Currently, I have this hybrid mobile application which talks to my C# web service to do CRUD transactions. As the mobile application is always on the go, and there might not have internet connectivity in all situations.
Therefore, I'm thinking of using SMS transactions in offline mode.
- Using sms, communicate to server to request for access token.
- Token generated and sent using SMS to registered user phone number
- User then enter the OTP within 5mins of validity
- App will then communicate with server with the OTP, once verified, user will go into a special user interface for offline access instead.
- Phone sends a sms to the 3G Dongle (Unique Session Token, UserID, Type Of Transaction, Transaction Details)
- SMS server received sms message
- Application which handles sms message, stores message received in a message queue
- Application will dequeue message queue and process the oldest message first
There are a few questions in which I would love to have some pointers in:
- How do I maintain a unique session using SMS? (Token?)
- How do I maintain security? (As in the text message is of course, unreadable by humans, yet can't be duplicated and workable for that transaction only)
I would be doing all of the above by own codes/libraries without using external cloud/web services as it's more for an internal corporation project.
I'm thinking of using 'counters', where my text message body would have a counter inside it.
For example: App Counter: 1 Server Counter: 0
1.App sends a transaction request.(App counter: 1)
2.Server decrypts and checks counter. (Since 1 > 0, allow request and increment server counter to 1)
In this case, even there is an duplicate text message sent by user, the message will not process as the counter is now 1. (1 > 1 will return false).
Apart from multiple users accessing the same account and messing up the counters, what concerns should I take note of?