Wireless Mobile Device SIM Challenge Modification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing challenge/response authentication schemes in wireless mobile devices are vulnerable to third-party authentication, as third parties can store challenge/response pairs to gain unauthorized access by repeatedly using the same challenge.
Innovation Solution
A wireless mobile device generates a second portion of the challenge internally and combines it with an externally received first portion to produce a complete challenge, ensuring each response is unique and secure, preventing third-party misuse by dynamically changing the second portion.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the wireless mobile device uses a fixed challenge length from the network, then the authentication process is simple and compatible with existing systems, but the challenge can be stored and reused by third parties for unauthorized authentication
Solution Approach 1:
The challenge is divided into two portions: a first portion received from the network and a second portion generated internally by the device. This segmentation allows the device to contribute its own random elements while maintaining compatibility with existing network infrastructure that expects fixed-length challenges.
Solution Approach 2:
The second portion of the challenge is dynamically generated internally by the wireless mobile device using its own random number generator. This dynamic element ensures that even if the same first portion is sent by the network, the complete challenge will be different each time, preventing replay attacks.
2Reliability
If the device generates a complete challenge internally, then authentication security is maximized, but compatibility with existing network authentication units may be compromised
Solution Approach 1:
The challenge generation is segmented into external (network-provided) and internal (device-generated) portions. This allows the system to maintain compatibility with existing network authentication units that provide challenges while adding internal security enhancements.
Solution Approach 2:
The first portion of the challenge from the network acts as an intermediary that bridges compatibility with existing systems, while the second internally generated portion adds security. The combination of both portions achieves both compatibility and enhanced security.
3Productivity
If the same challenge is reused for multiple authentication attempts, then the authentication process is efficient and fast, but the challenge/response pairs can be stored and misused by third parties
Solution Approach 1:
The second portion of the challenge is dynamically regenerated for each authentication attempt using the device's internal random number generator. This ensures that challenges cannot be reused or replayed, maintaining security while allowing efficient authentication processing.
Solution Approach 2:
The challenge parameters are changed by incorporating internally generated random elements. This transforms the static challenge into a dynamic one that changes with each authentication attempt, preventing storage and reuse attacks while maintaining authentication efficiency.
Data Source
AI summary
A wireless mobile device (104) provides challenge/response based authentication by receiving a first portion of a challenge (132) from an external authentication unit (102), such as a network unit, and utilizes an internal partial challenge generator (114) that internally provides a second portion of the challenge (138) and provides the internally generated second portion of the challenge (138) back to the authentication unit (102). The wireless mobile device (104) also includes combiner logic (116) that combines the externally received first portion of the challenge (132) with the internally produced second portion of the challenge (138) to produce a complete challenge (144). The wireless mobile device (104) then utilizes a response generators (118) that takes the complete challenge (144) that was produced and generates a response (146) based on the complete challenge (144), and other secret information (110) if desired using a suitable cryptographic operation. The response (146) is sent back to the authentication unit (102) for verification.