Mobile Phone Client -> Server Authentication based on device

Question

I have a mobile application (Android, iOS) and a server, which handles requests from the application.

It is easy to perform standard authentication using SSL, password and random token to authenticate the user.

However, I have no idea how to authenticate the mobile device AND the user. I need to prevent the user from using other devices then the one he used for the first time (for some very good reason).

The problem is I must expect the user will not cooperate. On contrary, he will probably try to use another device, but I have to stop him.

I think the SIM card must be the key to this problem. However, I cannot make any changes to SIM card itself (I cannot install any special SIM applet to the SIM). I can use only the features ANY SIM card provides.

Is there any possible solution?

Answer 1

Android provides APIs to store and manipulate private key material without revealing them to the app (often with hardware-support). You can generate a key and use it to authenticate to the server.

The keys can be marked as non-exportable, but I am not sure if the restriction is enforeced in hardware and whether the keys will be included in backups or not.

IOS has a Keychain as well but the keys are normally made accessible to the app, so it may be copied on a rooted device.

Answer 2

In mobile app -> server scenario, I like to have an approach for each of the following identity

1. User Identity - i.e. person trying to initial transaction with your server
2. Application Identity - application being used by user to perform the transaction
3. Device Identity- the actual device being used.

Each of these are important part of the comprehensive identity management. In your case, device Identity is the focus. There are a lot of device specific information like SIM card ID, IMEI, UDID (in case of apple) that can be used to tie a specific device to a user. An alternate approach can be that at the time of initial registration of the device, you can generate a public and private key pair on that device. You can associate the public key with the user id on your server. Now, every time you initiate the session or perform transaction, you can use the private key to sign a token (e.g. JWT) and send it with request. As part of authentication/authorization process on server, you can validate the token received and match it with authenticated user id based on saved association.

In addition to that, I am assuming, you have good process in place to handle 1. Transfer of mobile device - people sell or give their devices away and new people want to use device to run your application (with or without device wipe). 2. Multiple users - people in same family may use the same device but different user id to perform transactions.