Restricted certificate enrollment for unknown devices in hotspot networks
View Patent ↗A network access system, e.g. a network hotspot, requires a mobile network access device, e.g. a smart phone or WiFi only device, to provide a network access standard designation and/or a device identification datum to gain access to network services. The network access standard designation may be provided by the mobile network access device to an online signup server via a EKU_key_purpose field of a PKCS10 certificate signing request. The device identification datum may be provided to the OSU via a subject field of the signing request. The OSU may require that the device identification datum be the same as a device identification datum provided by the mobile network access device prior to the mobile network access device requesting a signed network access certificate.
1. A method, comprising:
receiving, by a mobile network access device, a certificate for access to a service provider network;
sending, by the mobile network access device, a certificate signing request to a service provider network server, the signing request including a network access standard designation;
receiving by the mobile network access device a signed access certificate that includes the network access standard designation.
2. The method of claim 1 , further comprising:
providing, by the mobile network access device to the network access server, a device identification datum; and
wherein the signed access certificate includes the device identification datum.
3. The method of claim 2 , wherein the device identification datum includes an IMEI, MEID, a MAC address or a unique device ID.
4. The method of claim 2 , wherein the device identification datum is conveyed in a subject field of the signed certificate.
5. The method of claim 1 , wherein the network access standard designation specifies a Hotspot 2.0 (HS2.0) or later standard.
6. The method of claim 1 , wherein the network access standard designation is conveyed in an EKU_key_purpose field of the signed certificate.
7. The method of claim 1 , wherein the mobile network access device is a mobile telephone.
8. The method of claim 1 , wherein the signed access certificate includes a designation that the network access standard designation is critical.
9. A mobile network access device, comprising:
a processor;
a transceiver configured to communicate with a wireless network; and
a non-transitory machine readable storage medium having encoded thereon program code, wherein the program code is executed by the processor to implement a method comprising:
receiving, via the transceiver, a certificate for access to a service provider network;
sending, via the transceiver, a certificate signing request to a service provider network server, the signing request including a network access standard designation;
receiving, via the transceiver, a signed access certificate that includes the network access standard designation.
10. The mobile network access device of claim 9 , wherein the method further comprises:
providing, by the mobile network access device to the network access server, a device identification datum; and
wherein the signed access certificate includes the device identification datum.
11. The mobile network access device of claim 10 , wherein the device identification datum includes an IMEI, MEID, a MAC address or a unique device ID.
12. The mobile network access device of claim 10 , wherein the device identification datum is conveyed in a subject field of the signed certificate.
13. The mobile network access device of claim 9 , wherein the network access standard designation specifies a Hotspot 2.0 (HS2.0) or later standard.
14. The mobile network access device of claim 9 , wherein the network access standard designation is conveyed in an EKU_key_purpose field of the signed certificate.
15. The mobile network access device of claim 9 , wherein the processor, transceiver and storage device a components of a mobile telephone.
16. The mobile network access device of claim 9 , wherein the signed access certificate includes a designation that the network access standard designation is critical.
17. The mobile network access device of claim 9 , further comprising directing to an authentication server a network access request including said signed access certificate.
18. The mobile network access device of claim 17 , wherein said network access request is made via a EAP-TLS (extensible authentication protocol-transport layer security) protocol.
19. The mobile network access device of claim 10 , wherein the identification datum of the mobile network access device is directed to the network access server before the sending of the certificate signing request.
20. The mobile network access device of claim 19 , wherein the method implemented by the processor further comprises directing the identification datum of the mobile network access device to the network access server concurrent with the sending of the certificate signing request, wherein the signed access certificate is received only on the condition that the identification datum sent before the sending the certificate signing request is determined to match the identification datum sent with the sending of the certificate signing request.
21. The method of claim 1 , further comprising directing to an authentication server a network access request including said signed access certificate.
22. The method of claim 21 , wherein said network access request is made via a EAP-TLS (extensible authentication protocol-transport layer security) protocol.
23. The method of claim 2 , further comprising directing the identification datum of the mobile network access device to the network access server before the sending of the certificate signing request.
24. The method of claim 23 , further comprising directing the identification datum of the mobile network access device to the network access server concurrent with the sending of the certificate signing request, wherein the signed access certificate is received only on the condition that the identification datum sent before the sending the certificate signing request is determined to match the identification datum sent with the sending of the certificate signing request.