Authenticating a user of a communication device to a wireless network to which the user is not associated with

• US 8,677,125 B2
• Filed: 03/31/2005
• Issued: 03/18/2014
• Est. Priority Date: 03/31/2005
• Status: Active Grant

• Current Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Original Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Inventors: Brok, Jacco, Van Bemmel, Jeroen
• Primary Examiner(s): Yalew, Fikremariam A
• Application Number:
  US11/095,957
• Publication Number:
  US 20060236105A1
• Time in Patent Office: 3,274 Days
• Field of Search: None
• US Class Current: 713/169
• CPC Class Codes: H04L 63/0838 using one-time-passwords
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/50 Secure pairing of devices
• CPC Class Codes: H04W 74/00 Wireless channel access
• CPC Class Codes: H04W 76/10 Connection setup
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

The present invention provides a method and an apparatus for automating authentication of a user. In one embodiment, a method calls for detecting an authentication event at a wireless communication device to gain access to a first wireless network through an access point associated with the first wireless network, automatically obtaining a credential from a second wireless network in response to the authentication event, and authenticating the user based on the credential to establish a connection between the wireless communication device and the first wireless network. A client-server based communication system includes a client module at a wireless communication device for user authentication of a Wi-Fi device to a Wi-Fi network through an access point associated therewith. For the purposes of authentication, the client-server based communication system further includes a server module with which the client module may automatically exchange short message service messages over a wide area network.

Claims

1. A method for authentication of a user of a wireless communication device, the method comprising:

transmitting, from the wireless communication device, a request to gain access to a first wireless network through an access point associated with said first wireless network over a first air interface between the wireless communication device and the access point, the request being transmitted to a second wireless network over a second air interface between the wireless communication device and a base station in the second wireless network;

receiving, at the wireless communication device in response to transmitting the request, a credential transmitted from the second wireless network over the second air interface, the credential being obtained from an authentication server and provided to the second wireless network for transmission to the wireless communication device over the second air interface, wherein the credential includes information that authenticates the user to the first wireless network; and

authenticating said user to establish a connection between said wireless communication device and said first wireless network over the first air interface, said authentication being performed using the credential and a password known to the user and the authentication server.

2. The method, as set forth in claim 1, wherein said first wireless network comprises a Wi-Fi network and said second wireless network comprises a wide area network, and wherein transmitting the request to the second wireless network comprises:

automatically transmitting the request to the wide area network over the second air interface automatically obtain said credential for authenticating said user to the Wi-Fi network in response to the wireless communication device entering a hotspot of the Wi-Fi network.

3. The method, as set forth in claim 2, further comprising:

in response to transmitting the request, receiving said credential in a reply message from said wide area network over the second air interface.

4. The method, as set forth in claim 3, wherein receiving the credential from the second wireless network further comprises:

receiving an access token including a security identifier of the user that authenticates the user to the first wireless network.

5. The method, as set forth in claim 4, further comprising:

automatically submitting said access token to said access point over the first air interface to access a Wi-Fi hotspot.

6. The method, as set forth in claim 3, wherein automatically sending a request message further comprising:

sending a short message service message over the second air interface said wide area network to request the access token so that the wireless communication device can use the access token to login onto said Wi-Fi network.

7. The method, as set forth in claim 6, wherein receiving said credential in a reply message further comprising:

in response to said short message service message, receiving said access token in a return short message service message over the second air interface.

8. The method, as set forth in claim 7, wherein transmitting the request comprises transmitting the request in response to:

detecting a link-layer authentication signal that initiates a Wi-Fi authentication process for login onto a Wi-Fi network for a modem at said wireless communication device; and

using the first air interface from said wireless communication device to a wireless local area network to detect a web-based page.

9. The method, as set forth in claim 8, wherein using the first air interface further comprising:

in response to said short message service message, receiving from said wide area network said access token with a password in said return short message service message over the second air interface;

causing a client module at said wireless communication device to communicate with a server module associated with an operator of said wide area network to authenticate said user based on said access token; and

enabling said user to login into said Wi-Fi network at least one-time by transmitting said password over the first air interface.

10. The method, as set forth in claim 3, wherein automatically sending a request message further comprising:

using a packet-based data connection capable of exchanging Internet protocol data packets to send said request message to a server over the second air interface to said wide area network.

21. The method of claim 1, wherein receiving the credential comprises receiving an electronic certificate that is recognized as proof of the user'"'"'s identity and a security level.

22. The method of claim 1, wherein receiving the credential comprises receiving a set of access permissions with media independent data attesting to the identity of the user or establishing the identity of the user.

11. A client-server based communication system to automate authentication of a user to a first wireless network, said client-server based communication system associated with a second wireless network comprising:

a client including a storage storing instructions for detecting an authentication event at a wireless communication device to gain access to said first wireless network through an access point associated with said first wireless network over a first air interface between the wireless communication device and the access point, in response to said authentication event, automatically obtaining a credential from said second wireless network over a second air interface between the wireless communication device and a base station in the second wireless network, wherein the credential includes information that authenticates the user to the first wireless network, and authenticating said user based on said credential and a password known to the user to establish a connection between said wireless communication device and said first wireless network over the first air interface; and

a server adapted to communicate with said client for an operator, said server including a storage storing instructions to automatically authenticate said user to said first wireless network in response to said authentication event by providing said credential in a signaling session with said client over said second wireless network for connecting said wireless communication device to said first wireless network over the first air interface, the server also using the password known to the user to authenticate the user.

12. The client-server based communication system, as set forth in claim 11, wherein said client storage stores further instructions for said client to signal said second wireless network including a wide area network over the second air interface to automatically send a request message over the second air interface to said wide area network to obtain said credential for authenticating said user to said first wireless network including a Wi-Fi network.

13. The client-server based communication system, as set forth in claim 12, wherein said client storage stores further instructions for said client to receive said credential in a reply message over the second air interface from said wide area network in response to said request message.

14. The client-server based communication system, as set forth in claim 13, wherein said client storage stores further instructions for said client to request an access token in said request message over the second air interface within a signaling session of said wireless communication device and said wide area network.

15. The client-server based communication system, as set forth in claim 14, wherein said client storage stores further instructions for said client to extract said access token from said reply message and automatically submit said access token to said access point over the first air interface to access a Wi-Fi hotspot associated with said Wi-Fi network.

23. The client-server based communication system of claim 11, wherein the credential comprises an electronic certificate that is recognized as proof of the user'"'"'s identity and a security level.

24. The client-server based communication system of claim 11, wherein the credential comprises a set of access permissions with media independent data attesting to the identity of the user or establishing the identity of the user.

16. A client in a client-server based communication system to automate authentication of a user to a first wireless network, said client associated with a second wireless network comprising:

a controller; and

a storage coupled to said controller, said storage storing instructions for detecting an authentication event at a wireless communication device to gain access to said first wireless network through an access point associated with said first wireless network over a first air interface between the wireless communication device and the access point, in response to said authentication event, automatically obtain over a second air interface between the wireless communication device and a base station in the second wireless network a credential from said second wireless network that receives said credential from an authentication server, wherein the credential includes information that authenticates the user to the first wireless network, and authenticate said user based on said credential and a password known to the user and the authentication server to establish a connection between said wireless communication device and said first wireless network over the first air interface.

17. The client, as set forth in claim 16, wherein said client is being defined at least in part by an Institute of Electrical and Electronics Engineers 802.11x standard.

18. The client, as set forth in claim 16, wherein said client further comprises:

a transceiver including a modem to;

detect a link-layer authentication signal that initiates a Wi-Fi authentication process for login onto said first wireless network including a Wi-Fi network;

send a short message service message to a server over the second air interface with the wide area network; and

receive an access token in a return short message service message transmitted over the second air interface in response to said short message service message.

19. The client, as set forth in claim 18, wherein said transceiver uses the first air interface to detect a web-based page.

20. The client, as set forth in claim 19, wherein said modem to receive from said wide area network said access token with a password in said return short message service message in response to said short message service message, cause a client module at said wireless communication device to communicate with a server module associated with an operator of said wide area network to authenticate said user based on said access token, and enable said user to login into said Wi-Fi network at least one-time based on said password.

25. The client, as set forth in claim 19, wherein the credential comprises an electronic certificate that is recognized as proof of the user'"'"'s identity and a security level.

26. The client, as set forth in claim 19, wherein the credential comprises a set of access permissions with media independent data attesting to the identity of the user or establishing the identity of the user.