Mobile Authentication via Media Access Gateway Token
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile communication devices face challenges in securely conducting sensitive transactions, as conventional security methods like usernames and passwords are often reused across accounts, making them vulnerable to cyber threats and fraud, especially when users are hacked on one system and credentials are used to attempt hacking other accounts.
Innovation Solution
A method and system that authenticates mobile communication devices into a radio access network (RAN) and leverages this authentication to obtain a web application access token, which includes a mobile directory number (MDN) and identity, providing a high level of security by ensuring only authorized devices can access web applications, thereby reducing fraud and cybercrime.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If conventional authentication methods (usernames and passwords) are used, then ease of operation is improved, but security is worsened due to credential reuse and vulnerability to hacking
Solution Approach 1:
The patent introduces a Media Access Gateway (MAG) as an intermediary component that sits between the mobile device and the web application server. The MAG intercepts authentication requests, performs independent verification of wireless subscription service accounts using IP addresses allocated during RAN attachment, and mediates the authentication process. This intermediary approach allows the system to use simple token-based authentication while maintaining high security through backend verification against wireless carrier credentials.
2Reliability
If independent verification of wireless subscription service account is implemented, then security is improved, but device complexity is worsened due to additional authentication components
Solution Approach 1:
The MAG serves as a network-side intermediary that handles the complexity of wireless subscription verification without requiring changes to the mobile device itself. The device simply needs to obtain an IP address through normal RAN attachment and present it to the MAG, which then performs the complex verification process against wireless carrier databases. This keeps the device simple while achieving high security through the network intermediary.
Solution Approach 2:
The MAG performs multiple functions: it acts as an authentication server, a database of wireless subscription credentials, a token issuer, and a mediator between different network protocols. By consolidating these multiple functions into a single network component, the system achieves high security without distributing complexity across multiple devices or systems.
3Ease of operation
If web application access tokens are implemented, then ease of operation is improved, but reliability is worsened without independent verification mechanisms
Solution Approach 1:
The system performs preliminary authentication verification through the MAG before the actual web application access is granted. The MAG verifies the mobile device's wireless subscription credentials and IP address binding in advance, then issues a web application access token that is already validated. This preliminary action ensures that the simple token-based authentication that follows is inherently secure, as the token itself carries the verification result of the preliminary check.
Solution Approach 2:
The MAG implements a feedback mechanism where it continuously monitors and verifies the binding between IP addresses and wireless subscription accounts. When a mobile device attaches to the RAN and receives an IP address, the MAG records this binding and uses it to verify subsequent authentication requests. This feedback loop ensures that access tokens are only issued to devices with valid, currently-active wireless subscriptions, maintaining high reliability while keeping the user interface simple.
Data Source
AI summary
A mobile communication device. The device comprises a client application that checks a non-transitory memory of the device for a web application access token corresponding to the client application, determines that the non-transitory memory does not store the web application access token, transmits a web application access token request via a cellular radio transceiver of the device to a Media Access Gateway (MAG), where the web application access token request comprises an identification of an Internet Protocol (IP) address allocated to the device when authenticating into a radio access network (RAN) by the cellular radio transceiver, receives a web application access token from the MAG, stores the web application access token in the non-transitory memory, and sends a request to access a web application comprising the web application access token to a web application server, where the web application server is different from the MAG.