Method for enrolling a user terminal in a wireless local area network

• US 8,498,617 B2
• Filed: 08/20/2004
• Issued: 07/30/2013
• Est. Priority Date: 08/20/2004
• Status: Active Grant

• Current Assignee: Telecom Italia S.p.A.
• Original Assignee: Telecom Italia S.p.A.
• Inventors: Gallo, Paolo, Polano, Marco, Obino, Pietro
• Primary Examiner(s): Gelin, Jean
• Assistant Examiner(s): Hong, Dung
• Application Number:
  US11/660,384
• Publication Number:
  US 20070263577A1
• Time in Patent Office: 3,266 Days
• Field of Search: 455410-411, 455/550.1, 455/561, 726/3, 709208-211, 709220-222, 709227-229, 709/248
• US Class Current: 455/411
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 9/0841 involving Diffie-Hellman or related key agreement protocols
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04W 12/041 Key generation or derivation
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A method for enrolling a user terminal in a network includes an access point for the user terminal, the access point performing the following steps: detecting the performance of a first pressure of a registration button on the access point; detecting the reception of a request for enrollment from the user terminal; detecting the performance of a second pressure of the registration button on the access point; and enrolling the user terminal in the network only if a single request for enrollment is received between the detections of the first and second pressures.

Claims

1. A method for enrolling a user terminal in a network comprising an access point for the user terminal, the method comprising:

detecting a performance of a first action by a user which proves that the user may directly interact with the access point;

after detecting the performance of the first action, detecting a reception of a request for enrollment from the user terminal;

after detecting the reception of the request, detecting a performance of a second action by the user which proves that the user may directly interact with the access point; and

after detecting the performance of the second action, enrolling the user terminal by generating and sending to the user terminal enrollment access credentials in the network only if a single request for enrollment is received between the detections of the performance of the first and second actions, and refusing the enrollment of the user terminal when more than a single request for enrollment is received between the detections of the performance of the first and second actions.

2. The method of claim 1, further comprising:

whenever a plurality of requests for enrollment are received from one or more requestors between the detections of the performance of the first and second actions, refusing enrollment to all of the one or more requestors.

3. The method of claim 1, wherein detecting performance of a first action and a second action by the user comprises:

detecting the performance of a first action and a second action by the user physically on the access point.

4. The method of claim 3, wherein detecting performance of a first action and a second action by the user physically on the access point comprises:

detecting a first operation and a second operation of a registration button on the access point.

5. The method of claim 3, wherein detecting performance of a first action and a second action by the user physically on the access point comprises:

detecting a first operation and a second operation of an access point configuration interface on the access point.

6. The method of claim 1, wherein detecting the reception of a request for enrollment from the user terminal comprises:

detecting a reception of a request for the enrollment access credentials.

7. The method of claim 1, wherein the enrollment access credentials comprise an enrollment digital certificate.

8. The method of claim 7, wherein generating and sending the enrollment digital certificate to the user terminal comprises:

detecting the reception of an identifier of either the user or the user terminal and of a public key randomly generated by the user terminal;

upon detecting the performance of the second action by the user, generating the enrollment digital certificate on the basis of the received identifier and the public key;

signing the enrollment digital certificate with a private key of the access point; and

sending the signed enrollment digital certificate to the user terminal.

9. The method of claim 1, wherein the enrollment access credentials comprise an enrollment secret key/password.

10. The method of claim 9, wherein generating and sending to the user terminal the enrollment secret key/password comprises:

agreeing to a symmetric key between the user terminal and the access point;

establishing a communication channel between the user terminal and the access point, any communication over said communication channel being encrypted by the agreed symmetric key;

detecting the reception of an identifier of either the user or the user terminal, said identifier being sent over the encrypted communication channel; and

upon detecting the performance of the second action by the user, randomly generating the enrollment secret key/password;

associating the enrollment secret key/password with the received identifier; and

sending the enrollment secret key/password to the user terminal via the encrypted communication channel.

11. The method of claim 1, wherein enrolling the user terminal in the network comprises:

upon detecting the performance of the second action by the user, storing the enrollment access credentials.

12. The method of claim 1, further comprising:

implementing an authentication protocol during the communications for the enrollment of the user terminal between the user terminal and the access point.

13. The method of claim 12, wherein implementing an authentication protocol comprises:

upon detecting the performance of the first action by the user, detecting the reception of authentication access credentials from the user terminal;

verifying the authentication access credentials; and

in case of positive verification, allowing the user terminal to have temporary access to the access point to perform the enrollment.

14. The method of claim 13, wherein the authentication access credentials comprises an authentication digital certificate.

15. The method of claim 14, wherein the authentication digital certificate is issued by a first certification authority;

wherein the access point is provided with a unique access point digital certificate issued by a second certification authority; and

wherein the first certification authority is provided with a unique certification authority digital certificate issued by the second certification authority.

16. The method of claim 13, wherein the authentication access credentials comprise an authentication secret key/password.

17. The method of claim 1, wherein the network is a local area network.

18. The method of claim 17, wherein the network is a wireless local area network.

19. The method of claim 18, wherein the wireless local area network is adapted for use in a domestic environment.

20. The method of claim 18, wherein the wireless local area network is adapted for use in a small office or home office environment.

21. An access point for a network comprising at least one processor to implement the enrolling method according to claim 1.

22. A network, comprising the access point of claim 21.

23. The network of claim 22, comprising a local area network.

24. The network of claim 23, comprising a wireless local area network.

25. The network of claim 23, wherein the network is adapted for use in a domestic environment.

26. The network of claim 23, wherein the network is adapted for use in a small office or home office.

27. A user terminal comprising at least one processor to connect to, and to cooperate with an access point to implement the enrolling method according to claim 1.

28. At least one non-transitory computer readable medium storing software modules capable, when loaded in a user terminal and in an access point for a network, of cooperating in implementing the method according to claim 1.

29. A method for enrolling a user terminal in a network comprising an access point for the user terminal, the method comprising:

detecting a performance of a first action by a user which proves that the user may directly interact with the access point;

detecting a reception of a request for enrollment from the user terminal, wherein the request for enrollment comprises an authentication digital certificate issued by a first certification authority, wherein the first certification authority is provided with a unique certification digital certificate that is issued by a second certification authority and inserts the unique digital certificate in the authentication digital certificate, and wherein the access point is provided with a unique access point digital certificate issued by a third certification authority;

detecting a performance of a second action by the user which proves that the user may directly interact with the access point;

verifying, by comparing the unique certification digital certificate and the unique access point digital certificate, that the second certification authority is the same as the third certification authority; and

when it is verified that the second certification authority is the same as the third certification authority and upon detecting the performance of the second action by the user, enrolling the user terminal by generating and sending to the user terminal enrollment access credentials in the network only when a single request for enrollment is received between the detections of the performance of the first and second actions.