Methods for fast, secure and privacy-friendly internet connection discovery in wireless networks

• US 9,949,301 B2
• Filed: 01/20/2016
• Issued: 04/17/2018
• Est. Priority Date: 01/20/2016
• Status: Active Grant

• Current Assignee: Xerox Corporation (Xerox Holdings Corp.)
• Original Assignee: Palo Alto Research Center, Inc. (Xerox Holdings Corp.)
• Inventors: Freudiger, Julien F., Brito, Alejandro E., Rane, Shantanu, Uzun, Ersin
• Primary Examiner(s): Huq, Obaidul
• Application Number:
  US15/002,160
• Publication Number:
  US 20170208631A1
• Time in Patent Office: 818 Days
• Field of Search: 370310, 370328, 370329
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 63/0421 Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 4/06 Selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS]; Services to user groups; One-way selective calling services
• CPC Class Codes: H04W 72/046 the resource being in the space domain, e.g. beams
• CPC Class Codes: H04W 76/10 Connection setup
• CPC Class Codes: H04W 76/38 triggered by timers

Abstract

A method and system for verifying Internet connectivity at an access point in a fast, secure, and privacy-friendly manner. During operation, the system may perform passive network discovery, challenge response discovery, and/or active discovery to verify Internet connectivity for a mobile device. Passive network discovery involves the mobile device using a public key of a server to decrypt a time value to verify Internet connectivity. The mobile device receives the encrypted time value as part of the server'"'"'s signed timing information in an overloaded WiFi beacon frame. Challenge response discovery involves the mobile device sending an encrypted challenge to servers, and a server returns a correct response to the challenge to confirm Internet connectivity. Active discovery involves a mobile device sending HTTP GET requests to a randomly selected set of servers without including a user agent, and a server may send an HTTP REPLY to confirm Internet connectivity.

Claims

1. A computer-executable method for performing passive network discovery to verify Internet connectivity of a mobile device, comprising:

setting, by a mobile device, a timeout variable to a value equal to a current time;

receiving, by the mobile device, a beacon frame from an access point of a WiFi service;

determining, by the mobile device, that the beacon frame includes signed timing information of a server and the value of the timeout variable is less than a maximum time;

determining a decrypted time value by using a public key of the server to decrypt an encrypted time value extracted from the signed timing information;

determining that the decrypted time value is equal to a time value extracted from the signed timing information and that the time value is greater than the current time minus a time window; and

determining, by the mobile device, that the Internet connectivity verification for the WiFi service is successful.

2. The method of claim 1, wherein the access point obtains the signed timing information from the server and broadcasts the signed timing information in the beacon frame.

3. The method of claim 1, further comprising performing challenge response discovery by executing the following operations:

setting, by the mobile device, the timeout variable to a value equal to the current time;

selecting, by the mobile device, a subset of servers from a stored list of servers;

sending, by the mobile device, a challenge request to the access point using a probe request frame, wherein the probe request frame includes a number encrypted using a public key of a respective server of the subset of servers;

forwarding, by the access point, the challenge request to the subset of servers, wherein a respective server of the subset of servers applies a function indicated in the challenge request to the number indicated in the challenge request to generate an encrypted value to be included in a result message returned to the access point;

forwarding, by the access point, the result message to the mobile device after receiving the result message from the respective server; and

determining, by the mobile device, based on the encrypted value in the result message, that the Internet connection has been successfully verified.

4. The method of claim 3, wherein the access point removes user agent information from the challenge request.

5. The method of claim 1, further comprising performing challenge response discovery by executing the following operations:

sending, by the mobile device, a request to perform a DNS lookup to a DNS server via the access point, wherein the request includes a domain name encrypted using a public key of the DNS server;

forwarding, by the access point, the request to the DNS server, wherein the DNS server decrypts the encrypted domain name, determines a numeric IP address corresponding to the domain name, and sends the numeric IP address to the access point for forwarding to the mobile device; and

determining, by the mobile device, that the Internet connection has been successfully verified based on receiving the numeric IP address.

6. The method of claim 1, further comprising performing active discovery by executing the following operations:

setting, by the mobile device, the timeout variable to a value equal to the current time;

selecting randomly, by the mobile device, a subset of servers from a plurality of servers;

sending, by the mobile device, a HTTP GET request without including a user agent to each server of the randomly selected subset of servers via the access point;

forwarding, by the access point, the HTTP GET request to each server of the randomly selected subset of servers, wherein a respective server sends an HTTP REPLY to the access point and the access point forwards the HTTP REPLY to the mobile device; and

determining, by the mobile device, that the Internet connectivity verification is successful based on receiving the HTTP REPLY and the value of the timeout being less than a maximum time.

7. The method of claim 1, wherein the beacon frame comprises the signed timing information of the server, terms of service, and a URL for a payment website.

8. The method of claim 1, wherein the server publishes signed timing information at regular intervals.

9. A non-transitory computer-readable storage medium storing instructions which when executed by a computer cause the computer to perform a method for passive network discovery to verify Internet connectivity of a mobile device, the method comprising:

setting, by a mobile device, a timeout variable to a value equal to a current time;

receiving, by the mobile device, a beacon frame from an access point of a WiFi service;

determining, by the mobile device, that the beacon frame includes signed timing information of the server and the value of the timeout variable is less than a maximum time;

determining a decrypted time value by using a public key of the server to decrypt an encrypted time value extracted from the signed timing information;

determining that the decrypted time value is equal to a time value extracted from the signed timing information and that the time value is greater than the current time minus a time window; and

determining, by the mobile device, that the Internet connectivity verification for the WiFi service is successful.

10. The storage medium of claim 9, wherein the access point obtains the signed timing information from the server and broadcasts the signed timing information in the beacon frame.

11. The storage medium of claim 9, wherein the method further comprises performing challenge response discovery by executing the following operations:

setting, by the mobile device, the timeout variable to a value equal to the current time;

selecting, by the mobile device, a subset of servers from a stored list of servers;

sending, by the mobile device, a challenge request to the access point using a probe request frame, wherein the probe request frame includes a number encrypted using a public key of a respective server of the subset of servers;

forwarding, by the access point, the challenge request to the subset of servers, wherein a respective server of the subset of servers applies a function indicated in the challenge request to the number indicated in the challenge request to generate an encrypted value to be included in a result message returned to the access point;

forwarding, by the access point, the result message to the mobile device after receiving the result message from the respective server; and

determining, by the mobile device, based on the encrypted value in the result message, that the Internet connection has been successfully verified.

12. The storage medium of claim 11, wherein the access point removes user agent information from the challenge request.

13. The storage medium of claim 9, wherein the method further comprises performing challenge response discovery by executing the following operations:

sending, by the mobile device, a request to perform a DNS lookup to a DNS server via the access point, wherein the request includes a domain name encrypted using a public key of the DNS server;

forwarding, by the access point, the request to the DNS server, wherein the DNS server decrypts the encrypted domain name, determines a numeric IP address corresponding to the domain name, and sends the numeric IP address to the access point for forwarding to the mobile device; and

determining, by the mobile device, that the Internet connection has been successfully verified based on receiving the numeric IP address.

14. The storage medium of claim 9, wherein the method further comprises performing active discovery by executing the following operations:

setting, by the mobile device, the timeout variable to a value equal to the current time;

selecting randomly, by the mobile device, a subset of servers from a plurality of servers;

sending, by the mobile device, a HTTP GET request without including a user agent to each server of the randomly selected subset of servers via the access point;

forwarding, by the access point, the HTTP GET request to each server of the randomly selected subset of servers, wherein a respective server sends an HTTP REPLY to the access point and the access point forwards the HTTP REPLY to the mobile device; and

determining, by the mobile device, that the Internet connectivity verification is successful based on receiving the HTTP REPLY and the value of the timeout being less than a maximum time.

15. A computing system comprising:

one or more processors;

a memory; and

a non-transitory computer-readable medium coupled to the one or more processors storing instructions stored that, when executed by the one or more processors, cause the computing system to perform a method comprising;

setting, by a mobile device, a timeout variable to a value equal to a current time;

receiving, by the mobile device, a beacon frame from an access point of a WiFi service;

determining, by the mobile device, that the beacon frame includes signed timing information of the server and the value of the timeout variable is less than a maximum time;

determining a decrypted time value by using a public key of the server to decrypt an encrypted time value extracted from the signed timing information;

determining that the decrypted time value is equal to a time value extracted from the signed timing information and that the time value is greater than the current time minus a time window; and

determining, by the mobile device, that the Internet connectivity verification for the WiFi service is successful.

16. The computing system of claim 15, wherein the access point obtains the signed timing information from the server and broadcasts the signed timing information in the beacon frame.

17. The computing system of claim 15, wherein the method further comprises performing challenge response discovery by executing the following operations:

setting, by the mobile device, the timeout variable to a value equal to the current time;

selecting, by the mobile device, a subset of servers from a stored list of servers;

sending, by the mobile device, a challenge request to the access point using a probe request frame, wherein the probe request frame includes a number encrypted using a public key of a respective server of the subset of servers;

forwarding, by the access point, the challenge request to the subset of servers, wherein a respective server of the subset of servers applies a function indicated in the challenge request to the number indicated in the challenge request to generate an encrypted value to be included in a result message returned to the access point;

forwarding, by the access point, the result message to the mobile device after receiving the result message from the respective server; and

determining, by the mobile device, based on the encrypted value in the result message, that the Internet connection has been successfully verified.

18. The computing system of claim 17, wherein the access point removes user agent information from the challenge request.

19. The computing system of claim 15, wherein the method further comprises performing challenge response discovery by executing the following operations:

sending, by the mobile device, a request to perform a DNS lookup to a DNS server via the access point, wherein the request includes a domain name encrypted using a public key of the DNS server;

forwarding, by the access point, the request to the DNS server, wherein the DNS server decrypts the encrypted domain name, determines a numeric IP address corresponding to the domain name, and sends the numeric IP address to the access point for forwarding to the mobile device; and

determining, by the mobile device, that the Internet connection has been successfully verified based on receiving the numeric IP address.

20. The computing system of claim 15, wherein the method further comprises performing active discovery by executing the following operations:

setting, by the mobile device, the timeout variable to a value equal to the current time;

selecting randomly, by the mobile device, a subset of servers from a plurality of servers;

sending, by the mobile device, a HTTP GET request without including a user agent to each server of the randomly selected subset of servers via the access point;

forwarding, by the access point, the HTTP GET request to each server of the randomly selected subset of servers, wherein a respective server sends an HTTP REPLY to the access point and the access point forwards the HTTP REPLY to the mobile device; and

determining, by the mobile device, that the Internet connectivity verification is successful based on receiving the HTTP REPLY and the value of the timeout being less than a maximum time.