Carrier ID Verification for Application Security

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

In wireless communications networks, existing security measures fail to prevent unauthorized access to privileged functionality by applications intended for different carriers, leading to unintended installation and execution of applications on mobile devices.

Innovation Solution

A method that authenticates an application's signature against a root certificate and compares the first carrier identification associated with the application to the second carrier identification of the network node, granting privileged access only if they match, thereby ensuring that applications are installed and executed only on intended devices.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Adaptability or versatility

If carrier-specific applications are distributed across multiple carriers' networks, then application availability increases, but security control deteriorates because applications can be installed on unintended devices from different carriers

Engineering Contradiction:

Improveapplication availabilityVSAvoidsecurity control

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The protection domain is segmented to include both a root certificate identifier and a carrier identification. This segmentation allows the system to verify both the cryptographic signature (root certificate) and the carrier-specific authorization (carrier ID), thereby maintaining security control while enabling distribution across multiple carriers' networks.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The carrier identification is embedded in the protection domain during the application signing process, before distribution. This preliminary action ensures that carrier-specific authorization information is already present in the application package, enabling automatic verification at installation time without requiring additional runtime authentication steps.

Inventive Principle:

Principle #10Preliminary action

2Device complexity

If root certificates are shared across multiple carriers, then trust establishment becomes simpler, but access control precision deteriorates because applications can access privileged functionality on unintended carriers' devices

Engineering Contradiction:

Improvetrust establishment complexityVSAvoidaccess control precision

Core Design Contradiction:

Device complexityVSMeasurement precision

Solution Approach 1:

The trust establishment process is segmented into two independent verification steps: first verifying the root certificate signature for cryptographic trust, and second verifying the carrier identification for access control precision. This segmentation allows both simplicity in trust establishment and precision in access control to coexist.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The carrier identification acts as an intermediary element between the root certificate verification and the final access decision. It bridges the gap between general cryptographic trust and specific carrier-based access control, enabling precise authorization while maintaining the simplicity of root certificate-based trust establishment.

Inventive Principle:

Principle #24Intermediary (Mediator)

3Productivity

If applications are granted privileged functionality based solely on root certificate verification, then authentication speed increases, but unauthorized access risk increases because applications from different carriers can be installed

Engineering Contradiction:

Improveauthentication speedVSAvoidunauthorized access risk

Core Design Contradiction:

ProductivityVSObject-affected harmful factors

Solution Approach 1:

The carrier identification verification is performed as a preliminary check during the application installation process, before granting privileged functionality. This preliminary action prevents unauthorized access by verifying carrier authorization in advance, while the overall authentication process remains fast because the verification data is already embedded in the application package.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The application package carries its own carrier identification information embedded in the protection domain, enabling self-verification during installation. This self-service approach eliminates the need for complex runtime authentication mechanisms, maintaining authentication speed while preventing unauthorized access through built-in carrier authorization verification.

Inventive Principle:

Principle #25Self-service

Data Source

PatentUS9313214B2Enhanced security using service provider authentication

Publication Date: 2016.04.12 NOKIA TECHNOLOGIES OY

AI summary

A method (100) and an apparatus (e.g., a network node (210)) for providing enhanced security using service provider authentication. In addition to authenticating an application signature (245) against a root certificate (235) stored on the network node (210), a first carrier identification (250) associated with the application (240) is compared to a second carrier identification (255). If the first and second carrier identifications match, then the application can be assigned to a trusted protection domain and granted permissions which provide privileged access to the network node. For example, the application can be granted permission to be installed and/or executed on the network node. Otherwise the application can be denied privileged access. Accordingly, a carrier's applications will be only installed onto network nodes that are intended recipients of the applications.