Provisioning methods and apparatus with use of a provisioning ESSID derived from both predetermined criteria and network-specific criteria

• US 8,023,994 B2
• Filed: 12/15/2006
• Issued: 09/20/2011
• Est. Priority Date: 07/07/2006
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Dunk, Craig A., Nagy, Thomas Charles, Kezys, Vytautas Robertas, Robertson, Ian
• Primary Examiner(s): Afshar; Kamran
• Assistant Examiner(s): Matharu; Manpreet S
• Application Number:
  US11/611,274
• Publication Number:
  US 20080148359A1
• Time in Patent Office: 1,740 Days
• Field of Search: 455/552.1, 455/432, 455/455, 455/436, 455/445, 455/3.04, 455/455.2, 370/338
• US Class Current: 455/552.1
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 12/73 Access point logical identity
• CPC Class Codes: H04W 8/18 Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

Methods and apparatus for use in provisioning mobile communication devices in wireless local area networks (WLANs) are described. In one illustrative example, a provisioning network identifier (“provisioning ESSID”) is derived based on both predetermined provisioning criteria (e.g. a fixed alphanumeric string) and network-specific criteria associated with a WLAN (eg a network domain name). The mobile device associates with a wireless access point of a provisioning virtual local area network (VLAN) of the network with use of the provisioning network identifier. After associating with the wireless access point with the provisioning network identifier, a primary network identifier (“primary ESSID”) associated with a primary VLAN of the network is received from the WLAN in a provisioning procedure and stored in memory of the mobile device after authentication. For subsequent communications with the WLAN, the mobile device associates with a wireless access point of the primary VLAN of the network with use of the primary network identifier. The technique of deriving an ESSID may alternatively be utilized in producing a primary ESSID of the WLAN.

Claims

1. A method in a mobile communication device for use in programming a primary extended service set identifier (ESSID) of a wireless local area network (WLAN) in memory of the mobile communication device, the method comprising the acts of:

performing, in the mobile communication device, a predetermined algorithm with use of both predetermined provisioning criteria and a domain name of the WLAN, for creating a provisioning ESSID that is unique to the WLAN and includes at least a portion of the domain name of the WLAN;

storing the provisioning ESSID in memory;

associating with a wireless access point of the WLAN with use of the provisioning ESSID;

while being associated with the wireless access point from use of the provisioning ESSID, causing authentication information of an authentication procedure to be transmitted, via the wireless access point, to the WLAN;

if the authentication procedure is successful, then;

performing a programming procedure with the WLAN which includes receiving, via the wireless access point, the primary ESSID from the WLAN and programming the primary ESSID in the memory;

for each one of a plurality of subsequent associations with a wireless access point of the WLAN;

associating with the wireless access point with use of the primary ESSID instead of the provisioning ESSID; and

otherwise, if the authentication procedure is unsuccessful, then failing to receive and program the primary ESSID in the memory.

2. The method of claim 1, wherein the mobile communication device is operative in accordance with IEEE 802.11 for communications with the WLAN.

3. The method of claim 1, wherein the predetermined provisioning criteria comprises an alphanumeric string which becomes part of the provisioning ESSID created by performing the predetermined algorithm.

4. The method of claim 1, wherein the predetermined provisioning criteria comprise an alphanumeric string.

5. The method of claim 1, wherein the predetermined provisioning criteria comprises an alphanumeric string and the predetermined algorithm comprises an appending algorithm configured to append the alphanumeric string to the at least portion of the domain name.

6. The method of claim 1, wherein the predetermined provisioning criteria comprises an alphanumeric string and the predetermined algorithm comprises a character interleaving algorithm configured to interleave the alphanumeric string with the at least portion of the domain name.

7. The method of claim 1, wherein the act of associating with the wireless access point with use of the provisioning ESSID comprises the further act of associating with the wireless access point of a provisioning virtual local area network (VLAN) of the WLAN, and wherein the act of associating with the wireless access point with use of the primary ESSID comprises the further act of associating with the wireless access point of a primary VLAN of the WLAN.

8. The method of claim 1, wherein the domain name is received as user input information at a user interface of the mobile communication device.

9. The method of claim 1, further comprising:

receiving, at a user interface of the mobile communication device, an e-mail address;

extracting the at least portion of the domain name from the e-mail address; and

wherein the extracted domain name is used in performing the predetermined algorithm for creating the provisioning ESSID.

10. The method of claim 1, which is performed in accordance with computer instructions stored in a computer readable medium which are executable by one or more processors in the mobile communication device.

11. A mobile communication device configured to assist in being programmed with an extended service set identifier (ESSID) of a wireless local area network (WLAN), the mobile communication device comprising:

one or more processors;

a wireless transceiver coupled to the one or more processors;

memory coupled to the one or more processors;

the one or more processors being operative to;

perform a predetermined algorithm with use of both predetermined provisioning criteria and the domain name of the WLAN, for creating a provisioning ESSID that is unique to the WLAN and includes at least a portion of the domain name of WLAN;

storing the provisioning ESSID in the memory;

associate, via the wireless transceiver, with a wireless access point of the WLAN with use of the provisioning ESSID;

while being associated with the wireless access point from use of the provisioning ESSID, cause authentication procedure to be transmitted, via the wireless transceiver, to the WLAN;

if the authentication procedure is successful, then;

perform a programming procedure with the WLAN which includes receiving, through the wireless transceiver, a primary ESSID from the WLAN via the wireless access point and programming the primary ESSID in the memory;

for each one of a plurality of subsequent associations with a wireless access point of the WLAN;

associate, via the wireless transceiver, with the wireless access point of the WLAN with use of the primary ESSID instead of the provisioning ESSID; and

otherwise, if the authentication procedure is unsuccessful, then fail to receive and program the primary ESSID in the memory.

12. The mobile communication device of claim 11, wherein the predetermined provisioning criteria comprise an alphanumeric string.

13. The mobile communication device of claim 11, wherein the predetermined provisioning criteria comprise an alphanumeric string which becomes part of the primary ESSID created by performing the predetermined algorithm.

14. The mobile communication device of claim 11, which further comprises a user interface, and wherein the one or more processors are further operative to:

receive, at the user interface, an e-mail address;

extract the at least portion of the domain name from the e-mail address; and

wherein the extracted domain name is used in performing the predetermined algorithm for creating the provisioning ESSID.

15. The mobile communication device of claim 11, wherein the one or more processors are further operative to associate with a wireless access point of the WLAN with use of the provisioning ESSID by associating with a wireless access point of a provisioning virtual local area network (VLAN) of the network, and wherein the one or more processors are further operative to associate with a wireless access point of the WLAN with use of the primary ESSID by associating with a wireless access point of a primary VLAN of the WLAN.

16. The mobile communication device of claim 11, wherein the domain name is received as user input information at a user interface of the mobile communication device.

17. A method in a wireless local area network (WLAN) for use in programming an extended service set identifier (ESSID) of the WLAN in a mobile communication device, the method comprising the acts of:

providing a wireless access point in the WLAN to allow the mobile communication device to associate with it with use of a provisioning ESSID;

wherein the provisioning ESSID is created by performing, in the WLAN, a predetermined algorithm with use of both predetermined provisioning criteria and a domain name of the WLAN, such that the provisioning ESSID is unique to the WLAN and includes at least a portion of the domain name of the WLAN;

while the mobile communication device is associated with the wireless access point from use of the provisioning ESSID, receiving, from the mobile communication device via the wireless access point, authentication information of an authentication procedure with the mobile communication device;

if the authentication procedure is successful, then;

causing a primary ESSID to be sent, from the WLAN via the wireless access point, in a provisioning procedure for programming in the mobile communication device;

for each one of a plurality of subsequent associations with the mobile communication device;

providing a wireless access point in the WLAN to allow the mobile communication device to associate with it with use of the primary ESSID instead of the provisioning ESSID; and

if the authentication procedure is unsuccessful, then refraining from sending the primary ESSID from the WLAN for programming in the mobile communication device.

18. The method of claim 17, wherein the WLAN is operative in accordance with IEEE 802.11.

19. The method of claim 17, wherein the predetermined provisioning criteria comprise an alphanumeric string which becomes part of the provisioning ESSID created by performing the predetermined algorithm.

20. The method of claim 17, wherein the predetermined provisioning criteria comprise an alphanumeric string and the predetermined algorithm comprises an appending algorithm configured to append the alphanumeric string to the at least portion of the domain name.

21. The method of claim 17, wherein the network-specific criteria comprise an alphanumeric string and the predetermined algorithm comprises a character interleaving algorithm configured to interleave the alphanumeric string with the at least portion of the domain name.

22. The method of claim 17, wherein the provisioning ESSID includes the entire domain name of the WLAN.

23. The method of claim 17, which is performed in accordance with computer instructions stored in a computer readable medium by a server in the WLAN.

24. A wireless local area network (WLAN) configured to provide a primary virtual local area network (VLAN) which is associated with a primary extended service set identifier (ESSID) and a provisioning VLAN which is associated with a provisioning ESSID, the WLAN comprising:

a provisioning server of the provisioning VLAN;

at least one wireless access point of the WLAN;

the at least one wireless access point being operative to;

allow a mobile communication device to associate with it with use of the provisioning ESSID;

wherein the provisioning ESSID is created by performing, in the WLAN, a predetermined algorithm with use of both predetermined provisioning criteria and a domain name of the WLAN, such that the provisioning ESSID is unique to the WLAN and includes at least a portion of the domain name of the WLAN;

while the mobile communication device is associated with the wireless access point from use of the provisioning ESSID, receive, from the mobile communication device, authentication information of an authentication procedure;

if the authentication procedure is successful, then;

cause the primary ESSID to be transmitted to the mobile communication device in a provisioning procedure for programming in the mobile communication device;

for each one of plurality of subsequent associations with the mobile communication device;

allow the mobile communication device to associate with it with use of the primary ESSID instead of the provisioning ESSID; and

if the authentication procedure is unsuccessful, then refrain from transmitting the primary ESSID to the mobile communication device for programming in the mobile communication device.

25. The WLAN of claim 24, wherein the predetermined provisioning criteria comprise an alphanumeric string which becomes part of the provisioning ESSID created by performing the predetermined algorithm.

26. The WLAN of claim 24, wherein the predetermined provisioning criteria comprise an alphanumeric string and the predetermined algorithm comprises an appending algorithm configured to append the alphanumeric string to the at least portion of the domain name.

27. The WLAN of claim 24, wherein the provisioning ESSID includes the entire domain name of the WLAN.