By attaching a secure certificate to a mobile phone number, user identity can be confirmed to service providers via cryptographically secure “identity messages” in the form of a paired key over a Public Key Infrastructure (PKI).
Certificate-based authentication offers an accepted standard for validating users, but individuals and businesses don’t like using them because they are typically troublesome. Most non-technical users, consumers or employees in a company, for example, find them confusing.
For professionals who issue and administer them, certificates are complex especially in terms of revocation management. It’s often said that Public Key Infrastructure is one percent cryptography and 99% procedure.
User certificates imply that users store their key using client-side software—generally operating systems and browsers—that an average user can normally learn to use but which tend to be, shall we say, ergonomically suboptimal.
Problems arise when users lose their key or an attacker obtains a copy of it. Keys can also be stored on dedicated hardware, which implies the use of hardware tokens and manual processes that are, too often, poorly safeguarded.
What Makes Mobile Certificates Different
When looking at the history of certificate-issuing authorities, it can be somewhat surprising—seemingly anyone can be an issuing authority, a troubling concern to say the least. Nonetheless, PKI has become a lingua franca of internet trust.
However, certificates have, by and large, not been applied to mobile transactions since a key element missing in the architecture is a consistent identifier.
Using a public or private-key combined with a certificate authority, as with Transport Layer Security (TLS), as a standard technology to secure an internet connection and shield sensitive data on websites, albeit not an exact parallel, can be adapted to mobile security and authentication.
In theory, smartphones can be used like desktops to produce signatures that are created using the mobile device itself and verified via certification services outside the mobile carrier network. Internet of Things, which requires Public Key Infrastructure for devices to obtain and renew X.509 certificates for device validation and communications encryption using TLS, can hypothetically achieve similar authentication as well.
Mobile certificates are almost always stored on a smartphone or other device, which suggests the device is kept in a trusted state and users understand enough about PKI to use it properly, but the reality is that they’re complicated to use and easily compromised.
While intended to mitigate this issue, additional tokens carrying better-secured chips and key pairs can rarely convey to users the meaning of what they sign, so they solve only part of the problem.
The only way we have seen this done effectively is when an entity uses its own certificate authority to sign the keys of trusted devices and then uses this as part of the connection requirement for the device via a mutually authenticated TLS or Secure Sockets Layer (SSL) connection. This effectively limits traffic to only that which comes from a device with an appropriately signed X.509 certificate, thus providing an effective deterrent in this respect.
For this to work, it is necessary to generate and store the key material securely and set up a strategy for generating and installing the certificates. Symantec and others have cloud services that could facilitate this at scale and would be worth a look.
On the technical side, most Subscriber Identity Module (SIM) cards contain only a symmetric key, which is used as a shared secret with carriers to generate and respond to challenges as a mechanism to prevent cloning. Increasingly promising has been the case of m-commerce.
For example, despite historically lower economic development compared to other regions, Africa is home to perhaps the most advanced usage of mobile phones for electronic payments. Lack of physical and financial infrastructure has led innovators there to bypass e-commerce, instead creating m-commerce payment services tied to mobile devices. It seems to be working, though flaws exist.
Certificates Linked to a Phone Number
A certificate is easy to create, yet to be useful as an identity credential, the contents of a certificate must be trusted. PKI standards provide a method to determine trust by following the certificate issuance chain up to a trusted certificate authority.
For mobile security, one method is to apply a certificate infrastructure—for instance, X.509 and PKI—to the phone-number-to-carrier relationship.
For this to work, an identity-verification standard inside which carrier-confirmed certificates can be executed is employed. Direct Autonomous Authentication (DAA), which is both automatic and requires no user agency, links certificates to the user’s mobile phone number.
Mobile carriers already authenticate users to track data and phone usage, so they can accurately bill the correct customer. Secured by the encryption strength of the SIM card, the autonomous protocol leverages real-time network data signaling over the mobile network to verify identity using the same information that carriers employ to meter usage.
By “bonding” the certificate to the user’s phone number in this way, it is impossible to verify a certificate, or even access it, unless a user is in possession of the exact same SIM card that can been confirmed as valid (and associated with the user) according to the carrier’s subscriber database.
Instead of storing certificates on the device, a third-party “manages” them for the user via a cloud service, acting as a proxy for the user. This means the authentication process generates a certificate, conceivably fit for any secure login or transaction, which the mobile-certificate authority then sends to the service provider on the user’s behalf.
Possession of a device controlling the user’s mobile phone number, as confirmed by the carrier, can serve as a stand-in for user identity. Individuals very often have a physical and emotional attachment to their smartphone, and certainly by extension to their phone number.
Since they exist in the cloud, the certificates persist when a device is lost or stolen, or upgraded for another device, as long as the user retains the same phone number.