PKI SIM Secure Messaging for SIM Swap-Resistant OTP Delivery
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure messaging systems, particularly those using SMS for one-time passwords (OTPs), are vulnerable to attacks such as SIM swap attacks and unauthorized access, lacking robust authentication mechanisms, and are not adequately protected against interception and theft of sensitive information.
Innovation Solution
Implementing a system and method that utilizes public key infrastructure (PKI) enabled SIM cards to encrypt and authenticate messages, converting OTPs into Class 2 SMS, and using asymmetric key cryptography, digital signatures, and X.509 certificates to ensure secure communication between users and service providers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If SMS is used for transmitting OTPs and sensitive information, then ease of operation and accessibility are improved, but security and protection against unauthorized access deteriorate
Solution Approach 1:
The patent introduces Class 2 SMS as an intermediary mechanism between the traditional SMS system and the application layer. Class 2 SMS acts as a mediator that provides authentication and authorization services, allowing the system to maintain the simplicity of SMS-based communication while adding security features through network-based authentication mechanisms.
Solution Approach 2:
The patent replaces the mechanical/plain text SMS transmission system with a cryptographic encryption system. By using asymmetric key cryptography and digital signatures, the system substitutes the vulnerable plain text transmission with secure encrypted communication, thereby improving security while maintaining the SMS delivery mechanism.
2Ease of manufacture
If plain text SMS is used for OTP transmission, then ease of manufacture and implementation are improved, but data confidentiality and protection against interception deteriorate
Solution Approach 1:
The patent replaces the plain text SMS transmission mechanism with an encryption-based system. By substituting the simple text transmission with cryptographic encryption using asymmetric keys and digital signatures, the system maintains implementation simplicity while achieving secure data transmission and preventing information loss through interception.
Solution Approach 2:
The patent changes the parameter of data transmission from plain text to encrypted form. By transforming the transmission parameter from unencrypted to encrypted, the system maintains compatibility with existing SMS infrastructure while improving data confidentiality and preventing unauthorized access to OTPs and sensitive information.
3Device complexity
If traditional SMS authentication is used, then device complexity and system requirements are reduced, but protection against SIM swap attacks and unauthorized access deteriorates
Solution Approach 1:
The patent introduces network-based authentication as an intermediary layer between the user's device and the service provider. This intermediary authentication mechanism provides protection against SIM swap attacks without requiring complex device modifications, as the authentication occurs at the network level using established telecommunication infrastructure.
Solution Approach 2:
The patent leverages the universal SMS infrastructure and Class 2 SMS capabilities to provide multiple security functions including authentication, authorization, and data encryption. By using the existing universal telecommunication network, the system achieves robust protection against unauthorized access without increasing device complexity or requiring specialized hardware.
Data Source
AI summary
The present disclosure provides an effective solution to an entity or an organization by enabling an end-to-end system or method of delivering secure messages. The system provides a unique way of securely delivering messages or information to a user only after proper user authentication. Hence, security attacks in mobile communication are avoided (such as SIM swapping and the like). Additionally, the system and method of secure messaging is mobile phone operating system (OS) agnostic.