Restricted Access Enrollment for Secure Service Gateway Switching
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for securing access to mobile network services, such as prepaid subscriptions, lack sufficient security measures, allowing unauthorized access without proper verification.
Innovation Solution
A device is configured in a restricted operation mode to initially access only a first server, which verifies user identity features. Upon validation, the device replaces its connectivity identifier to access a second server managing the desired service, ensuring secure access only after successful identity verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a device is configured in restricted operation mode to initially access only a first server for identity verification, then security of service access is improved, but device complexity and operation steps increase
Solution Approach 1:
The access process is segmented into two distinct phases: restricted operation mode for identity verification and normal operation mode for service access. The device is divided into different operational states with specific access permissions for each, ensuring security while maintaining simplicity through clear phase separation.
Solution Approach 2:
The device performs identity verification in advance through restricted operation mode before granting full service access. This preliminary action ensures that security checks are completed beforehand, allowing the device to transition to normal operation mode with confidence that authentication has been verified.
2Reliability
If user identity verification is mandatory before service access, then unauthorized access is prevented, but access time and process duration increase
Solution Approach 1:
Identity verification is performed as a preliminary action in restricted operation mode before the user requests service. Once verification is complete, the device transitions to normal operation mode where service access can proceed without repeated verification delays, reducing overall access time while maintaining security.
Solution Approach 2:
The device dynamically transitions between restricted and normal operation modes based on verification status. This dynamic state change allows the system to enforce security requirements only when necessary (during initial access), then efficiently serve authenticated users without continuous verification overhead.
3Adaptability or versatility
If the device stores a second identifier for the second connectivity gateway after deactivating restricted mode, then adaptability to different services is improved, but security control mechanisms become more complex
Solution Approach 1:
Identifier management is segmented by operation mode: the first identifier (connectivity gateway) is used exclusively in restricted mode for verification, while the second identifier is used in normal mode for service access. This segmentation prevents confusion between verification and service identifiers, maintaining simplicity despite multiple identifiers.
Solution Approach 2:
The connectivity gateway acts as an intermediary that manages the transition between identifiers. It receives the device identifier during verification, validates it, and facilitates the transition to using the second identifier for service access, simplifying the overall identifier management process through centralized gateway control.
Data Source
Figure 1~2
AI summary
The invention relates to a method (20) for securing an access to at least one service. According to the invention, a device (14) is set in a restricted operation mode. The restricted operation mode allows addressing only a first server (182). The restricted operation mode is associated with a first identifier relating to a first connectivity gateway (162). The first connectivity gateway allows accessing the first server. The device accesses the first identifier relating to the first connectivity gateway. The device accesses a subscription profile. The subscription profile is active during the restricted operation mode. The first server receives from the device or a chip (12) a request (26) for enrolling a device or chip user. The request for enrolling the device or chip user comprises or is accompanied with at least one feature relating to a user identity, as a user identity feature. The chip is embedded within or coupled to the device. The first server or another server connected to the first server verifies (28) whether the at least one user identity feature is or is not valid. Only if the at least one user identity feature is valid, the first server or another server connected to the first server sends to the device or, through the device, to the chip a command message (214) including a command for deactivating the restricted operation mode. The device or the chip deactivates (216) the restricted operation mode while storing or letting store, instead of the first identifier relating to the first connectivity gateway, a second identifier relating to a second connectivity gateway (164). The second identifier relating to the second connectivity gateway allows accessing a second server (184). The subscription profile is still active after the restricted operation mode deactivation. The second server manages the at least one service. The invention also relates to corresponding device and system.