Sat back channel security solution

[0002] The present invention relates to mobile communication, in particular security solutions for mobile terminals using USSD (Unstructured Supplementary Service Data).

[0003] For mobile terminals not supporting WAP, e.g. most mobile phones at the moment, there exist the possibility of viewing WAP pages through USSD. In other words, a simulation of a WAP (Wireless Application Protocol) information dialogue can be made by using the USSD capabilities of a Mobile Terminal. The WAP WML (Wireless Markup Language) is browsed in a proxy in the network, and the display of the terminal is made for showing the correct message by sending the equivalent of a “screen dump”. WML responses are put together by the proxy from the characters entered by the user on the keypad of the Mobile Terminal. This is summarised in FIG. 1 as follows:

[0004] 1. The WML server sends the content of a WML page to the Proxy

[0005] 2. The Proxy decomposes the WML page onto USSD (Unstructured Supplementary Service Data) and sends the data to the ME (Mobile Equipment)

[0006] 3. The ME sends the received data to the display, which presents said data to the user

[0007] 4. If an answer from the user is requested, then the user can enter it to the keypad, which forwards the answer to the ME

[0008] 5. The ME sends the input to the proxy

[0009] 6. The proxy assembles the received input into WML format and delivers it to the WML server

[0010] No security feature except for unencrypted passwords is available in this solution. It is not possible to have a secure transaction, i.e. encrypted message exchange in this architecture.

[0011] As mentioned above, the only security feature that exists is the unencrypted passwords. This security feature is implemented in the SAT applications, which implement the information browsing.

[0012] The problem with USSD based browsing as described above, is that the level of security is too low for higher values. As the password is communicated unencrypted, it can be discovered during the transfer. Another problem is that the system is awkward in use. Each time a secure transaction is to be performed, the WML server prompts the user for a password, which password has to be entered manually. The password has to be remembered by the user, possibly in addition to a number of passwords for other applications.

[0013] It is therefore an object of the present invention to provide a method for USSD based browsing, which allows transactions to be performed at a security level hitherto unknown. It is another object of the present invention that said transactions should be easy to perform from the users point of view, and if desired, made fully transparent to the user.

[0014] These objects are satisfied in a method as specified in the appended patent claims.

[0015] FIG. 1 Illustrates the simulation of a WAP information dialogue using USSD (prior art).

[0016] FIG. 2 illustrates a secure WAP exchange according to the invention using an SAT back channel.

[0017] For SAT (SIM Application Toolkit (ETSI 11.14)) enabled phones, the following solution is suggested.

[0018] As shown in FIG. 2, a secret/private key is stored on the SIM card. Also an algorithm for signing data using a symmetric or an asymmetric technique, as well as an application handling the dialogue with the user and the signing of data is stored on the SIM card.

[0019] This is summarized in FIG. 2 as follows:

[0020] 1. When information browsing through the mechanism described above and in FIG. 1, has reached a point where a secure transaction should be established, for example the WML server asking explicitly for a secure transaction.

[0021] 2. The USSD dialogue is terminated. Instead the proxy enters the details of the transaction to be secured into an SMS, and sends it to the SIM card of the Mobile Terminal where the SAT application is activated.

[0022] 3. The application using SAT commands shows the details of the transaction to the user, and prompts for an “OK” to the transaction.

[0023] 4. If the user agrees (optionally by entering a PIN), the application signs the data (or a hash of the data) with the secret/private key using the correct algorithms.

[0024] 5. The signed data is then returned to the proxy by using SMS or USSD as a bearer.

[0025] 6. Then the proxy either verifies the signature or passes it on to the appropriate instance that shall handle the verification.

[0026] A very high level of security is achieved in combination with a very flexible information browsing solution.

[0027] Since it only has to handle signing of data and no information or menu handling, the application on the SIM card can be made very thin and flexible. Thus, it can be made to work in many different applications.

[0028] The system handling the information browsing, and the system handling the security of the transactions are separated. They can be updated, changed etc. independently.

[0029] Application An application consists of a set of security mechanisms, files, data and protocols (excluding transmission protocols)

[0030] ETSI European Telecommunication Standard Institute

[0031] HDML Hand-held Device Markup Language An abbreviated version of HTML designed to enabling wireless pagers, cellular phones and other hand-held devices to obtain Web pages

[0032] HTML HyperText Markup Language The document format used on the World Wide Web. Web pages are built with HTML tags or codes embedded in the text. HTML defines the page layout, fonts and graphic elements, as well as the hypertext links to other documents on the Web.

[0033] PIN Personal Identification Number

[0034] Proxy It is also called a “proxy server” or “application level gateway”. It is an application that breaks the connection between the sender and the receiver. All input is forwarded to a different port, closing a straight path between two networks and preventing a hacker from obtaining internal addresses and details of a private network.

[0035] SAT SIM Application Toolkit SAT is a set of applications and related procedures, which may be used during a GSM session.

[0036] SIM Subscriber Identity Module (Mobile)

[0037] SMS Short Message Service

[0038] USSD Unstructured Supplementary Service Data USSD is a mechanism that allows user interaction between GSM Public Land Mobile Network applications and a Mobile Station in a transparent way through the network.

[0039] WAP Wireless Application Protocol WAP is a wireless standard from Motorola, Ericsson and Nokia for providing mostly cellular phones with access to e-mail and text-based Web pages. WAP uses the Wireless Markup Language (WML), which is the WAP version of HDML.