SIM Card Challenge-Response Application Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
There is a need for technology that enables the execution of a software application on a mobile station while preventing its execution or binary copy on another mobile station, addressing the vulnerability of prior art to jail-break attacks and ensuring secure execution.
Innovation Solution
The solution involves using the GSM security protocols, specifically the A8+A3 module in the SIM card, to verify the presence of a specific SIM, generating challenge-response pairs, and processing them through a verification server to secure the application's execution, making it dependent on the SIM's secrets and resistant to unauthorized execution.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If application protection facilities relying on OS privileges are used, then application security is improved, but the system becomes vulnerable to jail-break attacks that compromise kernel level privileges
Solution Approach 1:
The patent introduces an intermediary verification layer between the application and the SIM card. Instead of directly relying on OS privileges, the application communicates through a verified interface that checks SIM presence and authenticity before allowing access to protected functions. This intermediary mechanism prevents jail-break attacks from bypassing security controls.
Solution Approach 2:
The patent moves the security verification from the OS kernel level to the SIM card level, effectively changing the dimension of security enforcement. By anchoring security in the hardware-based SIM card rather than software-based OS privileges, the system creates a new security dimension that is independent of OS vulnerabilities.
2Reliability
If software obfuscation techniques are used to protect confidential information, then resistance to whitebox attacks is improved, but the application still lacks binding to a specific mobile station
Solution Approach 1:
The patent merges software obfuscation techniques with hardware-based SIM verification. The application combines code obfuscation for whitebox attack resistance with SIM card binding for portability control. This merging creates a composite security mechanism that achieves both attack resistance and station-specific binding.
Solution Approach 2:
The patent creates a composite security architecture combining multiple protection layers: software obfuscation, SIM presence verification, and challenge-response authentication. This composite approach integrates different security mechanisms to achieve comprehensive protection that satisfies both attack resistance and portability requirements.
3Adaptability or versatility
If challenge-response verification with SIM cards is implemented, then binding to specific mobile station is improved, but the system complexity increases
Solution Approach 1:
The SIM card performs self-service by autonomously generating challenge-response pairs using its embedded authentication algorithms. The SIM card independently verifies its own presence and authenticity without requiring external verification infrastructure, thereby reducing system complexity while maintaining strong binding to the specific mobile station.
Data Source
Figure 1~4
Figure 3
Figure 5~7
AI summary
A method for enabling a software application (12) to be executed on a mobile station (1) in dependence of a subscriber identity module (10), the method comprising: inputting challenge data originating from the software application (12) to the subscriber identity module (10), wherein the challenge data is preconfigured in the software application (12); generating first response data in the subscriber identity module (10), wherein the subscriber identity module (10) is configured to perform a first security function (101) and wherein the first response data is generated using the first security function (101) using (a) data which is associated with the subscriber identity module and (b) the challenge data; verifying if the first response data corresponds with a preconfigured response data in the software application (12) to obtain a verification result; and enabling the software application (12) to be further executed in dependence of the verification result.