Authenticate a mobile device when its visiting a website without using any other applications

Question

0.00/5 (No votes)

See more:

We have a client requirement to authenticate a Mobile device whenever it accesses a specific URL, Since this is a rarely used functionality so this was decided to be done in Website only, The website would be based on ASP.net/Web API for further calls

So kindly help me with the below questions with respect to the Authentication of a Mobile Device when accessing a Specific URL,

1) Do we have any way which can be used to authenticate a mobile device based on its unique identification?
2) But based on our analysis it is considered as a security risk to obtain data like IMEI , IMSI, MSISDN or Phone Number etc? Also efforts to extract those data on website access also failed, So do we have any other unique data which can be used as an authentication parameter?
3) If none of the above is feasible , Kindly suggest us any Ideas where a specific mobile device can be authenticated whenever it accesses a URL without any User Login or One Time Password or Flash Call authentication?
4) The URL being accessed will be provided to the user using a 3rd Party SMS service Provider, is there any data in SMS provider that can be leveraged for the specific authentication?

Thanks,
B

Posted 13-Oct-15 3:29am

Bala1313

Add a Solution

Comments

Nathan Minier 13-Oct-15 11:21am

Is there a way to exchange a shared secret out-of-band, before the first request is ever made?

Bala1313 14-Oct-15 1:24am

Sorry I'm not getting it, Can you please shed more light on the secret out-of-band before request thing?

Nathan Minier 14-Oct-15 7:16am

Sure. A shared secret is generally a password or encryption key, it's a way of providing an authentication factor. You could target specific device GUIDs or phone numbers if you were installing software onto the device, but since you inferred that the browser was the only software (I assume that's what you mean by "Website only") you're stuck with JavaScript, which does not have reliable solutions for that.

Out-of-band just means that the message (the shared secret in this place) can be communicated through a different medium than the one that you're trying to secure.

In this context, what I'm saying is that the best thing you could do is install a certificate containing a private key onto the mobile device before the web application is ever accessed. This, unfortunately, requires PKI, and I don't know if your organization has a management infrastructure for that (a CA, key store, etc).

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)