SIM OTA Key Provisioning for Secure Device-Server Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing secure communication systems for devices and application servers lack robust mechanisms for provisioning and storing dynamic keys, are vulnerable to hacking, and often lack mutual authentication, posing risks due to shared secrets and inadequate certificate management.
Innovation Solution
Utilize a subscriber identity module (SIM) over the air (OTA) capability for secure key provisioning, with a centralized key management service (KMS) server generating and managing security keys, ensuring secure storage and mutual authentication between devices and application servers.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a shared secret mechanism is used for secure communication between clients and application server, then communication can be established, but the system becomes vulnerable to hacking and man-in-middle attacks
Solution Approach 1:
The patent segments the shared secret into multiple parts: a long-term secret key stored securely in the SIM card, and a session-specific key generated for each communication session. This segmentation ensures that even if one session key is compromised, the long-term secret remains secure and other sessions are not affected.
Solution Approach 2:
The patent performs preliminary key provisioning by pre-installing the long-term secret key in the SIM card during device initialization. This preliminary action ensures that secure communication capabilities are established before actual communication begins, and the key is protected from the outset by the SIM card's secure environment.
2Ease of operation
If a token mechanism is used for authentication, then client access can be enabled, but the security is not fully secured and lacks mutual authentication
Solution Approach 1:
The patent introduces the SIM card as an intermediary authentication entity that holds and manages the secret key. The SIM card acts as a mediator between the client application and the application server, performing certificate exchanges and validations. This intermediary role enables mutual authentication where both client and server verify each other's credentials through the SIM card's secure mechanisms.
3Quantity of substance
If standard device application memory is used for storing keys and tokens, then storage is available, but there is no standard secure mechanism for key storage
Solution Approach 1:
The patent extracts the key storage function from the standard device application memory and relocates it to the SIM card's secure element. This extraction removes the security weaknesses of standard memory (lack of protection against unauthorized access, no secure deletion mechanisms) while maintaining the ability to store multiple keys and tokens securely in the SIM card's dedicated secure storage areas.
Data Source
AI summary
The present disclosure provides a system and a method for secure communication between a device and an application server. The device sends a request for secure communication with the application server. Further, the system generates a security key based on the request and transmits the security key to a subscriber identity module (SIM) associated with the device over an over the air (OTA) interface. Further, the system generates a session key based on the security key and transmits the session key to the application server. The system enables the secure communication between the device and the application server based on the session key.