Granular SMS Access Control for Android Verification Code Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In Android operating systems, malicious third-party applications can read SMS verification codes, leading to unauthorized sensitive operations due to lack of granular access control, allowing them to execute payments or registrations without proper authorization.
Innovation Solution
Implementing an SMS reading method that checks if a third-party application belongs to an access authority list specific to the SMS carrying sensitive information, ensuring only authorized applications can access and read such SMS content.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If third party applications are authorized to read SMS without granular access control, then ease of operation is improved, but security is worsened due to malicious applications being able to read verification codes
Solution Approach 1:
The patent segments SMS access control into granular levels by creating an access authority list that is specific to each SMS message. Instead of a single blanket authorization, the system divides access rights at the individual message level, allowing only authorized applications to read specific SMS containing sensitive information while maintaining ease of operation for legitimate uses.
2Reliability
If granular access control is implemented for SMS reading, then security is improved, but device complexity increases due to access authority lists and verification mechanisms
Solution Approach 1:
The access authority list mechanism serves multiple functions simultaneously: it identifies authorized applications, determines SMS accessibility, and enforces security policies. By making the access control mechanism universal and multi-functional, the patent reduces overall system complexity while maintaining strong security through a single integrated verification approach.
Data Source
AI summary
A method and device are provided for reading a SMS. In the method, the device receives reading request to read an SMS from a third party application. When the SMS is a SMS carrying sensitive information, the device determines whether the third party application belongs to an access authority list corresponding to the SMS, where the access authority list includes one or more applications having an authority of accessing the SMS. When the third party application belongs to the access authority list, the device feed the SMS back to the third party application.