Device authentication method and devices
In a method for authenticating a device on a wireless local area network (WLAN) there is a once-off registration phase in which the device sends registration data in a MO SMS via the mobile network to the authentication system, and the authentication system performs a query to this mobile network to validate the subscriber and resolve the subscriber and device identifiers. The device receives network access information from the authentication system, allowing it to generate network access credentials on an on-going basis. This is permanent unless the registration is revoked due, for example, to the device being stolen. The network access information may be provided by the authentication system generating and signing a unique subscriber certificate during registration, and the device downloading it. The device uses the signed certificate to generate and encrypt the network access credentials for the network access.
1. A wireless network access method performed by a subscriber device subscribed to a home mobile network, a WLAN, and an authentication system, the method comprising the steps and sequence of:
in a once-off registration phase:
sending, by the device, registration data in a mobile originating short message via a mobile network to the authentication system,
performing a query to said home mobile network of a subscriber by the authentication system to validate the subscriber and resolve subscriber and device identifiers, and
receiving network access information from the authentication system at the device, said network access information allowing the device to generate network access credentials for a subsequent network access; and
in a network access phase:
generating network access credentials by the device, using said network access information previously received from the authentication system during the once-off registration phase; wherein
the authentication system generates and signs a unique subscriber certificate during the once-off registration phase, and the device downloads the unique subscriber certificate as part of said network access information;
the device uses said unique subscriber certificate to generate and encrypt the network access credentials during the network access phase; and
including the step of the device sending a token to the authentication system, the authentication system using the token to sign the unique subscriber certificate, and the device using the token to subsequently retrieve the signed unique subscriber certificate; and wherein the token is a nonce with a globally unique identifier (GUID) unique reference number.
2. The wireless network access method as claimed in claim 1 , wherein the device downloads client software, and said client software performs the device part of the once-off registration phase and the device network access operations.
3. The wireless network access method as claimed in claim 1 , wherein the authentication system generates and signs a unique subscriber certificate during the once-off registration phase, and the device downloads the unique subscriber certificate as part of said network access information.
4. The wireless network access method as claimed in claim 1 , wherein the authentication system generates and signs a unique subscriber certificate during the once-off registration phase, and the device downloads the unique subscriber certificate as part of said network access information; and wherein the unique subscriber certificate includes both subscriber and device identifiers.
5. The wireless network access method as claimed in claim 1 , wherein the authentication system generates and signs a unique subscriber certificate during the once-off registration phase, and the device downloads the unique subscriber certificate as part of said network access information; and including the step of the device sending a token to the authentication system, the authentication system using the token to sign the unique subscriber certificate, and the device using the token to subsequently retrieve the signed unique subscriber certificate.
6. The wireless network access method as claimed in claim 1 , wherein the authentication system generates and signs a unique subscriber certificate during the once-off registration phase, and the device downloads the unique subscriber certificate as part of said network access information.
7. The wireless network access method as claimed in claim 1 , wherein the authentication system generates and signs a unique subscriber certificate during the once-off registration phase, and the device downloads the unique subscriber certificate as part of said network access information; and including the step of the device sending a token to the authentication system, the authentication system using the token to sign the unique subscriber certificate, and the device using the token to subsequently retrieve the unique subscriber signed certificate; and wherein the device stores the unique subscriber certificate securely in the device.
8. The wireless network access method as claimed in claim 1 , wherein during the network access phase the device automatically discovers a preferred WLAN service.
9. The wireless network access method as claimed in claim 1 , wherein during the network access phase the device automatically discovers a preferred WLAN service; and wherein the discovery is performed using network selection data included in the network access information.
10. The wireless network access method as claimed in claim 1 , wherein during the network access phase the device automatically discovers a preferred WLAN service; and wherein the network selection data includes service set identifiers, SSIDs.
11. The wireless network access method as claimed in claim 1 , wherein the device generates the network access credentials transparently to the subscriber.
12. The wireless network access method as claimed in claim 1 , wherein the network access credentials are transported using the RADIUS or the DIAMETER protocols.
13. The wireless network access method as claimed in claim 1 , wherein the network access credentials are not stored, being algorithmically generated for every network access.
14. The wireless network access method as claimed in claim 1 , comprising the further step of an application on the device using the received network access information to communicate with a server in the same trusted domain.
15. The wireless network access method as claimed in claim 1 , comprising the further step of an application on the device using the received network access information to communicate with a server in the same trusted domain; and
wherein the device application and the server perform mutual authentication.
16. The wireless network access method as claimed in claim 1 , comprising the further step of an application on the device using the received network access information to communicate with a server in the same trusted domain; and
wherein the device includes a plurality of applications adapted to use the received network access information to authenticate itself to a server in the same trusted domain.
17. A subscriber mobile device configured to transmit and receive radiation, the device comprising a processor, wherein the processor is adapted to perform device registration and network access steps of:
in a once-off registration phase:
sending, by the device, registration data in a mobile originating short message via a mobile network to the authentication system,
performing a query to said home mobile network of a subscriber by the authentication system to validate the subscriber and resolve subscriber and device identifiers, and
receiving network access information from the authentication system at the device, said network access information allowing the device to generate network access credentials for a subsequent network access; and in a network access phase:
generating network access credentials by the device, using said network access information previously received from the authentication system during the once-off registration phase; wherein
the authentication system generates and signs a unique subscriber certificate during the once-off registration phase, and the device downloads the unique subscriber certificate as part of said network access information;
the device uses said unique subscriber certificate to generate and encrypt the network access credentials during the network access phase; and
including the step of the device sending a token to the authentication system, the authentication system using the token to sign the unique subscriber certificate, and the device using the token to subsequently retrieve the signed unique subscriber certificate; and wherein the token is a nonce with a globally unique identifier (GUID) unique reference number.
18. A non-transitory computer readable medium comprising software code adapted to be read by a digital processor to perform the device registration and network access steps of:
in a once-off registration phase:
sending, by the device, registration data in a mobile originating short message via a mobile network to the authentication system,
performing a query to said home mobile network of a subscriber by the authentication system to validate the subscriber and resolve subscriber and device identifiers, and
receiving network access information from the authentication system at the device, said network access information allowing the device to generate network access credentials for a subsequent network access; and
generating network access credentials by the device, using said network access information previously received from the authentication system during the once-off registration phase; wherein
the authentication system generates and signs a unique subscriber certificate during the once-off registration phase, and the device downloads the unique subscriber certificate as part of said network access information;
the device uses said unique subscriber certificate to generate and encrypt the network access credentials during the network access phase; and
including the step of the device sending a token to the authentication system, the authentication system using the token to sign the unique subscriber certificate, and the device using the token to subsequently retrieve the signed unique subscriber certificate; and wherein the token is a nonce with a globally unique identifier (GUID) unique reference number.
19. A non-transitory computer readable medium comprising software code adapted to be read by a digital processor to perform the authentication system registration and network access steps of:
in a once-off registration phase:
sending, by the device, registration data in a mobile originating short message via a mobile network to the authentication system, performing a query to said home mobile network of a subscriber by the authentication system to validate the subscriber and resolve subscriber and device identifiers, and
receiving network access information from the authentication system at the device, said network access information allowing the device to generate network access credentials for a subsequent network access; and
in a network access phase:
generating network access credentials by the device, using said network access information previously received from the authentication system during the once-off registration phase; wherein
the authentication system generates and signs a unique subscriber certificate during the once-off registration phase, and the device downloads the unique subscriber certificate as part of said network access information;
the device uses said unique subscriber certificate to generate and encrypt the network access credentials during the network access phase; and
including the step of the device sending a token to the authentication system, the authentication system using the token to sign the unique subscriber certificate, and the device using the token to subsequently retrieve the signed unique subscriber certificate; and wherein the token is a nonce with a globally unique identifier (GUID) unique reference number.
20. A wireless network access method performed by a subscriber device subscribed to a home mobile network, a WLAN, and an authentication system, the method comprising the steps and sequence of:
in a once-off registration phase:
sending, by the device, registration data in a mobile originating short message via a mobile network to the authentication system,
performing a query to said home mobile network of a subscriber by the authentication system to validate the subscriber and resolve subscriber and device identifiers,
receiving network access information from the authentication system at the device, said network access information allowing the device to generate network access credentials for a subsequent network access; and
in a network access phase:
generating network access credentials by the device, using said network access information previously received from the authentication system during the once-off registration phase; wherein
the authentication system generates and signs a unique subscriber certificate during the once-off registration phase, and the device downloads the unique subscriber certificate as part of said network access information;
the device uses said unique subscriber certificate to generate and encrypt the network access credentials during the network access phase: and
including the step of the device sending a token to the authentication system, the authentication system using the token to sign the unique subscriber certificate, and the device using the token to subsequently retrieve the signed unique subscriber certificate;
and wherein the token is a nonce with a globally unique identifier (GUID) unique reference number.
21. A wireless network access method performed by a subscriber device subscribed to a home mobile network, a WLAN, and an authentication system, the method comprising the steps and sequence of:
in a once-off registration phase:
sending, by the device, registration data in a mobile originating short message via a mobile network to the authentication system, performing a query to said home mobile network of a subscriber by the authentication system to validate the subscriber and resolve subscriber and device identifiers, and
receiving network access information from the authentication system at the device, said network access information allowing the device to generate network access credentials for a subsequent network access; and
in a network access phase:
generating network access credentials by the device, using said network access information previously received from the authentication system during the once-off registration phase; wherein
the authentication system generates and signs a unique subscriber certificate during the once-off registration phase, and the device downloads the unique subscriber certificate as part of said network access information;
the device uses said unique subscriber certificate to generate and encrypt the network access credentials during the network access phase; and
the device downloads the unique subscriber certificate as part of said network access information; and including the step of the device sending a token to the authentication system, the authentication system using the token to sign the unique subscriber certificate, and the device using the token to subsequently retrieve the signed unique subscriber certificate.
22. A subscriber mobile device configured to transmit and receive radiation, the device comprising a processor, wherein the processor is adapted to perform device registration and network access steps of:
in a once-off registration phase:
sending, by the device, registration data in a mobile originating short message via a mobile network to the authentication system, performing a query to said home mobile network of a subscriber by the authentication system to validate the subscriber and resolve subscriber and device identifiers, and
receiving network access information from the authentication system at the device, said network access information allowing the device to generate network access credentials for a subsequent network access; and
in a network access phase:
generating network access credentials by the device, using said network access information previously received from the authentication system during the once-off registration phase; wherein
the authentication system generates and signs a unique subscriber certificate during the once-off registration phase, and the device downloads the unique subscriber certificate as part of said network access information;
the device uses said unique subscriber certificate to generate and encrypt the network access credentials during the network access phase; and
the device downloads the unique subscriber certificate as part of said network access information; and including the step of the device sending a token to the authentication system, the authentication system using the token to sign the unique subscriber certificate, and the device using the token to subsequently retrieve the signed unique subscriber certificate.