Systems and methods for authenticating users accessing unsecured wifi access points
View Patent ↗Systems and methods system for a user accessing an unsecure Wifi access point are provided. In an embodiment, the present invention requests that the customer perform authentication of the access point to which he is connected. On initial connection to the access point, the customer provides his username/password and chooses a memorable information element (e.g., image or phrase). A site specific cookie is delivered to the customer device after a successful authentication. On subsequent connections, the site specific cookie is validated and the MAC address of the customer device is used to retrieve the memorable information element. If the customer recognizes his memorable image, he confirms that he is on a bona fide access point. In a further embodiment, if the customer connects at a location and/or time of day which breaks a previously observed pattern, MAC authentication is not accepted and a full authentication (e.g., user/password) is required.
1. A method for authenticating a user accessing an unsecure WiFi access point, wherein a device of the user includes a MAC address, comprising:
receiving at the unsecure WiFi access point a request from the user device to access the unsecure WiFi access point;
transmitting from the unsecure WiFi access point to an Authentication, Authorization, and accounting server an access request including the MAC address of the user;
when the MAC address is unauthorized by the AAA server,
returning from the AAA server an access reject message to the unsecure WiFi access point;
transmitting a redirect message from the WiFi access point to the user device redirecting the user device to a web portal;
requesting at the web portal a username, password and selection of a memorable information element;
receiving at the web portal a username, password and selection of a memorable information element;
transmitting from the web portal an access request message to the AAA server containing the username, password, MAC address and the identifier of the memorable information element;
authenticating at the AAA server the username and password;
storing at the AAA server the MAC address and the identifier of the memorable information element;
transmitting from the AAA server to the web portal an access accept message;
transmitting from the web portal to the user device a site cookie;
transmitting from the web portal an instruction to the unsecure WiFi access point to allow the user to access the unsecure WiFi access point;
when the MAC address is authorized by the AAA server,
returning from the AAA server an access accept message to the unsecure WiFi access point, wherein the access accept message includes the identifier of the memorable information element;
transmitting a redirect message from the WiFi access point to the user device redirecting the user device to the web portal;
receiving the site cookie from the user device at the web portal; validating the site cookie at the web portal;
displaying by the web portal the memorable information element associated with the identifier for the memorable information element;
receiving an indication from the user device that the memorable information element is a correct memorable information element; and
transmitting from the web portal an instruction to the unsecure WiFi access point to allow the user device to access the WiFi access point.
2. The method of claim 1 , further comprising:
accessing subscriber profile and state information to obtain historical user profile and current user information;
comparing a current user condition with the historical user profile information to generate comparison results; and
evaluating the comparison results against established criteria to determine an authentication action.
3. The method of claim 2 , wherein subscriber profile and state information include one or more of user location, user time of day usage pattern and/or user usage patterns.
4. The method of claim 2 , wherein the authentication action includes denying access, requiring additional security measures and/or transmitting a fraudulent activity notification.
5. The method of claim 1 , wherein storing the MAC address and the identifier for the memorable information element further includes storing an identifier timer.
6. The method of claim 5 , further comprising upon expiry of the identifier timer expiring the identifier for the memorable information element.
7. The method of claim 6 , wherein the site cookie comprises a hashed site cookie including the MAC address, the identifier of the memorable image element and a portal key.
8. The method of claim 1 , wherein the memorable information element includes one or more of an image, a phrase or a question/answer.
9. The method of claim 1 , wherein the AAA server comprises a RADIUS or DIAMETER server.
10. The method of claim 1 , wherein the site cookie comprises a Hash-based Message Authentication Code (HMAC) where the hash input message includes the MAC address, the identifier of the memorable image element, and the hash key is the private key of the web portal.
11. The method of claim 10 , wherein the site cookie comprises a cookie expiry timestamp and includes the cookie expiry timestamp in the hash input message.