Single-SSID and dual-SSID enhancements
A wireless local area network system establishes a PASSPOINT™ connection between a mobile station and a hotspot using an enhanced single SSID method or an enhanced dual SSID method. In the dual SSID method, an access point associates and authenticates a mobile device to a secondary SSID of the access point during enrollment and provisioning. After enrollment, the access point authenticates the mobile station to a primary SSID of the access point using the credential that the mobile station received from an online sign-up (“OSU”) server in connection with the secondary SSID. In the single SSID method, an access point performs two levels of authentication. During authentication, communications are limited to an 802.1x controlled port running on the mobile station and access point. After a first authentication, communications between the OSU server and the mobile station are unblocked. After the second authentication, all traffic from the mobile station is unblocked.
1. A method of online sign-up and data communication using one Service Set Identification and one Basic Service Set Identification, comprising:
recording, by at least one access point, an Internet Protocol address of an online sign-up server serviced by the access point;
performing a first level authentication of one or more signals received at the access point from a station;
in response to completing the first level authentication, only permitting communication, by a controlled port in the access point, of the station with the internet protocol address of the online sign-up server;
performing a second level authentication after performing the first level authentication; and
in response to completing the second level authentication, unblocking all traffic from the station by the controlled port.
2. The method of claim 1 , further comprising:
in response to completing the first level authentication and prior to performing the second level authentication, only permitting communication, by the controlled port in the access point and the station, of a predefined number of packets between the station and the online sign-up server.
3. The method of claim 2 , wherein the predefined number of packets includes a first number of packets from the station to the online sign-up server and a second number of packets from the online sign-up server to the station.
4. The method of claim 2 , wherein the predefined number of packets includes more packets than are required to complete the second level authentication.
5. The method of claim 1 , wherein only permitting communication of the station with the internet protocol address of the online sign-up server includes performing a header check of each packet from the station.
6. The method of claim 1 , wherein the first level authentication includes server-side authentication.
7. The method of claim 1 , wherein the second level authentication includes communicating a signed certificate to the station.
8. The method of claim 1 , wherein communication between the station and the access point conforms to an IEEE 802.11 protocol.
9. The method of claim 1 , wherein the one Service Set Identification and the one Basic Service Set Identification are used for online signup and for accessing a service provider's network.
10. The method of claim 9 , wherein the access point is disassociated from the station after the first authentication and before accessing the service provider's network.
11. The method of claim 9 , wherein the access point remains associated between the first authentication and accessing the service provider's network.
12. An access point, comprising:
a controller configured to record an Internet Protocol address of an online sign-up server serviced by the access point, and configured to perform a first level authentication of one or more signals received at the access point from a station; and
a controlled port, wherein in response to completing the first level authentication, the access point is further configured to direct the controlled port to only permit communication from the station that includes the internet protocol address of the online sign-up server, and in response to completing a second level authentication, the access point further configured to direct the controlled port to unblock all traffic between the access point and the station.
13. The access point of claim 12 , wherein in response to completion of the first level authentication and prior to performing the second level authentication, the controller is further configured to direct the controlled port to only permit communication of a predefined number of packets between the station and the online sign-up server.
14. The access point of claim 13 , wherein the predefined number of packets includes a first number of packets from the station to the online sign-up server and a second number of packets from the online sign-up server to the station.
15. The access point of claim 13 , wherein the predefined number of packets includes more packets than are required to complete the second level authentication.
16. A system, comprising:
an access point, the access point having a controller configured to record an Internet Protocol address of an online sign-up server serviced by the access point; and
a station, the station having a controller configured to record the Internet Protocol address of the online sign-up server serviced by the access point, wherein the system is configured to perform a first level authentication of one or more signals communicated between the station and the access point and, in response to completing the first level authentication, the system configured to only permit communication of packets from the station when the packets contain the Internet Protocol address of the online sign-up server, the system further configured to perform a second level authentication after performing the first level authentication and, in response to completing the second level authentication, the system configured to unblock all packets communicated from the station to the access point.
17. The system of claim 16 , wherein the controller of the access point comprises:
a controlled port wherein, in response to completing the first level authentication and prior to performing the second level authentication, the controller of the access point is configured to direct the controlled port to permit passage of only a predefined number of packets between the station and the online sign-up server.
18. The system of claim 17 , wherein the predefined number of packets includes a first number of packets from the station directed to the online sign-up server and a second number of packets from the online sign-up server directed to the station.
19. The system of claim 16 , wherein the first authentication, the second authentication, and communication with a service providers network are conducted using a same Service Set Identification and a same Basic Service Set Identification.
20. The system of claim 16 , wherein the first level authentication includes server-side authentication and the second level authentication includes user acceptance of one or more subscription terms.