WO2014117939A1

WO2014117939A1 - Method for accessing a service of a server using an application of a terminal

Info

Publication number: WO2014117939A1
Application number: PCT/EP2014/000246
Authority: WO
Inventors: Alexander SUMMERER; Denny Brandl; Bernhard Inderst
Original assignee: Giesecke & Devrient Gmbh
Priority date: 2013-01-31
Filing date: 2014-01-29
Publication date: 2014-08-07
Also published as: EP2952029A1; DE102013001733A1

Abstract

The invention relates to a method for accessing a service (SR) of a server (SV) using an application (AP) of a terminal (MD), wherein the terminal (MD) has an associated security element (SE) with which the terminal (MD) can communicate and the security element (SE) contains a subscriber identification (MSI) of a mobile radio subscriber in a mobile radio network. The application (AP) of the terminal (MD) uses a first channel of an IP-based nework to transmit an identification (SID, TN) to the service (SR) of the server (SV) on the basis of IP-based transmission. In the event that the service (SR) is able to successfully verify the identification (SID, TN), an authentication token (AT) is transmitted from the service (SR) to the security element (SE) in encrypted form using a second channel of the mobile radio network on the basis of transmission that differs from the first channel. Next, the application (AP) is automatically provided with the authentication token (AT) transmitted to the security element (SE). Finally, the application (AP) accesses the service (SR) by means of encrypted communication via the first channel, wherein the application (AP) automatically provides requests (RE, RE') that are transmitted from the application (AP) to the service (SR) in the course of the encrypted communication with the provided authentication token (AT), with requests (RE, RE') being processed further by the service (SR) only in the event of successful verification of the authentication token (AT).

Description

G e t u c t i o n c e m e n t i o n c o n t i o n t i o n t e n t i o n t he n o t e s o u r c e v e n t i o n t e n t i o n o t e s

The invention relates to a method for accessing a service of a server via an application of a terminal. Furthermore, the invention relates to a corresponding system for accessing a service. Authentication methods for accessing servers based on authentication tokens are known from the prior art. An application in possession of such an authentication token can gain access to a service or a resource via this token. Well-known token-based authentication methods are the protocols OAuth 1.0 and OAuth 2.0.

In the authentication protocols OAuth 1.0 and OAuth 2.0, the exchange of authentication tokens is exchanged purely via IP-based transmission technology between application and service. In order to ensure sufficient security against accesses of unauthorized applications, a user authentication is usually performed, however, which require user interaction, eg the input of user name and password. The object of the invention is to provide a method for accessing a service of a server via an application, which is well protected against attacks by unauthorized third parties and requires few or possibly no user interaction for authentication. This object is achieved by the method according to claim 1 and the system according to claim 12. Further developments of the invention are defined in the dependent claims. The inventive method is used to access a service of a server via an application of a terminal, wherein the terminal is associated with a security element with which the terminal can communicate. The security element contains a subscriber identification of a mobile subscriber in a mobile network. The terminal has access to a mobile radio interface and may be a portable mobile device, such as a mobile phone, smart phone, tablet PC or a portable computer, depending on the configuration. Also, the terminal may also be a stationary device such as a desktop computer. The security element is preferably a hardware security element. Depending on the application, the security element is a UICC card or SIM / USIM card (UICC = Universal Integrated Circuit Card). These cards can be inserted into the appropriate terminal, as could other portable data carriers such as USB tokens, secure mass storage card or RFID transponder as. Serve security element. Optionally, the security element may also be a permanently installed in the terminal element (security module), in particular in the form of a so-called. Embedded UICC card or embedded SIM / USIM card, but also as an NFC module or TPM module. The assignment of the terminal to the security element can thus be achieved by inserting the security element in the terminal or by the fixed installation of the security element in the terminal. Likewise, such an association can also be ensured via another coupling between the terminal and the security element, for example by a mobile radio stick or another device containing the security element, wired (eg via USB) or wirelessly (eg via Bluetooth) is connected to the terminal. The mobile radio network used in the method according to the invention can be based on any technologies, for example, it can be a GSM network (GSM = Global System for Mobile Communications) or a 3G network or even an LTE network (LTE = Long Term Evolution ) act. In the method according to the invention, the application of the terminal transmits an identification to the service of the server in a step a) via a first channel of an IP-based network based on an IP-based transmission (IP = Internet Protocol). In a particularly preferred variant, the identification is encrypted over the first channel, for example using the TLS protocol (TLS = Transport Layer Security). In a step b) of the method according to the invention, in the event that the service can successfully verify the identification, an authentication token from the service over a second channel of the mobile network based on a different transmission from the first channel (ie by means of another type of Transmission) encrypted transmitted to the security element. The second channel is thus based on a transmission technology which is not based on the Internet Protocol. The verification of the corresponding identification can be done differently depending on the configuration, in case of unsuccessful identification of the method is aborted. In a preferred variant, one or more predetermined identifications are stored in the server, wherein in case the identification received via the first channel matches one of the predetermined identifications, the identification is successfully verified. The concept of the authentication token is here and in the As broadly understood, it may include any type of authentication data based on any data format.

In a step c), the application is provided automatically (i.e., without a user interaction) with the authentication token transmitted to the security element. Finally, the application accesses the service in a step d) by means of an encrypted communication via the first (IP-based) channel, wherein the application requests (which are transmitted in the context of the encrypted communication from the application to the service, automatically (ie without user interaction) with the provided authentication token. In this case, requests are processed by the service only upon successful verification of the authentication token. The verification of the authentication token takes place in particular in such a way that the authentication token is compared with the authentication token transmitted in step b) and still stored in the server, whereby the verification is successful only if the tokens match. The encrypted communication used in step d) is preferably based on the already mentioned TLS protocol. In the context of encrypted communication, the HTTP protocol is also used in particular (HTTP = Hypertext Transfer Protocol).

The inventive method has the advantage that the security against attacks by third parties is increased by the use of two channels for data transmission, namely a first channel for encrypted access to the service and a second channel for transmitting an authentication token. In addition, the number of required user inputs is reduced as part of an authentication. In particular, the authentication token is automatically generated by the application processed without having to enter authentication data manually.

In one embodiment of the method according to the invention, the identification transmitted in step a) is communicated in advance to a user of the terminal, whereby this message takes place in particular via the service which is to be accessed. In this case, in step a) the user enters the identification at the terminal via a user interface, whereupon the application transmits the input identification to the service via the first channel. The notification of the identification to the user may e.g. by sending an e-mail or text SMS.

In a particularly preferred embodiment, in step a) the application reads out a call number stored in the security element, via which the mobile radio subscriber can be contacted, wherein the identification transmitted in step a) is the read out call number. In this case, the corresponding identification no longer has to be entered manually by a user. In a particularly preferred variant of the method according to the invention, the authentication token is transmitted encrypted in step b) via an SMS (SMS = Short Message Service) to the security element. For encrypted transmission of the SMS known technologies, such as the standard GSM 03.48, can be used. Preferably, the transmission of the authentication token to the security element in step b) with the interposition of a so-called. OTA server (OTA = Over The Air), with the information in a conventional manner via a mobile network to corresponding security elements and in particular one SIM / USIM card or an embedded SIM / USIM card can be transmitted.

In a further variant of the method according to the invention, the automatic provision of the authentication token in step c) takes place via a polling of the application for the authentication token on the security element. The term known per se for polling is understood as meaning a cyclical polling via which the application receives the information that a corresponding authentication token is available on the security element.

In a further variant, the reception of the authentication token in the security element and the provision of this authentication token for the application are carried out with the aid of a program and in particular a Java applet on the security element. In a further preferred embodiment, the security element or the program communicates with the application via a so-called Secure Element API (API = application programming interface). Such APIs are well known in the art (e.g., Open Mobile API or JSR177). These APIs allow for access protection mechanisms so that only an authorized application can read the authentication token from the security element.

In a further embodiment of the method according to the invention, the transmission of queries in step d) can be triggered at least partially by a user via a user interface of the terminal. As a result, the execution of the application can be controlled in a suitable manner by a user. The authentication token is preferably valid only for a defined time for use with a service. The authentication token is thus accepted by the service for verification if it is used within the defined period of time. However, upon expiration of the time, the authentication token is no longer accepted by the service. The server can delete a transmitted (and stored for verification) authentication token after the defined time, for example, mark or expired.

In a preferred embodiment, the transmitted (first) authentication token can also serve as a second identification (session ID) for a second communication with the service or another service, for which then - analogously to the procedure already described - a second authentication token is transmitted.

The method of the invention can be used to access any types of services. In particular, as part of the access to the service in step d), one or more cryptographic keys or one or more certificates can be stored or renewed by the service on the terminal.

In addition, a session ID is independent of the type of the first communication channel. The session ID can thus be used for different first communication channels between the application and the one service.

In addition to the method described above, the invention further relates to a system for accessing a service of a server via an application of a terminal, wherein the terminal is assigned a security element, with which the terminal can communicate, and the security element contains a subscriber identification of a mobile subscriber in a mobile network. The application, the security element and the service are designed such that the method according to the invention or one or more preferred variants of the method according to the invention can be carried out.

The invention further relates to a server having a service stored thereon, wherein the service is set up for use in the method according to the invention or one or more preferred variants of the method according to the invention. That is to say, the service is set up to carry out the steps carried out by it according to claim 1 or corresponding dependent claims. In other words, the service is designed such that it corresponds to a service of the above-described system according to the invention.

The invention further includes a terminal with an application and assigned security element deposited thereon, wherein the application and the security element are for use in the method according to the invention or one or more preferred variants of the invention

Procedure are set up. That is, the application and the security element are set up to carry out the steps performed by them according to claim 1 or corresponding dependent claims. In other words, the application and the security element correspond to the application and the security element in the system according to the invention described above.

Embodiments of the invention are described below in detail with reference to the accompanying drawings. Show it:

1 is a schematic representation of a first embodiment of the inventive method, and

Fig. 2 is a schematic representation of a second embodiment of the method according to the invention. In the embodiment of FIG. 1, a method for accessing an application AP, which is an arbitrary consumer application, is shown on a service SR of a server SV. The application AP is stored on a mobile device MD of a user U. This mobile device allows communication in a mobile network. For this purpose, a security element SE in the form of a SIM / USIM card with a corresponding IMSI subscriber identification MSI of a mobile radio subscriber (IMSI = International Mobile Subscribe Identity) and associated call number is provided in the mobile radio. The application AP can access the service SR via a suitable interface by means of an IP-based data transmission. This service is a so-called service provider application, via which the application AP can obtain data on the mobile device MD or perform actions. The service SR is thus offered by a service provider, this provider does not necessarily have to match the operator of the server SV. The application AP can, for example, access a service for providing keys, the keys being stored in the server SV. Likewise, with a corresponding service of the server SV, a certificate for the application AP to be issued. If, for example, a new key was generated by the application AP, it can request a certificate for the new key by accessing the service. Another example of a service is the renewal of an existing certificate for an application.

The user U indicated schematically in FIG. 1 is a human person who operates the application AP on the mobile radio MD in order to access the service SR of the server SV. As a rule, this person is also the owner of the mobile device at the same time. The mobile device may be a mobile phone or a smartphone. Optionally, the mobile device may also be a tablet computer, portable computer or laptop with security element inserted or integrated therein. Likewise, the mobile device may be a stationary desktop computer or PC.

The security element SE can be realized differently depending on the embodiment. In particular, it can be a replaceable SIM / USIM card, which is reversibly inserted into the mobile device (portable data carrier). Likewise, the security element may be a so-called. Embedded SIM / USIM card, which is firmly integrated in the mobile device (security module). For the assignment of a security element to a corresponding mobile device, it may also not be necessary for the security element to be located in the mobile radio device. In particular, the security element can also be used in a mobile radio stick to set up a mobile radio connection, wherein the stick is in turn connected to a terminal (eg via USB). The terminal together with the stick then represents the mobile device. Likewise, the security element can be assigned to a terminal via another mobile device, which is connected via a corresponding interface and, in particular, to a wireless device. los (eg via Bluetooth) communicates with the terminal. The mobile device MD of FIG. 1 corresponds in this case to the combination of terminal and further mobile device. The application AP can access the security element SE in the context of the method according to the invention. In this case, known technologies can be used, for example, access via a so-called.

Secure Element API (API = Application Programming Interface). Examples of such Secure Element APIs are Open Mobile API under the Android operating system or JSR177 for Blackberry phones. A Secure Element API enables a transfer of so-called APDUs according to the standard ISO 7816-4 (APDU = Application Protocol Data Unit). APDUs are typically used for data transfer between a security element and a terminal or mobile device. The communication between application and security element as well as the receipt of an authentication token described below is preferably controlled on the security element via a special Java applet.

In the context of the method of FIG. 1, in a step S1, the user U initially enters an identification in the form of a so-called session ID SID, whereby the user is provided with this identification in advance via a suitable transmission path (eg via text SMS or e-mail). Mail) was communicated. The corresponding message with the identification contained therein is transmitted in the embodiment described here by the server SV to the mobile device MD and can be displayed to the user U there. After entering the identification SID, this is transmitted by the application AP in a step S2 to the service SR. For this purpose, an IP-based data transmission over a corresponding first channel, eg via a LAN or WLAN interface of the mobile device used. Likewise, the Data transmission takes place with the interposition of the corresponding mobile radio interface of the mobile device. The transmission of the identification SID is encrypted to avoid manipulation, eg via the TLS protocol. Thus, a connection of the application AP to the server SV via the Internet is established via the IP-based first channel. This channel is also used in the further direct communication between application AP and service SR.

The identification SID received by the service SR in step S2 is checked in step S3 by the service SR as to whether it is aware of the service. For this purpose, if appropriate, a database with corresponding permissible identifications can be stored in the server SV. If the identification SID in the server is known, in a next step S4 a so-called authentication token AT is generated, which contains corresponding authentication data and is used in a later stage of the method for authorizing the application AP with respect to the service SR. As part of a step S5, a status message is also sent to the application AP, with which it is informed whether the identification SID could be successfully identified or not. In the latter case, the method is stopped because the application AP has no authorization to access the service SR.

After the generation of the authentication token AT in step S4, this token is transmitted in step S6 to an OTA server OS. Such servers are known in the art and allow transmission of information over the air over a cellular network. Consequently, in a step S7, the OTA server OS transmits the token AT to the security element SE of the mobile radio MD based on a mobile radio transmission. The second channel used for this is not IP-based and thus uses a different transmission technology than the first channel. In the embodiment described here, the transmission takes place by means of a text message based on an encrypted SMS, whereby preferably the standard GSM 03.48 is used. In this case, the telephone number used for the transmission of the SMS is known in the service SR and linked to the session identification SID.

After sending the identification SID in step S2, the application AP carries out a so-called polling (i.e., a cyclical polling) via a secure element API, wherein in the course of the polling an authentication token AT which is transmitted to the security element SE is searched. As soon as the authentication token AT has been received by the security element SE, it is referred to by the application AP in step S8. This authentication token is then used to authenticate the application AP in the context of the subsequent communication with the service SR via the first IP-based channel. In the embodiment described here, the subsequent communication takes place with the aid of so-called HTTP requests, which the application AP directs to the service SR in order to trigger corresponding actions. An HTTP request, which is based on the known hypertext transfer protocol, is a concrete HTTP transfer command. In particular, data can be requested from an HTTP server using the "HTTP GET" command, whereas with the HTTP POST command, data can be transmitted from an HTTP server to an application, so that the server SV also has the functionality of a HTTP server.

In step S9 is via a user input to a user interface of the mobile device MD (or automated, in particular according to user default) a corresponding action for execution by the service SV triggered. Based on the user input, an HTTP request RE is then directed to the service SR via the first channel in step S10. In this case, the authentication AP is automatically inserted into the HTTP request as an attribute by the application AP. In step S11, the service SR then checks whether the received token corresponds to the token sent out in step S4. If so, the application AP is successfully authenticated or authorized so that the corresponding action requested via the HTTP command RE is performed in step S12. If no match of the tokens is found in step S12, the process is aborted. In both cases, a response to the application AP is returned by the service SR in step S13. Upon successful authentication in step Sil, the result of the requested action, eg a requested key or a requested certificate, is given as an answer to the application AP. In the case of unsuccessful authentication, on the other hand, an abort message is transmitted to the application AP.

In the embodiment of FIG. 1, the execution of a further action via corresponding steps S9 ', S10 ¹ , S13' is shown by way of example. These steps correspond to the steps S9 to S13 described above. That is, it is in turn via the step S9 'by the user (or automated) triggered an action that leads to the transmission of an HTTP request RE' containing the authentication token AT as an attribute. A check of the token is then carried out in step S11 'and, if authentication is successful, the action S12' is carried out, which in

Step S13 'results in returning a response. Depending on the design of the application, other actions for accessing the service can also be triggered. In the just described access to the SR service, the encrypted communication over the first channel is always based on the IP-based communication. For encryption, the TLS protocol known per se is used in a particularly preferred embodiment. This protocol authenticates the server and encrypts the corresponding RE and RE 'requests and the responses based on them. This ensures that the authentication token can not be read by third parties by listening to the first channel. 2 shows a schematic representation of a modification of the embodiment of FIG. 1. The method of FIG. 2 largely corresponds to the method of FIG. 1. Thus, only the differences between the two methods are described. In contrast to FIG. 1, in the method of FIG. 2, no session ID SID is transmitted as identification in step S2, but instead the telephone number or telephone number TN of the mobile radio subscriber which is stored in the security element SE. The start of the application AP by the user U in step Sl takes place without the input of a session ID. Subsequently, the telephone number TN is then automatically read out of the security element SE by the application AP and encrypted (in particular with the TLS protocol) via the first IP-based channel to the service SR of the server SV. The service SR then verifies the telephone number, eg by comparing the telephone number with authorized telephone numbers from a user database. Upon successful verification, the method proceeds analogously as described in FIG. 1, ie an authentication token AT is encrypted via a second channel using SMS transmitted to the security element SE and then used to authorize corresponding requests in the context of access to the service. In order to avoid repetition, the corresponding method steps are not repeated described in detail. In this regard, reference is made to the above statements to FIG. 1.

The embodiments of the invention described above have a number of advantages. In particular, in the context of access to a service by an application, two different transmission technologies are used via a first channel of an IP-based network and a second, different channel of a mobile network. For the direct communication of the application with the service, the first channel is used, and the second channel is used to transmit the authentication key. As a result, attacks by unauthorized third parties are made more difficult because an attacker needs access to both networks to record and analyze corresponding log data to gain access to the service.

The method according to the invention also ensures that the authentication token is always transmitted in encrypted form. It also ensures that the authentication token is transmitted only to authenticated communication partners. For this purpose, an encrypted SMS and the TSL protocol can be used in special embodiments. Moreover, typical access protection mechanisms of a secure element API (for example GP SE Access Control) during the communication between application and security element can ensure that only authorized applications can read the authentication token from the security element.

Another advantage of the method according to the invention is that the authentication of the application takes place automatically, which is achieved by the automatic provision of the authentication token and the automatic authentication. integration of the authentication token is realized in corresponding requests to the service. Consequently, in the context of authentication, it is no longer necessary for inputs to be made manually by a user, as is often the case with conventional authentication protocols.

Claims

P a n t a n s p r e c h e

Method for accessing a service (SR) of a server (SV) via an application (AP) of a terminal (MD), wherein the terminal (MD) is assigned a security element (SE) with which the terminal (MD) can communicate, and the security element (SE) contains a subscriber identification (MSI) of a mobile radio subscriber in a mobile radio network, wherein

a) the application (AP) of the terminal (MD) transmits an identification (SID, TN) to the service (SR) of the server (SV) via a first channel of an IP-based network based on an IP-based transmission;

b) in the event that the service (SR) can successfully verify the identification (SID, TN), an authentication token (AT) from the service (SR) encrypted over a second channel of the mobile network based on a different from the first channel transmission the security element (SE) is transmitted;

c) the application (AP) is automatically provided with the authentication token (AT) transmitted to the security element (SE); d) the application (AP) accesses the service (SR) by means of an encrypted communication via the first channel, wherein the application (AP) queries (RE, RE '), which in the context of the encrypted communication from the application (AP) the service (SR) is automatically provided with the provided authentication token (AT), whereby requests (RE, RE ') are further processed by the service (SR) only upon successful verification of the authentication token (AT). Method according to claim 1, characterized in that the identification (SID) transmitted in step a) is notified in advance to a user (U) of the terminal (MD) by the service (SR), wherein in step a) after an input of the notified identification (SID) by the user via a user interface of the terminal (MD) the application (AP) the identification (SID) via the first channel to the service (SR).

A method according to claim 1 or 2, characterized in that the application (AP) in step a) a stored in the security element (SE) phone number (TN), via which the mobile subscriber can be contacted in the mobile network, wherein in step a) transmitted Identification is the read out telephone number (TN).

Method according to one of the preceding claims, characterized in that the authentication token (AT) in step b) is transmitted via an SMS to the security element (SE).

Method according to one of the preceding claims, characterized in that the authentication token (AT) in step b) with the interposition of an OTA server (OS) to the security element (SE) is transmitted.

Method according to one of the preceding claims, characterized in that the automatic provision of the authentication token (AT) in step c) takes place via a polling of the application (AP) for the authentication token (AT) on the security element (SE). Method according to one of the preceding claims, characterized in that the reception of the authentication token (AT) in the security element (SE) and the provision of the authentication token (AT) for the application (AP) by means of a program and in particular a Java applet on the security element (SE) and / or that the security element (SE) communicates with the application (AP) via a secure element API.

Method according to one of the preceding claims, characterized in that the encryption of the communication over the first channel in step d) takes place based on the TLS protocol.

Method according to one of the preceding claims, characterized in that the transmission of requests (RE, RE ') in step d) can be triggered at least partially by a user (U) via a user interface of the terminal (MD).

Method according to one of the preceding claims, characterized in that as part of the access to the service in step d) one or more cryptographic keys and / or one or more certificates are deposited and / or renewed by the service (SR) on the terminal.

Method according to one of the preceding claims, characterized in that the method by means of a security element (SE) is performed, which is used as a portable data carrier in the terminal (MD) or as a security module in the terminal (MD) is firmly integrated. Method according to one of the preceding claims, characterized in that the authentication token (AT) is valid only for a defined time for use in the step d.

Method according to one of the preceding claims, characterized in that the identification (SID, TN) can be used for different first channels between the application (AP) and the service (SR).

System for accessing a service (SR) of a server (SV) via an application (AP) of a terminal (MD), wherein the terminal (MD) is assigned a security element (SE) with which the terminal (MD) can communicate, and the security element (SE) contains a subscriber identification (MSI) of a mobile radio subscriber in a mobile radio network, wherein the application (AP), the security element (SE) and the service (SR) are configured such that a method can be carried out in which

c) the application (AP) is automatically provided with the authentication token (AT) transmitted to the security element (SE); d) the application (AP) accesses the service (SR) by means of an encrypted communication via the first channel, wherein the application (AP) queries (RE, RE '), which in the context of the encrypted communication from the application (AP) the service (SR) is automatically provided with the provided authentication token (AT), whereby requests (RE, RE ') are further processed by the service (SR) only upon successful verification of the authentication token (AT).

System according to claim 14, characterized in that the system is arranged to carry out a method according to one of claims 2 to 13.

Server (SV) with a service (SR) stored thereon, characterized in that the service (SR) is set up for use in a method according to one of the claims 1 to 13.

Terminal with an application (AP) deposited thereon and an associated security element (SE), characterized in that the application (AP) and the security element (SE) are set up for use in a method according to one of claims 1 to 13.