Using The GSM/UMTS SIM to Secure Web Services

In this paper we present a mobile operator endorsed authentication and payment platform for the consumption of Web services by a mobile station. We propose a protocol where the mobile operator plays the role of dusted third party to issue authentication and authenticated payment authorisation tokens to facilitate a transaction between a mobile station and a Web service provider. We consider the structure and syntax of these tokens to minimise service latency, and provide security services to protect against the threat model. To validate our proposal we have developed code to create a Web service test scenario utilising readily available J2ME, Java Card, J2SE and J2EE platforms, Wtb Services tools from Apache, the KToolBar emulator from Sun, and a Gem-plus Java Card