Method for securing host configuration messages

1. A method comprising:

causing at least one available network to be detected;

causing a query to be transmitted that causes an online signup provider list to be downloaded and stored;

determining a fully qualified domain name (FQDN) for the at least one detected available network;

causing a registry entry to be accessed in a registry stored on a service provider's server that corresponds to the determined FQDN and causing a service provider record to be downloaded from the registry, wherein the service provider record comprises at least one certificate for at least one network entity different from the service provider's server, the at least one network entity operating on the at least one available network and comprising at least one dynamic host configuration protocol (DHCP) server or at least one domain name system (DNS) server;

causing a connection to the at least one detected available network based at least partially on the service provider record;

receiving, after causing the connection to the at least one detected available network, an authentication option based on a router advertisement (RA) option;

receiving, after receiving said authentication option, configuration information from the at least one connected network; and

verifying the received configuration information from the at least one connected network based on the authentication option, wherein verification comprises determining whether the received configuration information is signed with a digital certificate that corresponds to the at least one certificate in the accessed registry entry.

2. A method according to claim 1 wherein the accessed registry entry includes certificates for at least one of a router, Dynamic Host Configuration Protocol (DHCP) server or Domain Name System (DNS) server of a service provider.

3. A method according to claim 1 further comprising receiving a message comprising a signature from at least one of a router, DHCP server or DNS server, wherein the signature further comprises at least one of an identity or random number belonging to a mobile terminal.

4. A method according to claim 1 further comprising receiving a message comprising a signature from at least one of a router, DHCP server or DNS server, wherein the message further comprises a hash of a public key used to sign the message, to determine a network entity from a service provider record that signed the message.

5. A method according to claim 1 further comprising receiving a router advertisements, DHCP, or DHCPv6 messages, and determining whether the received router advertisements, DHCP, or DHCPv6 messages are from a verified legitimate network entity and causing a connection to the verified access network in an instance in which the received messages contain a valid signature of a network element which is authorized to IP provision at least one mobile terminal associated to that access network.

6. A method according to claim 1 wherein a network entity is authorized in an instance in which the network entity has a corresponding certificate in the registry or the network entity has a certificate that is issued by an entity that has a corresponding certificate in the registry.

7. A method according to claim 4 wherein the signature includes at least one field, wherein one of the fields includes the FQDN of an entity that generated the digital signature.

8. A method according to claim 1 , further comprising accepting an IP address configuration information in an instance in which a signature is verified and at least one of the network entity has a corresponding certificate in the registry or the network entity has a certificate that is issued by an entity that has a corresponding certificate in the registry.

9. An apparatus comprising:

a processor and

a memory including software, the memory and the software configured to, with the processor, cause the apparatus to at least:

cause at least one available network to be detected;

cause a query to be transmitted that causes an online signup provider list to be downloaded and stored;

determine a fully qualified domain name (FQDN) for the at least one detected available network;

cause a registry entry to be accessed in a registry stored on a service provider's server that corresponds to the determined FQDN and cause a service provider record to be downloaded from the registry, wherein the service provider record comprises at least one certificate for at least one network entity different from the service provider's server, the at least one network entity operating on the at least one available network and comprising at least one dynamic host configuration protocol (DHCP) server or at least one domain name system (DNS) server;

cause a connection to the at least one detected available network based at least partially on the service provider record;

receive, after causing the connection to the at least one detected available network, an authentication option based on a router advertisement (RA) option;

receive, after receiving said authentication option, configuration information from the at least one connected network; and

verify the received configuration information from the at least one connected network based on the authentication option, wherein verification comprises determining whether the received configuration information is signed with a digital certificate that corresponds to the at least one certificate in the accessed registry entry.

10. An apparatus according to claim 9 wherein the accessed registry entry includes certificates for at least one of a router, Dynamic Host Configuration Protocol (DHCP) server or Domain Name System (DNS) server of a service provider.

11. An apparatus according to claim 9 wherein the at least one memory including the computer program code is further configured to, with the at least one processor, cause the apparatus to receive a message comprising a signature from at least one of a router, DHCP server or DNS server, wherein the signature further comprises at least one of an identity or random number belonging to the apparatus.

12. An apparatus according to claim 9 wherein the at least one memory including the computer program code is further configured to, with the at least one processor, cause the apparatus to receive a message comprising a signature from at least one of a router, DHCP server or DNS server, wherein the message further comprises a hash of a public key used to sign the message, to determine a network entity from a service provider record that signed the message.

13. An apparatus according to claim 9 wherein the at least one memory including the computer program code is further configured to, with the at least one processor, cause the apparatus to receive a router advertisements, DHCP, or DHCPv6 messages, and to determine whether the received router advertisements, DHCP, or DHCPv6 messages are from a verified legitimate network entity and causing a connection to the verified access network in an instance in which the received messages contain a valid signature of a network element which is authorized to IP provision at least one mobile terminal associated to that access network.

14. An apparatus according to claim 9 wherein a network entity is authorized in an instance in which the network entity has a corresponding certificate in the registry or the network entity has a certificate that is issued by an entity that has a corresponding certificate in the registry.

15. An apparatus according to claim 9 wherein an IPv6 header option is defined to carry in a router advertisement a signature over an assigned IP address and an identity or random number belonging to the client.

16. An apparatus according to claim 9 wherein a signature includes at least one field, wherein one of the fields includes the FQDN of an entity that generated the digital signature.

17. An apparatus according to claim 9 wherein the at least one memory including the computer program code is further configured to, with the at least one processor, cause the apparatus to accept an IP address configuration information in an instance in which a signature is verified and at least one of the network entity has a corresponding certificate in the registry or the network entity has a certificate that is issued by an entity that has a corresponding certificate in the registry.

18. A computer program product comprising:

at least one computer readable non-transitory memory medium having program code stored thereon, the program code which when executed by an apparatus cause the apparatus at least to:

cause at least one available network to be detected;

cause a query to be transmitted that causes an online signup provider list to be downloaded and stored;

determine a fully qualified domain name (FQDN) for the at least one detected available network;

cause a registry entry to be accessed in a registry stored on a service provider's server that corresponds to the determined FQDN and cause a service provider record to be downloaded from the registry, wherein the service provider record comprises at least one certificate for at least one network entity different from the service provider's server, the at least one network entity operating on the at least one available network and comprising at least one dynamic host configuration protocol (DHCP) server or at least one domain name system (DNS) server;

cause a connection to the at least one detected available network based at least partially on the service provider record;

receive, after causing the connection to the at least one detected available network, an authentication option based on a router advertisement (RA) option;

receive, after receiving said authentication option, configuration information from the at least one connected network; and

verify the received configuration information from the at least one connected network based on the authentication option, wherein verification comprises determining whether the received configuration information is signed with a digital certificate that corresponds to the at least one certificate in the accessed registry entry.

19. A computer program product according to claim 18 wherein the accessed registry entry includes certificates for at least one of a router, Dynamic Host Configuration Protocol (DHCP) server or Domain Name System (DNS) server of the service provider.

20. A computer program product according to claim 18 further comprises program code which when executed by an apparatus cause the apparatus at least to receive a message comprising a signature from at least one of a router, DHCP server or DNS server, wherein the signature further comprises at least one of an identity or random number belonging to the apparatus.