VISP Authentication Service for Mobile Device Tracking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Third-party mobile applications cannot effectively authenticate and authorize IP connection sessions with mobile devices due to the transient nature of IP addresses in cellular networks, which limits their ability to maintain confidentiality and track devices.
Innovation Solution
A VISP authentication service that utilizes a combination of Universal Integrated Circuit Card (UICC) or Subscriber Identity Module (SIM) based mobile subscriber authentication, along with an IP connection session via a packet gateway, to establish a secure authentication and authorization mechanism between third-party application servers and mobile devices, using a packet gateway to manage session data and enforce authentication protocols.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If IP connection sessions are used in cellular networks, then mobile devices can access third-party application servers, but the transient nature of IP addresses prevents effective authentication and device tracking
Solution Approach 1:
The patent introduces an authentication server as an intermediary between mobile devices and third-party application servers. This server maintains device profiles containing permanent identifiers (such as IMSI or MSISDN) and authentication credentials, decoupling the authentication mechanism from the transient IP addresses. The intermediary enables reliable authentication by mediating between the changing network layer (IP addresses) and the stable identity layer (device profiles).
Solution Approach 2:
The patent shifts authentication from the network layer (IP addresses that change) to the application layer (device profiles with permanent identifiers). By moving authentication to another dimension - the application layer - the system can maintain reliable device identification and tracking despite IP address transience in the network layer.
2Adaptability or versatility
If IP addresses change frequently in cellular networks, then network flexibility is improved, but confidentiality and device tracking capabilities deteriorate
Solution Approach 1:
The authentication server acts as an intermediary that maintains device profiles with permanent identifiers. This intermediary preserves device tracking information by storing stable identifiers (IMSI, MSISDN) that do not change with IP addresses, while still allowing the network to flexibly assign transient IP addresses for communication.
Solution Approach 2:
The system creates and maintains a copy of device identification information in the authentication server's device profiles. This copy contains permanent identifiers that serve as a reliable reference for device tracking, independent of the transient IP addresses used for actual network communication.
3Device complexity
If traditional authentication methods are used, then implementation simplicity is maintained, but security and confidentiality for third-party applications are insufficient
Solution Approach 1:
The authentication server provides universal authentication services that can be used by multiple third-party application servers. Instead of each application implementing its own complex authentication mechanism, they all utilize the same multi-functional authentication infrastructure that handles device identification, credential verification, and session management.
Solution Approach 2:
The authentication server mediates between mobile devices and third-party application servers, providing a standardized authentication interface. This intermediary simplifies implementation for application servers by handling the complex security operations centrally, while maintaining high security through proper credential management and authentication protocols.
Data Source
AI summary
An authentication device receives, from an application executing at a mobile device, a request for an authentication token, the request including an application identifier and an encrypted session identifier (SID). The application identifier identifies the application and the SID uniquely identifies a session between the application and a destination network device. The authentication device decrypts, using a first private key of a first public/private key pair, the encrypted SID to produce a decrypted SID; and determines a first hash value of certain data that includes the application identifier and session information associated with the session. The authentication device further encrypts, using a second public key of a second public/private key pair, the determined first hash value and the decrypted SID to produce an authentication token comprising the encrypted first hash value and the SID; and sends the authentication token to the application at the mobile device.