Dynamic account creation with secured hotspot network

• US 9,131,373 B2
• Filed: 09/16/2011
• Issued: 09/08/2015
• Est. Priority Date: 09/16/2010
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Technologies Oy (Nokia Corporation)
• Inventors: Patil, Basavaraj, Bajko, Gabor
• Primary Examiner(s): RAHIM, MONJUR
• Application Number:
  US13/234,906
• Publication Number:
  US 20120072976A1
• Time in Patent Office: 1,453 Days
• Field of Search: 726/6
• US Class Current: 1/1
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 48/14 using user query or user detection

Abstract

A secure network access point transmits a beacon transmission. A user device receiving it determines it does not have credentials necessary to attach with the secure network access point, and so a preliminary association is formed between the user device and the secure network access point. During the preliminary association, the user device receives or creates credentials necessary to associate with the secure network access point, forms an association with the secure network access point using the received or created credentials, and obtains internet connectivity via the secure network access point. In this embodiment there is only the secure network access point, but in another embodiment there is also a non-secure network access point which transmits a beacon using the same SSID as the secure network access point, and the preliminary association is with the non-secure network access point.

Claims

1. An apparatus comprising:

at least one processor; and

at least one memory including computer program code;

in which the at least one memory with the computer program code is configured with the at least one processor to cause the apparatus at least to;

receive a beacon transmission from a secure network access point, where the beacon advertises a service set identifier (SSID);

in response to determining that the apparatus does not have credentials necessary to attach with the secure network access point, form a preliminary association with the secure network access point using the advertised SSID;

during the preliminary association, receive or create credentials necessary to associate with the secure network access point; and

form an association with the secure network access point using the received or created credentials and the advertised SSID, and obtain interne connectivity via the secure network access point.

2. The apparatus according to claim 1, in which the at least one memory with the computer program code is configured with the at least one processor to further cause the apparatus at least to:

send http traffic towards the secure network access point during the preliminary association; and

form a secure http connection with a portal page to which the apparatus is redirected in response to sending the http traffic;

in which the apparatus is configured to receive or create the credentials necessary to form the association with the secure network access point while in the secure http connection with the portal page.

3. The apparatus according to claim 2, where when connected with the portal page a user is enabled to select via the apparatus either manual or automatic credential generation.

4. The apparatus according to claim 3, where with the automatic credential generation the apparatus receives from the portal page the generated credentials which comprise one of a username, a password and a client certificate;

the apparatus is configured to store the received credentials in the at least one memory, and the apparatus is configured to automatically provide the stored credentials to the secure network access point without requiring that the user be aware of content of the credentials.

5. The apparatus according to claim 1, in which the beacon received from the secure network access point indicates that the secure network access point supports on-line sign-up.

6. The apparatus according to claim 1, in which the at least one memory with the computer program code is configured with the at least one processor to further cause the apparatus at least to:

while the apparatus is in a pre-associated state, send a request for a sign-up network access identifier NAI to the secure network access point;

receive the requested sign-up network access identifier; and

thereafter

form the preliminary association with the secure network access point using the network access identifier and only server side authentication.

7. A method comprising:

receiving at a user device a beacon transmission from a secure network access point, where the beacon transmission advertises a service set identifier (SSID);

in response to determining that the user device does not have credentials necessary to attach with the secure network access point, forming a preliminary association between the user device and the secure network access point using the advertised SSID;

during the preliminary association, the user device receiving or creating credentials necessary to associate with the secure network access point; and

forming an association between the user device and the secure network access point using the received or created credentials and the advertised SSID, and obtaining internet connectivity for the user device via the secure network access point.

8. The method according to claim 7, the method further comprising:

sending http traffic towards the secure network access point during the preliminary association; and

forming a secure http connection with a portal page to which the user device is redirected in response to sending the http traffic;

in which the user device receives or creates the credentials necessary to associate with the secure network access point while in the secure http connection with the portal page.

9. The method according to claim 7, in which the received beacon transmission indicates that the secure network access point supports on-line sign-up.

10. The method according to claim 9, the method further comprising:

while the user device is in a pre-associated state, sending a request for a sign-up network access identifier NAI to the secure network access point;

receiving the requested sign-up network access identifier; and

thereafter

forming the preliminary association with the secure network access point using the network access identifier and only server side authentication.

11. A non-transitory computer-readable medium that includes computer program instructions which when executed by at least one data processor result in performance of operations comprising:

receiving at a user device a beacon transmission from a secure network access point, where the beacon transmission advertises a service set identifier (SSID);

in response to determining that the user device does not have credentials necessary to attach with the secure network access point, forming a preliminary association with the secure network access point using the advertised SSID;

during the preliminary association, the user device receiving or creating credentials necessary to associate with the secure network access point; and

forming an association between the user device and the secure network access point using the received or created credentials and the advertised SSID, and obtaining internet connectivity via the secure network access point.

12. The non-transitory computer-readable medium of claim 11, in which the operations further comprise:

sending http traffic towards the secure network access point during the preliminary association; and

forming a secure http connection with a portal page to which the user device is redirected in response to sending the http traffic;

in which the user device receives or creates the credentials necessary to associate with the secure network access point while in the secure http connection with the portal page.

13. An apparatus comprising:

at least one processor; and

at least one memory including computer program code;

in which the at least one memory with the computer program code is configured with the at least one processor to cause the apparatus at least to;

transmit at least one beacon transmission, where the beacon transmission advertises a service set identifier (SSID);

provide a sign-up network access identifier NM to a user device while the user device is in a pre-associated state with the apparatus using the advertised SSID;

receive from the user device an association request which includes the sign-up network access identifier NAI;

grant the user device limited access to a network for credential creation purposes; and

using created credentials, grant the user device Internet connectivity using the advertised SSID.

14. The apparatus according to claim 13, in which granting the user device limited access to the network for credential creation purposes comprises:

establishing a preliminary association with the user device;

redirecting http traffic received from the user device during the preliminary association to a portal page;

forming a secure http connection with the user device for establishing the credentials; and

terminating the preliminary association with the user device.

15. The apparatus according to claim 13, in which the apparatus comprises a robust security network RSN network access point, and the at least one memory with the computer program code is configured with the at least one processor to further cause the apparatus at least to:

form an association with the user device using the credentials and thereafter grant the user device Internet connectivity via the apparatus.

16. A method comprising:

transmitting at least one beacon transmission, where the beacon transmission advertises a service set identifier (SSID);

providing a sign-up network access identifier NAI to a user device while the user device is in a pre-associated state using the advertised SSID;

receiving from the user device an association request which includes the sign-up network access identifier NAI;

granting the user device limited access to a network for credential creation purposes; and

using created credentials, grant the user device Internet connectivity using the advertised SSID.

17. The method according to claim 16, in which granting the user device limited access to the network for credential creation purposes comprises:

establishing a preliminary association with the user device;

redirecting http traffic received from the user device during the preliminary association to a portal page;

forming a secure http connection with the user device for establishing the credentials; and

terminating the preliminary association with the user device.

18. The method according to claim 16, in which the method is executed by a robust security network RSN network access point, and the method further comprises:

forming an association with the user device using the credentials and thereafter granting the user device Internet connectivity via the robust security network RSN network access point.

19. A non-transitory computer-readable medium that includes computer program instructions which when executed by at least one data processor result in performance of operations comprising:

transmitting at least one beacon transmission, where the beacon transmission advertises a service set identifier (SSID);

providing a sign-up network access identifier NAI to a user device while the user device is in a pre-associated state using the advertised SSID;

receiving from the user device an association request which includes the sign-up network access identifier NAI; and

granting the user device limited access to a network for credential creation purposes; and

using created credentials, grant the user device Internet connectivity using the advertised SSID.

20. The non-transitory computer-readable medium of claim 19, in which the operations further comprise:

establishing a preliminary association with the user device;

redirecting http traffic received from the user device during the preliminary association to a portal page;

forming a secure http connection with the user device for establishing the credentials; and

terminating the preliminary association with the user device.