Using SMS as transaction in offline situations

Question

Currently, I have this hybrid mobile application which talks to my C# web service to do CRUD transactions. As the mobile application is always on the go, and there might not have internet connectivity in all situations.

Therefore, I'm thinking of using SMS transactions in offline mode.

For Login:

1. Using sms, communicate to server to request for access token.
2. Token generated and sent using SMS to registered user phone number
3. User then enter the OTP within 5mins of validity
4. App will then communicate with server with the OTP, once verified, user will go into a special user interface for offline access instead.

For Transactions:

1. Phone sends a sms to the 3G Dongle (Unique Session Token, UserID, Type Of Transaction, Transaction Details)
2. SMS server received sms message
3. Application which handles sms message, stores message received in a message queue
4. Application will dequeue message queue and process the oldest message first

There are a few questions in which I would love to have some pointers in:

1. How do I maintain a unique session using SMS? (Token?)
2. How do I maintain security? (As in the text message is of course, unreadable by humans, yet can't be duplicated and workable for that transaction only)

I would be doing all of the above by own codes/libraries without using external cloud/web services as it's more for an internal corporation project.

Update:

I'm thinking of using 'counters', where my text message body would have a counter inside it.

For example: App Counter: 1 Server Counter: 0

1.App sends a transaction request.(App counter: 1)

2.Server decrypts and checks counter. (Since 1 > 0, allow request and increment server counter to 1)

In this case, even there is an duplicate text message sent by user, the message will not process as the counter is now 1. (1 > 1 will return false).

Apart from multiple users accessing the same account and messing up the counters, what concerns should I take note of?

Answer 1

Wow! It's good to read your scenario. Hmmm If I may suggest, I aggree with 1.) Unique session via token, a token from your c# app with the mobile number tagged on it. For number 2.) Yes it's achievable based from 1.) checked the mobile number who requested your c# app who's already tagged with token. Even if someone has duplicated token or whatever , you already tagged the original mobile number requested the app.