Service-Based Authentication via Channel Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current mobile device authentication methods, such as GSM and UMTS AKA, are vulnerable to attacks like man-in-the-middle attacks, where malware can misuse authentication information to gain network access, causing damage to the victim.
Innovation Solution
A service-based authentication method that identifies the communication channel through which authentication requests are received and securely inserts this information into the authentication response, using a service interface module to prevent misuse by ensuring the network can distinguish between legitimate and malicious access attempts.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional AKA authentication is used, then network access is provided, but the system is vulnerable to man-in-the-middle attacks and malware misuse
Solution Approach 1:
The patent introduces a service interface module as an intermediary component between the AKA module and the communication interfaces. This module intercepts authentication requests, identifies the communication channel, and modifies authentication responses to include channel-specific information. The intermediary prevents direct interaction between malware and authentication mechanisms, thereby blocking man-in-the-middle attacks while maintaining legitimate network access.
Solution Approach 2:
The service interface module performs preliminary identification of the communication channel before authentication occurs. By determining which communication interface (e.g., cellular, Bluetooth, WiFi) the authentication request arrived through, the system can pre-modify the authentication response to include channel-specific identifiers. This preliminary action ensures that authentication information is bound to the legitimate communication path before the authentication exchange completes, preventing replay attacks through unauthorized channels.
2Ease of operation
If authentication information is transmitted without channel identification, then communication is simple, but malware can detect and modify the communication channel
Solution Approach 1:
The patent modifies the authentication response parameters by embedding communication channel identifiers within the authentication information. The service interface module changes the authentication response structure to include channel-specific data that the network can verify. This parameter change makes it computationally difficult for malware to detect and modify the communication channel without detection, as any alteration would invalidate the channel-specific authentication information.
3Productivity
If the network cannot distinguish communication channels, then authentication processing is fast, but malware can misuse authentication information from different channels
Solution Approach 1:
The patent segments the authentication process by introducing channel identification as a distinct step. The service interface module separates channel identification from the core AKA authentication logic, allowing the network to process channel information in parallel with authentication verification. This segmentation maintains processing speed by not adding sequential overhead, while simultaneously improving reliability by ensuring authentication information is validated against the correct communication channel.
Data Source
Figure 1
Figure 2(a)~2(b)
Figure 3
AI summary
A method and a system for service-based authentication of a terminal to a network is described, wherein the terminal comprises a number of communications interfaces, each communications interface allowing the terminal to set-up a predetermined communication channel with the network. The method comprises the steps of: sending a service request for access to a network service; receiving in response to the service request an authentication request from the network; identifying the communication channel through which the authentication request was received; and, sending an authentication response RES to the network, wherein the authentication response depends on the identified communication channel.