Currently, I have this hybrid mobile application which talks to my C# web service to do CRUD transactions. As the mobile application is always on the go, and there might not have internet connectivity in all situations.

Therefore, I'm thinking of using SMS transactions in offline mode.

For Login:

  1. Using sms, communicate to server to request for access token.
  2. Token generated and sent using SMS to registered user phone number
  3. User then enter the OTP within 5mins of validity
  4. App will then communicate with server with the OTP, once verified, user will go into a special user interface for offline access instead.

For Transactions:

  1. Phone sends a sms to the 3G Dongle (Unique Session Token, UserID, Type Of Transaction, Transaction Details)
  2. SMS server received sms message
  3. Application which handles sms message, stores message received in a message queue
  4. Application will dequeue message queue and process the oldest message first

There are a few questions in which I would love to have some pointers in:

  1. How do I maintain a unique session using SMS? (Token?)
  2. How do I maintain security? (As in the text message is of course, unreadable by humans, yet can't be duplicated and workable for that transaction only)

I would be doing all of the above by own codes/libraries without using external cloud/web services as it's more for an internal corporation project.


I'm thinking of using 'counters', where my text message body would have a counter inside it.

For example: App Counter: 1 Server Counter: 0

1.App sends a transaction request.(App counter: 1)

2.Server decrypts and checks counter. (Since 1 > 0, allow request and increment server counter to 1)

In this case, even there is an duplicate text message sent by user, the message will not process as the counter is now 1. (1 > 1 will return false).

Apart from multiple users accessing the same account and messing up the counters, what concerns should I take note of?

1 Answer 1


Wow! It's good to read your scenario. Hmmm If I may suggest, I aggree with 1.) Unique session via token, a token from your c# app with the mobile number tagged on it. For number 2.) Yes it's achievable based from 1.) checked the mobile number who requested your c# app who's already tagged with token. Even if someone has duplicated token or whatever , you already tagged the original mobile number requested the app.

  • How do i prevent users from duplicating the text message? I'm thinking of using counters. Where my message counter should be "greater than" my server counter. What do you think?
    – Gene
    Commented Dec 17, 2015 at 0:59
  • I think your idea is good. However my approach is I'm going to create a flag (field in a database table) that will determine if this number has/already sent a text message that the server received it, and every number that will send a text message I will check / look into the flag to determine if this is a fresh request/text or another(will be a duplicate). Commented Dec 17, 2015 at 1:53
  • The user will send more than one transaction. Creating flags in database table looks more complicated and will strain the server resources more, right?
    – Gene
    Commented Dec 17, 2015 at 2:05
  • Yeah if that's the case flag isn't fit. I thought this will be the main entry point to use the app so the request should be 1 only for a certain period of time. Counters will do. :-) Commented Dec 17, 2015 at 2:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.