I have a mobile application (Android, iOS) and a server, which handles requests from the application.
It is easy to perform standard authentication using SSL, password and random token to authenticate the user.
However, I have no idea how to authenticate the mobile device AND the user. I need to prevent the user from using other devices then the one he used for the first time (for some very good reason).
The problem is I must expect the user will not cooperate. On contrary, he will probably try to use another device, but I have to stop him.
I think the SIM card must be the key to this problem. However, I cannot make any changes to SIM card itself (I cannot install any special SIM applet to the SIM). I can use only the features ANY SIM card provides.
Is there any possible solution?