokens.

-They have to

install OTP

generation

software in all

clients mobile,

the time in

both mobile

and server has

to be always

synchronized,

if client

purchase a new

mobile, the

mobile have to

be registered

and installed

with the OTP

generation

software,

updated

software have

to re-installed

in all client

mobile.

23

He Sun1,2,3, Kun

Sun1, Yuewu

Wang2, and

Jiwu Jing2,

(2015)

TrustOTP:

Transforming

Smartphones into

Secure

One-Time

Password Tokens

-In this paper, the

researcher present

TrustOTP, a secure

one-time password

solution that can

achieve both the

flexibility of software

tokens and the

security of hardware

tokens by using ARM

TrustZone technology.

- They provide a

trusted graphical user

interface that displays

the OTP on the same

screen shared with the

Rich OS.

- They implement a

TrustOTP prototype

and the evaluation

results show that

TrustOTP can work

efficiently with small

power consumption.

-Can prevent all types

of attacks from the

malicious mobile OS

and continue to

display the OTP even

if the mobile OS

crashes. -It is flexible

to support various

OTP algorithms and

multiple OTP

instances on one

smartphone.

-It requires no changes

of the mobile OS and

has

small impacts on the

mobile OS's

performance.

-when the

mobile

operating

system is

compromised,

it cannot

guarantee the

confidentiality

of the

generated

OTPs or even

the seeds.

24

A. A. ABD.

RAHNI11,2,*, N.

ZAINAL1,2, M.

F. ZAINAL

ADNA1, N. E.

OTHMAN3, M.

F. BUKHORI1,2,

(2015)

Development of

The Online

Student

Attendance

Monitoring

System(𝑆𝐴𝑀𝑆𝑇𝑀)

Based on QR-

Codes and Mobile

Devices.

-They propose a QR-

code based system, in

combination with

mobile devices to

display and scan the

QR-codes. This thus

removes the need for

any additional

hardware.

-This design was

chosen due to its

simplicity and cost-

effectiveness.

The main advantage

of the system is a

more accurate and

quicker method of

recording and

monitoring

student attendance.

-With this system, it

will be quantitatively

easier to discern

the students based on

their diligence in

attending classes.

-

Fadi Masalha,

Nael Hirzallah,

(2014)

A Students

Attendance

System Using QR

Code

-This paper proposes a

system that is based

on a QR code, which

is being displayed for

students during or at

the beginning of each

lecture.

-The students will

need to scan the code

in order to confirm

their attendance.

- The proposed system

allows fraud detection

based on the GPS

locations as well as

the facial images

taken for each student.

-The system will save

not only time but also

efforts that were

supposed to be put by

instructors during

each lecture.

-It will speed up the

process of taking

attendance and leave

much time for the

lecture to be given

properly.

-

25

Phanuphong

Hathaiwichian,

Lapas

Siriwittayacharo

en

Apinat

Wongwachirawa

nich, and

Chaiyong

Ragkhitwetsagul

(2014)

Android

Application for

Event

Management and

Information

Propagation

-This project

alleviates theproblem

of traditional event

managing procedures

such as lots of

paper work, or long

queue at the

registration desk.

-The objective is to

develop an android

application which

provides interesting

news and events.

-This application uses

QR code to provide an

easyway to verify

participants’ identity

in an event.

-This application can

be used from

everywhere, anytime.

-information of events

in order to be

easily reached by

users and will be able

to manage their event

participation.

-

Abhas

Tandon1,Rahul

Sharma2,

Sankalp

Sodhiya3,P.M.D

urai Raj

Vincent4 ,

(2013)

QR Code based

secure OTP

distribution

scheme for

Authentication in

Net-Banking.

In this paper, the

researcher is

presenting a new

authentication scheme

for secure OTP

distribution in net

banking through QR

codes and email.

-The system does not

require any technical

pre-requisite and this

makes it very user-

friendly.

- QR code proves to

be versatile at the

same time beneficial

for both the customers

in terms of security

and vendors’ in

terms of increasing

their efficiency.

OTPs are

generated for a

session

and have a

short lifetime.

It’s not

possible to use

the OTP after

their expiry.

26

Young Sil Lee*,

Nack Hyun

Kim**, Hyotaek

Lim***,

HeungKuk

Jo***, Hoon Jae

Lee*** (2015)

Online Banking

Authentication

System

using Mobile-

OTP with QR-

code

In this paper, they

propose a new Online

Banking

Authentication

system.

This authentication

system used Mobile

OTP with the

combination of QR-

code which is a

variant of the 2D

barcode.

One of the

OTP generate device

which has same

security as the existing

OTP. This reduce in

acquisition costs

Barcode is fast, easy,

accurate and

automatic data

collection method.

Barcode

enables products to be

tracked efficiently and

accurately at

speeds net possible

using manual data

entry system.

-

27

CHAPTER 3

METHODOLOGY

3.1 Introduction

In this chapter, it will clearly define the flow of application with the methodology being used

in this project. The methodology is the description in the thesis to achieve the object which is

describing the way doing or the design for carrying out research of the development of a

procedure. Methodology is used to ensure the systematic process of developing the project

and perform theoretical analysis of the methods applied to a field of studies. The

methodology also must be able to solve all the problems arising in the system analysis to

ensure that this project is complete and able to work well. For this project, waterfall

methodology has been chosen. The phases of waterfall model are requirement analysis,

system design, implementation, testing, deployment and maintenance. In requirement

analysis, all possible requirements of the system to be developed are captured in this phase

and documented in a requirement specification doc. For system design, the requirement

specifications from first phase are studied in this phase and system design is prepared.

System design helps in specifying hardware and system requirements and also helps in

defining overall system architecture. It involves the Context Diagram (CD), Data Flow Data

(DFD) and Entity Relationship Diagram (ERD). The next phase is implementation. With

inputs from system design, the system is first developed in small programs called units,

which are integrated in the next phase. Each unit is developed and tested for its functionality

which is referred to as Unit Testing. Then, testing phase is occurring. All the units developed

in the implementation phase are integrated into a system after testing of each unit. Post

integration the entire system is tested for any faults and failures. After testing is done, the

system is being deployed. Last is maintenance to measure the effectiveness of the system.

28

3.2 System Requirement and Specification

System requirement is needed to achieve this project and assist the development of the

project that involves system requirement in hardware and software. All of these elements are

important in the process of development of this project. List of hardware and software are

shown as below:

3.2.1 Hardware Requirement

Table 3.2.1.1 below shows the list of hardware that are used in this project. Five types of

hardware are needed upon completing the application.

Table 3.2.1.1: List of hardware requirement

No Hardware Type

1 Laptop model Acer-Aspire E5-476G

2 Processor Intel® Core™ i5-8250U CPU @ 1.60Ghz 1.80Ghz

3 Memory 4.00 GB

4 Hard Disk 1.00 TB

5 Operating System version Windows 10/64-bit

29

3.2.2 Software Requirement

Table 3.2.2.1 shows the software that are used in this project development. Ten software are

used in order to build the application.

Table 3.2.2.1: List of software requirement

Num. Software Purpose

1. XAMPP Server Local server to run and test application

2. PhpMyAdmin Database for the application

3. Android Studio IDE Android platform, design for Android

development

4. Notepad++ Cross-platform source code editor

5. QR Code Generator QR Code platform

6. Firebase One-Time-Password platform

7. Java JDK For developing Java application and applets

8. Google Chrome To download other requirements

9. Lucidchart.com and edraw To create CD, DFD, ERD

10. Microsoft Powerpoint 2016 To present the proposal

30

3.3 Framework Design of Event Attendance System Using One Time Password(OTP)

Figure 3.3.1.1: One Time Password (User Registration)

For this project, One Time Password is being used as user registration. Firstly, user must

enter country code and also phone number. Server will save the registered phone number.

Then, the database will do mobile phone number lookup. Once the database has found the

mobile phone number, it will tell the server that the mobile phone number is exist. Next,

server will send One-Time Password to the mobile phone in the form of SMS. After the

mobile phone has received the One-Time Password, user will enter the OTP to verify the user

registration. For more details about how One-Time-Password (OTP) works with Android will be

explain in the algorithm section.

Step 1: Enter country

code and phone number

31

Figure 3.3.1.2: QR Code Data Flow (Attendance recording)

After the user has registered, the user can access the event system and apps easily.They can

view which event is available, the information of event that they want to participate and many

more. When they go to some events, attendance will be taken based on scanning of QR code

that is displayed at the event . In this project, the attendance recording is based on QR Code

scanning. Figure 3.5.1.2 shows QR code algorithm for attendance recording. Database will

send random number to web system to generate QR code. Student will scan the QR code that

contain random number. Then, the mobile application will get IMEI number and random

number from scanning of QR code. IMEI (International Mobile Equipment Identity) is a

unique number to identify GSM, WCDMA, and iDEN mobile phones, as well as some

satellite phones. Next, mobile application will send the IMEI number and random number to

the server. After that, server will check either IMEI number exist or not. If exist, server will

check random number as well. Then, java session is created. Lastly, server will tell the

mobile application that authentication is okay and attendance will be record and save in the

database.

32

3.3.2 Process Model

3.3.2.1 Context Diagram

Figure 3.3.2.1 Context Diagram

As shown in figure 3.3.2.1, there is two entity involved which are admin and user. The admin

and user must register and login into the application.

For admin, after admin register into the application, admin must login with admin profile into

the application. If the login session success, all of the information that admin key in will be

save in the database. Password that admin use (static password) will be a “unique key” or ID

for the admin. After that, admin will be free to create any event, update and delete any

information.

As for user, user will register into the application by using country code and phone number

by using method called One-Time Password(OTP). After that, user will be given a six digits

code as a ticket to enter into the application or event that have been created by the admin. The

six digits’ code will be sent via message. User will only have one-time login session as the

application using One-Time Password (OTP) for the user. Apart from that, user can view all

of the information that admin updated into the application.

For user, there is user attendance. The user attendance is based on the QR code that will be

scan by user at the event that they are attending. The attendance wil be saved in the database.

33

This application also have feedback section that is provided for admin to check the event

feedback info. User will give feedback and only admin can view the feedback info.

3.3.2.2 Data Flow Diagram Level 0

Figure 3.3.2.2 Data Flow Diagram (DFD Level 0)

Data Flow Diagram (DFD) is a graphical representation of the flow data through an

information system. It shows how a system’s environmental entities, processes, and data are

interconnected and also the data is stored in the databases. It also shows what kind of

information will be input to and output from the system, where the data will come from and

go to and where the data will be stored. Figure 3.4.2.1 above shows the DFD that consist of

two entities and four processes. The two entities are admin and user while the other four

processes are register and log in, user attendance, create and update event, event information,

and event feedback.

34

The first process that is manage admin will involve admin. Admin to register and login into

the application. After admin register, admin profile will be save and the admin information

will be store in the login data store for admin. Second process will be the user attendance.

Only user will involve at this process as the user is the only one that need to scan QR code to

record their attendance when participating an event. After user has scan the QR code, all the

attendance database will be stored in the data store for authentication. Third process will be

managing event. Only admin will involve at this process as the admin is the only one that can

create and update the information. After admin already created the event, all the databases

about that event will be stored in the data store for event. The next process is about the event

information. At this point, only user will be involving to view the event information details.

All the event details will be retrieve from the database event that is already been stored. The

last process is all about the event feedback. Both entities that is admin and user will be

involve at this phase. User will be the one that comment about the event management and the

comment will be stored in the data store named feedback. Admin can view all the comments

by retrieving the data from the feedback data store.

3.3.2.3 Data Flow Diagram Level 1

i. Manage Admin

Figure 3.3.2.3.1 Add and Update Admin

Manage Admin account allows admin to add profile and update profile.

35

ii. Manage Attendance

Figure 3.3.2.3.2 Verify Code and Count Attendance of user

Manage attendance allows user to input code and verify attendance

iii. Manage Event

Figure 3.3.2.3.3 Add, Update and Delete Event

Manage Event allows admin to add info, update info and delete info about event.

36

iv. Manage Feedback

Figure 3.3.2.3.4 Add and Update Feedback

Manage Feedback allows user to add feedback and update feedback.

37

3.3.3 Entity Relationship Diagram

Figure 3.3.3.1 ERD model for Event Attendance System Using One Time Password(OTP)

contains five entities and have their attributes.

38

3.5 Algorithm

3.5.1 One-Time Password Algorithm

For this project, the algorithm used for user registration is One-Time Password. One Time

Password is a password that is valid for only one login session or transaction. OTP can be

send to a mobile phone in the form of SMS. The types of the algorithm used are Time –Based

One Time Password. The server side has synchronized clock which is will synchronize with

client’s OTP clocks. In time-based OTP, each OTP value is only valid for a short amount of

time. Furthermore, only a single one-time password appears on the screen at any one time

and so it is not possible to obtain future OTP values. In this project, user need to input

country and mobile number and One Time Password Server will generate One Time

Password code. In order to record the user registration, every user will generate random code

for authentication. Admin will monitor over the system from server side. The server will

generate one random code and authenticate the user registration. This approach provides

security element in preventing replay attacks, eavesdropping and any sensitive information

being stolen by the third party.

3.5.1 QR Code Algorithm

For this project, the algorithm used for recording user attendance is QR Code Algorithm. A

QR Code is a special type of barcode that can encode information like numbers, letters and

Kanji characters. There are seven steps in QR Code encoding process which are data analysis,

data encoding, error correction coding, structure final message, module placement in matrix,

data masking and format and version information.

A QR Code encodes a string of text. There are four modes for encoding text in QR code

which are numeric, alphanumeric, byte and Kanji. Each mode encodes the text as a string of

bits (1s and 0s), but each mode uses different method for converting the text into bits. While

UTF-8 can encode Kanji characters, it must use three or four bytes to do so. Shift JIS, on the

other hand, uses just two bytes to encode each Kanji character, so Kanji mode compresses

Kanji characters more efficiently. If the entire input string consists of characters in the

double-byte range of Shift JIS, use Kanji mode. It is also possible to use multiple modes

within the same QR code.

39

The next step is data encoding. In data encoding, there are four steps. First, choose the error

correction level. Second, determine the smallest version for the data. Third, add the mode

indicator and fourth, add the character count indicator. To choose the error correction level,

QR codes uses Reed Solomon error correction. This process creates error correction

codewords (bytes) based on the encoded data. A QR code reader can use these error

correction bytes to determine if it did not read the data correctly, and the error correction

codewords can be used to correct those errors. There are four levels of error correction: L

(recovers 7% of data), M (recovers 15% of data), Q (recovers 25% of data) and H (recovers

30% of data). Then, count the number of characters to be encoded to determine which is the

smallest version that can contain the number of characters for encoding mode and desired

error correction level. Then, we can add mode indicator which each encoding has a four-bit

mode indicator that identifies it. Next, add the character count indicator. The character count

indicator is a string of bits that represents the number of characters that are being encoded.

The character count indicator must be placed after the mode indicator. Furthermore, the

character count indicator must be a certain number of bits long, depending on the QR version.

The third step is error correction coding. As mentioned earlier, QR codes uses error

correction. This means that after create the string of data bits that represent the text, then use

those bits to generate error correction codewords using a process called Reed-Solomon error

correction. QR scanners read both the data codewords and the error correction codewords. By

comparing the two, the scanner can determine if it read the data correctly, and it can correct

errors if it did not read the data correctly.

The fourth step is structure final message. The data and error correction codewords generated

in the previous steps must now be arranged in the proper order. For large QR codes, the data

and error correction codewords are generated in blocks, and these blocks must be interleaved

according to the QR code specification.

The fifth step is module placement in matrix. After generating the data codewords and error

correction codewords and arranging them in the correct order, the bits must be place in the

QR code matrix. The codewords are arranged in the matrix in a specific way. During this

40

step, the patterns that are common to all QR codes will be place, such as the boxes on the

three corners.

The sixth step is data masking. Certain patterns in the QR code matrix can make it difficult

for QR code scanners to correctly read the code. To counteract this, the QR code

specification defines eight mask patterns, each of which alters the QR code according to a

particular pattern. We must determine which of these mask patterns results in the QR code

with the fewest undesirable traits. This is done by evaluating each masked matrix based on

four penalty rules. The final QR code must use the mask pattern that resulted in the lowest

penalty score.

The last step is format and version information. The final step is to add format and (if

necessary) version information to the QR code by adding pixels in particular areas of the

code that were left blank in previous steps. The format pixels identify the error correction

level and mask pattern being used in this QR code. The version pixels encode the size of the

QR matrix and are only used in larger QR codes.

3.6 Summary

In this chapter, the methodology chosen is Waterfall Model which is suitable for my project.

System requirement includes hardware and software which are needed and fulfils the project

requirement. Android studios as a platform to develop an application. Java Language is the

universal language used in this project. System Design is fundamental in building the project

to more clear about the system. This project accompanied by documentation for each

requirement, which enables to review it for validation. To show the flow of the project and

the process of this project, context diagram, data flow diagram, entity relationship diagram is

shown in order to illustrate a better understanding about this project. Furthermore, this

chapter also stress out the algorithm or method used that will be applied on this project.

41

CHAPTER 4

4.1 Introduction Implementation and Output

The implementation process is must need a method to carry out, execute the project after the

system design. The system being implemented into a real prototype or integrate software

based service for the end-user. After implementation, the system testing is executed to test the

whole system for the functionality and credibility of the system being developed. In this

process, the algorithm or technique being applied along with the development of the

application. This chapter discusses the implementation, deployment, and result of the entire

application after being developed.

4.1.1 Deployment and Configuration

In this stage, the deployment takes place on deploy the system requirements to enable

development of this project. The hardware requirement being setup and testing either it

suitable and compatible with the project requirement. This project deployment uses hybrid

mobile application that are built in a similar manner as websites. Both uses a combination of

technologies like HTML, CSS and JavaScript. In this project, Apache Cordova is used

because most hybrid mobile applications leverage Apache Cordova a platform that provides a

consistent set of JavaScript APIs to access device capabilities through plug-ins, which are

built with native code. The process deployment of XAMPP as a local host also used which

has Apache web server, PHPMyAdmin, and MySQL that need to configure and deploy to

develop an application. All the process conducted involving software and hardware

requirement based on system design to ensure all meet the expectation.

42

4.1.2 Interfaces

Figure 4.1.2.1 Homepage

Figure 4.1.2.2 Admin Login Page

43

Figure 4.1.2.3 Admin Interface (Add Event)

Figure 4.1.2.4 Admin Interface (Update Event)

44

Figure 4.1.2.5 Admin Interface (Delete Event)

Figure 4.1.2.6 User Interface (View event and participate the event)

45

Figure 4.1.2.7 User Interface (Event Participation Detail)

Figure 4.1.2.8 Feedback Interface

46

4.2 Summary

In this chapter whereby the implementation takes places. Implementation stage is where

process turn in system design into a prototype.

REFERENCES

[1] M.Mahalakshmi, S.Gomathi and S.Krithika, “Event Management System” International

Journal of Trend in Research and Development, Volume 3(2), ISSN: 2394-9333, March-

April 2016.

[2] R Deepika, R Gayathri, T Saravanakumar, K Vigneshwaran, K Vignesh, “Android

Application for Event Management System” International Conference on Systems, Science,

Control, Communication, Engineering and Technology 2016 [ICSSCCET 2016], February

2016.

[3] Miran Hikmat Mohammed, Baban, “UNIVERSITY SEMINARS ATTENDANCE

CHECKING SYSTEM USING QR CODE IMAGE SCANNER” International Journal of

Advance Research, IJOAR .org Volume 3, Issue 8, August 2015, Online: ISSN 2320-9194

[4] Mohsen Gerami, Satar Ghiasvand, “One-Time Passwords via SMS” Bulletin de la

Société Royale des Sciences de Liège, Vol.: 85, 2016, p. 106 – 113

[5] Sagar Acharya, Apoorva Polawar, P.Y.Pawar, “Two Factor Authentication Using

Smartphone Generated One Time Password” IOSR Journal of Computer Engineering (IOSR-

JCE) e-ISSN: 2278-0661, p- ISSN: 2278-8727Volume 11, Issue 2 (May. - Jun. 2013), PP 85-

90.

[6] He Sun, Kun Sun, Yuewu Wang, and Jiwu Jing, “trustOTP: Transforming Smartphones

into Secure One-Time Password Tokens”, 2015.

47

[7] Andrew Y. Lindell, “Time versus Event Based One-Time Passwords” Aladdin

Knowledge Systems, 2007.

[8] A. A. ABD. RAHNI, N. ZAINAL, M. F. ZAINAL ADNA, N. E. OTHMAN, M. F.

BUKHORI, “DEVELOPMENT OF THE ONLINE STUDENT ATTENDANCE

MONITORING SYSTEM (𝑆𝐴𝑀𝑆𝑇𝑀) BASED ON QR-CODES AND MOBILE DEVICES”

Journal of Engineering Science and Technology Special Issue on UKM Teaching and

Learning Congress 2013, June (2015) 28 – 40

[9] Fadi Masalha, Nael Hirzallah, “A Students Attendance System Using QR Code”

(IJACSA) International Journal of Advanced Computer Science and Applications, Vol. 5,

No. 3, 2014

[10] Phanuphong Hathaiwichian, Lapas Siriwittayacharoen Apinat Wongwachirawanich,

and Chaiyong Ragkhitwetsagul, “Android Application for Event Management and

Information Propagation” The 2014 Third ICT International Student Project Conference

(ICT-ISPC2014).

[11] Abhas Tandon, Rahul Sharma, Sankalp Sodhiya, P.M.Durai Raj Vincent, “QR Code

based secure OTP distribution scheme for Authentication in Net-Banking” International

Journal of Engineering and Technology (IJET), ISSN : 0975-4024, Vol 5 No 3 Jun-Jul 2013.

[12] Young Sil Lee*, Nack Hyun Kim**, Hyotaek Lim***, HeungKuk Jo***, Hoon Jae

Lee***, “Online Banking Authentication System using Mobile-OTP with QR-code”, 2015.