Secure Element Authentication via Omitted Signature Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current authentication methods for secure elements in communication devices, such as SIM cards, are cumbersome and ineffective when used in scenarios where the connection is not via a mobile communication network, particularly for operator-based billing and M2M services, as they fail to reliably identify the subscriber's MSISDN number.
Innovation Solution
A method utilizing a second server entity to conduct authentication and identification by generating a signature using a secure element's private key, where the signing message content includes omitted information accessible only to the network operator, allowing verification and subsequent retrieval of the MSISDN number for authentication purposes.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional authentication methods (OTP, username/password) are used, then authentication can be performed, but the process becomes cumbersome for users and fails to reliably identify the subscriber's MSISDN number when connected via non-mobile networks
Solution Approach 1:
The patent introduces a secure element (SIM card) as an intermediary that stores cryptographic keys and generates digital signatures. This secure element acts as a mediator between the communication device and the server entity, enabling automatic authentication without requiring user interaction with OTP or password inputs, thus improving both reliability of MSISDN identification and ease of operation
Solution Approach 2:
The patent replaces the mechanical/manual authentication system (OTP entry, password typing) with an automated cryptographic system. The secure element automatically generates digital signatures using private keys stored in the SIM card, and the server verifies these signatures using public keys, eliminating the need for manual user input while ensuring reliable MSISDN identification
2Reliability
If the secure element transmits all signature generation information, then verification can be performed, but security is compromised as sensitive information is exposed during transmission
Solution Approach 1:
The patent extracts only the necessary verification information (public key and signature) from the complete signature generation process. The secure element generates a signature using a private key and additional information, but only transmits the public key and signature to the server, leaving the sensitive additional information securely stored in the secure element where it cannot be accessed or intercepted during transmission
Solution Approach 2:
The patent adds a cryptographic dimension to the authentication process by using public-key cryptography. Instead of transmitting the additional information directly, the system transforms it into a cryptographic signature that can be verified without exposing the original information. This dimensional transformation allows verification while maintaining security
Applied Scientific Principles
This section explains which scientific principles are used to turn an abstract innovation direction into a practical engineering solution.
Function Achieved in This Case
This approach simplifies and secures the authentication process, enabling cost-effective identification of communication devices and subscribers, even when connected via non-mobile networks, by leveraging public-key cryptography and omitting information in the signature generation process to ensure only authorized entities can verify the signature.
Implementation Method 1
the secure element comprises a signed public key and a private key of an algorithm for public-key cryptography
Data Source
Figure 1~2
AI summary
The invention relates to a method for an enhanced authentication and/or an enhanced identification of a secure element located in a communication device, especially associated to a subscriber of a mobile communication network and especially being a user equipment, wherein a communication link is established between the communication device, on the one hand, and a first server entity, on the other hand, wherein the secure element comprises a signed public key and a private key of an algorithm for public-key cryptography, wherein the secure element and/or the communication device is authenticated and/or identified by a second server entity, wherein the method comprises the following steps: -- a first message is transmitted to the secure element in the communication device, -- a second message is transmitted, subsequent to the transmission of the first message, from the secure element to the first server entity, the second message comprising at least the signed public key associated to the secure element and a signature information, the signature information being generated - by using the private key associated to the secure element - from a signing message content, wherein the signing message content comprises at least one information element that is omitted in the second message, -- a third message is transmitted, subsequent to the transmission of the second message, to the second server entity, the third message comprising at least the signed public key associated to the secure element and the signature information, wherein the signing message content including the at least one information element that is omitted in the second message is accessible to or derivable by the second server entity in view of a verification of the signature information contained in the second message for authentication and/or identification purposes.