Authenticating Mobile Users to Public Internet Commodity Services Using SIM Technology
Siddharth Prakash Rao, Alexandros Bakas · 2023
The traditional use of the Subscriber Identity Module (SIM), which resides in a mobile device, is to authenticate a user to cellular mobile networks. However, we believe that the cryptographic capabilities of SIM are not fully utilized for authenticating a user to other types of services. To address this concern, we introduce a novel SIM-based solution to authenticate users to Commodity Services (CS) on the public Internet. We present SIM-Based Authentication (SIMBA), a protocol that comprises registration, key establishment, authentication, and revocation. Our solution consists of a variant of the Remote SIM Provisioning (RSP) protocol that can be run between a commodity service, users, and a Mobile Network Operator (MNO). Furthermore, we introduce the concept of asub-profile for CS that can reside inside an operating SIM profile of an MNO. Unlike the SIM profiles defined in the RSP, our solution can have multiple active sub-profiles that allow users to simultaneously log in to different commodity services without swapping between profiles. We formally define a threat model and present an analysis to prove the protocol's security guarantees. SIMBA offers several benefits to mobile end-users, CS providers, and MNOs. In this realm, we believe that our work contributes to the ongoing research on novel authentication methods.