Provisioning methods and apparatus for wireless local area networks (WLANS) with use of a provisioning ESSID

• US 8,032,174 B2
• Filed: 12/15/2006
• Issued: 10/04/2011
• Est. Priority Date: 07/07/2006
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Nagy, Thomas Charles, Kezys, Vytautas Robertas
• Primary Examiner(s): Afshar; Kamran
• Assistant Examiner(s): MATHARU, MANPREET S
• Application Number:
  US11/611,293
• Publication Number:
  US 20080040486A1
• Time in Patent Office: 1,754 Days
• Field of Search: 455/432, 455/455, 455/436, 455/445, 455/552.1, 455/410, 455/411, 455/435, 370/338, 370/401
• US Class Current: 455/552.1
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 12/73 Access point logical identity
• CPC Class Codes: H04W 8/18 Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

Methods and apparatus for use in provisioning mobile communication devices in wireless local area networks (WLANs) are described. A mobile communication device associates with a wireless access point of a provisioning virtual local area network (VLAN) of the network with use of a provisioning network identifier (“provisioning ESS1D”). After associating with the wireless access point of the provisioning VLAN, a primary network identifier (“primary ESSID”) associated with a primary VLAN of the network is received from the WLAN in a provisioning procedure and stored in memory of the mobile device after authentication. For subsequent communications with the WLAN, the mobile device associates with a wireless access point of the primary VLAN of the network with use of the primary network identifier.

Claims

1. A method in a mobile communication device for use in programming a primary extended service set identifier (ESSID) of a wireless local area network (WLAN) in a network list maintained in memory of the mobile device, the WLAN including a primary virtual local area network (VLAN) which provides one or more communication services and a provisioning VLAN which provides a provisioning service but disallows the one or more communication services, the method comprising the acts of:

associating, by the mobile device, with a wireless access point of the WLAN by sending a request which includes a provisioning ESSID that is uniquely associated with the WLAN, for accessing and operating in the provisioning VLAN;

while being associated with the wireless access point from use of the provisioning ESSID, sending, from the mobile device, authentication information, via the wireless access point, to the WLAN in an authentication procedure with the provisioning VLAN;

if the authentication procedure is successful, then;

receiving, at the mobile device via the wireless access point, the primary ESSID in a provisioning procedure with the provisioning VLAN;

programming, by the mobile device, the primary ESSID in the network list maintained in the memory of the mobile device; and

for each one of a plurality of subsequent associations with a wireless access point of the WLAN;

associating, by the mobile device, with the wireless access point by sending a request which includes the primary ESSID from the network list instead of the provisioning ESSID, for accessing and operating in the primary VLAN for the one or more communication services.

2. The method of claim 1, wherein the provisioning ESSID comprises all or part of a domain name of the WLAN.

3. The method of claim 1, wherein the mobile communication device is operative in accordance with IEEE 802.11 for communications with the WLAN.

4. The method of claim 1, further comprising:

if the authentication procedure fails, then failing to receive the primary ESSID for association with the wireless access point for accessing and operating in the primary VLAN for the one or more communication services.

5. The method of claim 1, further comprising:

receiving, via a user interface of the mobile communication device, an email address used for sending and receiving e-mail messages with the mobile communication device; and

,

deriving the provisioning ESSID based on all or part of a domain name extracted from the e-mail address.

6. The method of claim 1, comprising the further acts of:

while being associated with the wireless access point from use of the provisioning ESSID, receiving an IP address which is assigned to the mobile device for establishing layer-3 communications with the WLAN;

sending the authentication information in the authentication procedure with the provisioning VLAN after the layer-3 communications have been established.

7. The method of claim 1, wherein the authentication procedure comprises a login procedure in the provisioning VLAN, and wherein the authentication information comprises a password.

8. The method of claim 1, further comprising:

receiving, via a user interface of the mobile communication device, a domain name corresponding to the WLAN; and

deriving the provisioning ESSID based on the domain name received via the user interface.

9. A mobile communication device operative to communicate in a wireless local area network (WLAN) including a primary virtual local area network (VLAN) which provides one or more communication services and a provisioning VLAN which provides a provisioning service but disallows the one or more communication services, the mobile communication device comprising:

one or more processors;

a wireless transceiver coupled to the one or more processors;

memory coupled to the one or more processors;

the one or more processors being operative to;

associate, via the wireless transceiver, with a wireless access point of the WLAN by sending a request which includes a provisioning extended service set identifier (ESSID) that is uniquely associated with the WLAN, for accessing and operating in the provisioning VLAN;

while being associated with the wireless access point from use of the provisioning ESSID;

cause authentication information to be transmitted, from the mobile device via the wireless transceiver, through the wireless access point, to the WLAN in an authentication procedure with the provisioning VLAN;

if the authentication procedure is successful, then;

receive, through the wireless access point via the wireless transceiver, a primary ESSID in a provisioning procedure with the provisioning VLAN;

program the primary ESSID in a network list which is maintained in the memory of the mobile device; and

for subsequent communications with a wireless access point of the WLAN;

associate, by the mobile device via the wireless transceiver, with the wireless access point by sending a request which includes the primary ESSID from the network list instead of the provisioning ESSID, for accessing and operating in the primary VLAN for the one or more communication services.

10. The mobile communication device of claim 9, wherein the one or more processors is further operative to:

prior to receiving and storing the primary network identifier;

if the authentication procedure fails, fail to receive the primary ESSID for association with the wireless access point for accessing and operating in the primary VLAN for the one or more communication services.

11. The mobile communication device of claim 9, wherein the one or more processors are further operative to:

while being associated with the wireless access point from use of the provisioning ESSID, receive an IP address which is assigned to the mobile device for establishing layer-3 communications with the WLAN;

send the authentication information in the authentication procedure with the provisioning VLAN after the layer-3 communications have been established.

12. The mobile communication device of claim 9, wherein the authentication procedure comprises a login procedure with the provisioning VLAN, and wherein the authentication information comprises a password.

13. The mobile communication device of claim 9, which is operative in accordance with IEEE 802.11 communications.

14. A method in a wireless local area network (WLAN) for use in programming an extended service set identifier (ESSID) in a network list maintained in memory of a mobile communication device, the WLAN including a primary virtual local area network (VLAN) which provides one or more communication services and a provisioning VLAN which provides a provisioning service but disallows the one or more communication services, the method comprising the acts of:

providing a wireless access point in the WLAN for receiving, from the mobile communication device, a request which includes a provisioning ESSID that is uniquely associated with the WLAN, so that the mobile communication device may associate with the wireless access point for access and operation in the provisioning VLAN of the WLAN;

while the mobile communication device is associated with the wireless access point from use of the provisioning ESSID, receiving, in the WLAN via the wireless access point, authentication information from the mobile communication device in an authentication procedure of the provisioning VLAN;

if the authentication procedure is successful, then causing a primary ESSID to be sent from the WLAN to the mobile communication device via the wireless access point in a provisioning procedure with the provisioning VLAN, for programming the primary ESSID in the network list maintained in the memory of the mobile communication device; and

for subsequent associations by the mobile communication device;

receiving, from the mobile communication device, a request which includes the primary ESSID instead of the provisioning ESSID, so that the mobile communication device may associate with the wireless access point for access and operation in the primary VLAN for the one or more communication services.

15. The method of claim 14, wherein the provisioning ESSID comprises all or part of a domain name of the WLAN.

16. The method of claim 14, wherein the authentication procedure comprises a login procedure with the provisioning VLAN, and wherein the authentication information comprises a password.

17. The method of claim 14, wherein the WLAN is operative in accordance with IEEE 802.11 communications.

18. A wireless local area network (WLAN) including a primary virtual local area network (VLAN) which provides one or more communication services and a provisioning VLAN which provides a provisioning service but disallows the one or more communication services, the WLAN comprising:

at least one wireless access point operative to receive, from the mobile communication device, a request which includes a provisioning extended service set identifier (ESSID) that is uniquely associated with the WLAN, so that the mobile communication device may associate with the wireless access point for access and operation in the provisioning VLAN of the WLAN;

the WLAN being operative to receive, via the wireless access point, while the mobile communication device is associated with it from use of the provisioning ESSID, authentication information from the mobile communication device in an authentication procedure of the provisioning VLAN and, if the authentication procedure is successful, cause a primary ESSID to be sent from the WLAN to the mobile communication device in a provisioning procedure with the provisioning VLAN for programming the primary ESSID in a network list maintained in memory of the mobile communication device; and

the at least one wireless access point being further operative to receive, for subsequent associations with the mobile communication device, a request which includes the primary ESSID instead of the provisioning ESSID, so that the mobile communication device may associate with the wireless access point for access and operation in the primary VLAN of the WLAN for the one or more communication services.

19. The WLAN of claim 18, wherein the provisioning ESSID comprises all or part of a domain name of the WLAN.

20. The WLAN of claim 18, wherein the at least one wireless access point is operative in accordance with IEEE 802.11 communications.

21. The WLAN of claim 18, wherein the authentication procedure comprises a login procedure with the provisioning VLAN, and wherein the authentication information comprises a password.