Techniques to provide access point authentication for wireless network
According to an example embodiment, an apparatus may include a client device including a processor and memory. The client device may be configured to obtain, via a secure communication, a certificate identifying a publically accessible wireless access point (AP) and a public key for the AP, the AP being publically accessible. The client (or client device) may be configured to generate a challenge, send the challenge to the AP, wherein the AP has a private key securely stored in a hardware security module of the AP. The private key may correspond to the public key for the AP. The client may be configured to receive a response from the AP, the response being generated by the AP based on the challenge and the private key for the AP, and authenticate the AP based on the response.
1. A method of a client device authenticating a wireless access point comprising:
obtaining, by the client device from a certificate authority, a certificate for each of a plurality of publically accessible wireless access points (APs), each certificate identifying one of the wireless APs and a public key for the AP, wherein a certificate is obtained by the client device for a first AP of the plurality of APs before the client device communicates with the first AP;
generating a challenge by encrypting a random number based on the public key for the first AP;
sending the challenge from the client device to the first AP of the plurality of APs, wherein the first AP has a private key securely stored in a hardware security module of the first AP, wherein the stored private key corresponds to the public key for the first AP;
receiving a response by the client device from the first AP, the response being generated by the first AP based on the challenge and the private key for the first AP; and
comparing, by the client device, the received response to the random number used in generating the challenge, wherein authentication of the first AP is established based on a match between the random number and the received response.
2. The method of claim 1 and further comprising the client device providing payment information to the first AP after the client device has authenticated the first AP.
3. The method of claim 1 and further comprising sending confidential credit card information from the client device to the first AP after the first AP has been authenticated.
4. The method of claim 1 wherein the obtaining comprises receiving, by the client device via a secure communication from the certificate authority or other trusted entity, a certificate for each of a plurality of publically accessible non-secure wireless APs provided by a common wireless service provider, each certificate identifying a MAC address of one of the wireless APs and a public key for the AP.
5. The method of claim 1 wherein the challenge comprises a random number and the response comprises the random number that has been encrypted based on the first AP's private key.
6. The method of claim 1 wherein the challenge comprises a random number that has been encrypted by the client device based on the first AP's public key and the response comprises the random number that has been obtained by the first AP by decrypting the challenge based on the first AP's private key.
7. The method of claim 1 and further comprising the first AP authenticating the client.
8. The method of claim 1 and further comprising authenticating, by the client device, the first AP based on a match between the random number and the received response.
9. The method of claim 1 wherein the obtaining comprises obtaining, by the client device from a certificate authority, a certificate for each of a plurality of publically accessible wireless access points (APs) at a specific location.
10. The method of claim 1 wherein the obtaining comprises obtaining, by the client device from a certificate authority, a certificate for each of a plurality of publically accessible wireless access points (APs) for a specific wireless service provider.
11. The method of claim 1 and further comprising sending confidential service subscription information from the client device to the first AP after the first AP has been authenticated.
12. The method of claim 1 and further comprising:
the first AP sending a challenge to the client device;
the first AP receiving a response to the challenge;
authenticating, by the first AP, the client device based on the response received.
13. The method of claim 1 and further comprising:
sending a challenge to the client device from an authentication server;
the authentication server receiving a response to the challenge from the client device;
authenticating, by the authentication server, the client device based on the response received.
14. An apparatus comprising:
a client device including a processor and memory, the client device configured to:
obtain, from a certificate authority, a certificate for each of a plurality of publically accessible wireless access points (APs), each certificate identifying one of the wireless APs and a public key for the AP, wherein a certificate is obtained by the client device for a first AP of the plurality of APs before the client device communicates with the first AP;
generate a challenge by encrypting a random number based on the public key for the first AP;
send the challenge from the client device to the first AP of the plurality of APs, wherein the first AP has a private key securely stored in a hardware security module of the first AP, wherein the stored private key corresponds to the public key for the first AP;
receive a response by the client device from the first AP, the response being generated by the first AP based on the challenge and the private key for the first AP; and
compare, by the client device, the received response to the random number used in generating the challenge, wherein authentication of the first AP is established based on a match between the random number and the received response.
15. The apparatus of claim 14 and further comprising the client device being configured to provide payment information to the first AP after the client device has authenticated the first AP.
16. The apparatus of claim 15 wherein the client device is configured to send confidential credit card information to the first AP after the first AP has been authenticated.
17. The apparatus of claim 14 and further comprising the first AP, the first AP including:
a host processor; and
a hardware security module configured to securely store one or more keys including the private key corresponding to the public key for the first AP.
18. The apparatus of claim 14 and further comprising the first AP, the first AP including:
a host processor; and
a hardware security module including:
a processor;
a random number generator;
a one-time-programmable memory configured to securely store one or more keys including a private identity key corresponding to the first AP's public key, such that the private keys are not exposed outside of the hardware security module;
one or more cryptographic engines configured to perform cryptographic processing.
19. The method of claim 14 wherein the challenge comprises a random number and the response comprises the random number that has been encrypted based on the first AP's private key.
20. The method of claim 14 wherein the challenge comprises a random number that has been encrypted based on the first AP's public key and the response comprises the random number that has been obtained by the first AP by decrypting the challenge based on the first AP's private key.