Mobile Message Sender Verification Using Signed Headers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing SMS messaging systems lack effective methods to verify the authenticity of message senders, particularly in enterprise communications, making them vulnerable to spoofing attacks that deceive recipients into revealing confidential information.
Innovation Solution
A cloud messaging service generates a public/private key pair to sign a message header, using the private key to create a digital signature that is verified by the subscriber device's Trusted Execution Environment (TEE) to authenticate the sender, and employs a key provisioning method to establish a secure communication channel.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If SMS messaging is sent through SS7 protocol without verification, then message transmission is simple and fast, but the system is vulnerable to spoofing attacks and sender authenticity cannot be verified
Solution Approach 1:
The system performs preliminary key provisioning and registration before actual messaging. The cloud messaging service generates key pairs and registers public keys with the SMS gateway in advance, so that when messages are sent, the verification infrastructure is already in place without adding complexity to the messaging flow itself
Solution Approach 2:
The patent introduces a cloud messaging service as an intermediary between the SMS gateway and subscriber devices. This intermediary handles the complex cryptographic operations (key generation, digital signing of sender IDs, verification) centrally, so that individual components (gateway, devices) don't need to implement complex verification logic themselves
2Reliability
If digital signature verification is implemented using TEE, then message authenticity is verified securely, but the key provisioning and verification process becomes more complex
Solution Approach 1:
The Trusted Execution Environment on the subscriber device performs self-verification of digital signatures locally using stored public keys. The TEE autonomously verifies the authenticity of incoming messages without requiring manual intervention or complex external verification processes, simplifying the operational complexity despite enhanced security
Solution Approach 2:
Public keys are provisioned to the TEE in advance during device initialization or registration. This preliminary setup allows the TEE to perform rapid local verification of digital signatures without needing to fetch or process complex cryptographic data during actual message reception, reducing operational complexity
Data Source
AI summary
This invention is a system and method for verifying a sender of messages on a mobile network. Software on a cloud messaging service generates a public/private key pair. The private key is securely retained in a cloud wallet service and is accessible to a messaging cloud service (the trusted sender). The public key is shared with a subscriber device that receives messages from the messaging cloud service. The cloud messaging service receives an inbound message for the subscriber device from a trusted enterprise application via a secure connection. The cloud messaging service signs a special header to the message with its private key. When the message is received by the subscriber device, the public key resident on the device verifies the message header signed with the public key of the cloud messaging service thereby verifying the sender.