Token Validation for Mobile Application Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Mobile communication devices face challenges in accessing application services over wireless networks, particularly due to the inconvenience of proof-of-work tests like Captcha, which are often unsuitable for mobile devices, and the need for efficient methods to grant special access privileges to trusted devices while preventing automated software access.
Innovation Solution
A mobile communication device operates in a wireless network with a service provider, sending a message containing a token with a digital signature to an application server, which performs token validation using a public key to grant or deny access, thereby bypassing proof-of-work tests for entrusted devices.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If proof-of-work tests (e.g., Captcha) are implemented to prevent automated software access, then security against automated bots is improved, but user convenience and ease of operation deteriorates for mobile devices
Solution Approach 1:
The service provider performs preliminary authentication by digitally signing a token and providing it to the mobile device before the device accesses the application server. This advance verification eliminates the need for proof-of-work tests at the application server, resolving the contradiction by maintaining security through pre-established trust while preserving user convenience during actual service access
Solution Approach 2:
A token serving as an intermediary credential is introduced between the mobile device and application server. The token, digitally signed by the service provider, acts as a mediator that proves the device's trustworthiness without requiring the user to complete proof-of-work tests, thus maintaining both security and ease of operation
2Reliability
If token validation with digital signature verification is implemented, then security and reliability of access control is improved, but device complexity and processing requirements worsens
Solution Approach 1:
The complex cryptographic verification operations are extracted from the mobile device and performed instead by the application server. The device only needs to store and present the digitally signed token, while the server handles the computationally intensive digital signature verification using its private key, thus improving security without burdening the mobile device with complex processing requirements
Solution Approach 2:
The service provider creates a digital copy of the authentication credential in the form of a signed token that can be repeatedly presented by the mobile device. This token copy contains all necessary verification information, allowing the application server to validate the device's authenticity without requiring repeated complex authentication exchanges, reducing processing complexity while maintaining security
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A mobile communication device operates in a wireless communication network with use of a communication service provided by a service provider (e.g. a wireless carrier for voice telephony, or data service provider for data synchronization). An application server receives, via the wireless network, a message from the mobile device. The message has a field for inclusion of a token having a digital signature corresponding to the service provider. The application server performs token validation of the message, which includes a verification step for verifying the digital signature of the token with a public key corresponding to the service provider. The application server then grants or denies access to an application service depending on the outcome of the token validation. In one embodiment, the application service is an e-commerce transaction service, wherein a proof-of-work (POW) test (e.g. a Captcha test) otherwise utilized for the service is bypassed or excluded.