WIRELESS CONNECTIONS TO A WIRELESS ACCESS POINT

• US 20110167263A1
• Filed: 01/06/2010
• Published: 07/07/2011
• Est. Priority Date: 01/06/2010
• Status: Active Grant

• Current Assignee: Kyndryl Incorporated
• Original Assignee: International Business Machines Corporation
• Inventors: Takahashi, Takehiro, Dewey, David B., Cross, Thomas J.
• Granted Patent: US 9,197,420 B2
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A method and apparatus for establishing a wireless connection. A digital certificate having a second name is obtained by a processor unit in response to receiving a selection of a network using a first name broadcast by a wireless access point. A determination is made by the processor unit as to whether the digital certificate is valid. A determination is made by the processor unit as to whether the second name in the digital certificate matches the first name broadcast by the wireless access point. The processor unit establishes the wireless connection to the wireless access point in response to the digital certificate being valid and the second name in the digital certificate matching the first name broadcast by the wireless access point.

Claims

1. A method for establishing a wireless connection, the method comprising:

responsive to receiving a selection of a network using a first name broadcast by a wireless access point, obtaining, by a processor unit, a digital certificate having a second name;

determining, by the processor unit, whether the digital certificate is valid;

determining, by the processor unit, whether the second name in the digital certificate matches the first name broadcast by the wireless access point; and

responsive to the digital certificate being valid and the second name in the digital certificate matching the first name broadcast by the wireless access point, establishing, by the processor unit, the wireless connection to the wireless access point.

2. The method of claim 1 further comprising:

exchanging, by the processor unit, information with the network using the wireless connection established with the wireless access point.

3. The method of claim 1, wherein the step of determining, by the processor unit, whether the digital certificate is valid comprises:

determining, by the processor unit, whether a digital signature in the digital certificate is signed by a trusted certificate authority.

4. The method of claim 1, wherein the step of determining, by the processor unit, whether the digital certificate is valid comprises:

determining, by the processor unit, whether the digital certificate matches one of a number of digital certificates previously identified as being valid.

5. The method of claim 1, wherein the step of determining, by the processor unit, whether the digital certificate is valid comprises:

requesting, by the processor unit, a user input as to whether to trust the digital certificate.

6. The method of claim 1, wherein the step of establishing, by the processor unit, the wireless connection to the wireless access point comprises:

generating, by the processor unit, a session key for the wireless connection using the digital certificate; and

exchanging, by the processor unit, information with a server using the session key to encrypt and decrypt the information.

7. The method of claim 1, wherein the first name is a service set identifier.

8. The method of claim 1, wherein the second name is a domain name.

9. The method of claim 1, wherein the wireless connection is an encrypted wireless connection.

10. The method of claim 1, wherein the network is a wireless network specified by IEEE 802.11 standards.

11. A method for establishing a wireless connection, the method comprising:

broadcasting, by a wireless access point, a name;

responsive to a first request for authentication from a client, sending, by a processor unit, through the wireless access point, a digital certificate including the name; and

establishing, by the processor unit, through the wireless access point, the wireless connection with the client in response to a second request from the client to establish the wireless connection received after sending the digital certificate.

12. The method of claim 11, wherein the step of establishing, by the processor unit, the wireless connection with the client in response to the second request from the client to establish the wireless connection received after sending the digital certificate comprises:

generating, by the processor unit, a session key for the wireless connection using the digital certificate; and

exchanging, by the processor unit, information with the client using the session key to encrypt and decrypt the information.

13. A computer comprising:

a bus;

a storage device connected to the bus;

a processor unit connected to the bus; and

program code stored on the storage device, for execution by the processor to obtain a digital certificate having a second name in response to receiving a selection of a network using a first name broadcast by a wireless access point, determine whether the digital certificate is valid, determine whether the second name in the digital certificate matches the first name broadcast by the wireless access point, and establish a wireless connection to the wireless access point using the digital certificate in response to the digital certificate being valid and the second name in the digital certificate matching the first name broadcast by the wireless access point.

14. The computer of claim 13, wherein the program code is also executable by the processor to exchange information with the network using the wireless connection established with the wireless access point.

15. The computer of claim 13, wherein the program code determines whether the digital certificate is valid by determining whether a digital signature in the digital certificate is signed by a trusted certificate authority to determine whether the digital certificate is valid.

16. The computer of claim 13, wherein the program code determines whether the digital certificate is valid by determining whether the digital certificate matches one of a number of digital certificates previously identified as being valid.

17. The computer of claim 13 wherein the program code determines whether the digital certificate is valid by requesting user input as to whether to trust the digital certificate.

18. The computer of claim 13, wherein the program code establishes the wireless connection to the wireless access point by generating a session key for the wireless connection using the digital certificate;

and exchange information with a server using the session key to encrypt and decrypt the information.

19. The computer of claim 13, wherein the first name is a service set identifier.

20. The computer of claim 13, wherein the second name is a domain name.

21. A computer program product comprising:

a computer readable storage medium;

first program code, stored on the computer readable storage medium, responsive to receiving a selection of a network using a first name broadcast by a wireless access point, for obtaining a digital certificate having a second name;

second program code, stored on the computer readable storage medium, for determining whether the digital certificate is valid;

third program code, stored on the computer readable storage medium, for determining whether the second name in the digital certificate matches the first name broadcast by the wireless access point; and

fourth program code, stored on the computer readable storage medium, responsive to the digital certificate being valid and the second name in the digital certificate matching the first name broadcast by the wireless access point, for establishing a wireless connection to the wireless access point using the digital certificate.

22. The computer program product of claim 21 further comprising:

fifth program code, stored on the computer readable storage medium, for exchanging information with the network using the wireless connection established with the wireless access point.

23. The computer program product of claim 21, wherein the second program code comprises:

program code, stored on the computer readable storage medium, for determining whether a digital signature in the digital certificate is signed by a trusted certificate authority to determine whether the digital certificate is valid.

24. The computer program product of claim 21, wherein the second program code comprises:

program code, stored on the computer readable storage medium, for determining whether the digital certificate matches one of a number of digital certificates previously identified as being valid.

25. The computer program product of claim 21, wherein the second program code comprises:

program code, stored on the computer readable storage medium, for requesting a user input as to whether to trust the digital certificate.