KR101230209B1 - Common data model and method for secure online signup for hotspot networks - Google Patents

Abstract

PURPOSE: A common data model for hotspot networks and a method for a safe online signature are provided to generate and store a subscription MO(Management Object). CONSTITUTION: A subscription MO includes a plurality of nodes. A plurality of the nodes includes a subscription node(241) defining a provisioned subscription for a service by a service provider. The subscription node includes at least one of a home operator node(242) and a credential node(246). The home operator node specifies home operation information about a related subscription. The credential node includes a credential related to the related subscription.

Description

Common Data Models for Hotspot Networks and Methods for Secure Online Signing {COMMON DATA MODEL AND METHOD FOR SECURE ONLINE SIGNUP FOR HOTSPOT NETWORKS}

[Related Application]

This application is filed June 30, 2011, U.S. Patent Application No. 13 / 173,338, entitled "MOBILE DEVICE AND METHOD FOR AUTOMATIC CONNECTIVITY, DATA OFFLOADING AND ROAMING BETWEEN NETWORKS" (Agent No. 884.J38US1, client reference number P37992). And US patent application Ser. No. 13 / 188,205, filed Jul. 21, 2011, entitled "SECURE ONLINE SIGNUP AND PROVISIONING FOR WI-FI HOTSPOTS USING A DEVICE-MANAGEMENT PROTOCOL" (Agent No. 884.J39US1, client reference number P37993). Related to.

[Technical Field]

Embodiments relate to wireless communication. Some embodiments relate to a wireless network, such as a wireless fidelity (WiFi) network. Some embodiments relate to the provisioning of secure online signatures and credentials for a service and the connection may comprise a subscription establishment. Some embodiments relate to secure online signatures for hotspot 2.0 networks.

The WiFi infrastructure is the WiFi alliance's hotspot, intended to enable seamless connectivity and traffic offloading from third generation (3G) and fourth generation (4G) cellular networks to hotspot 2.0 enabled WiFi networks. 2.0 program has been developed. One issue related to seamless connection and traffic offload is that there is no standardized process for secure online signing, provisioning of credentials, and establishing subscriptions for WiFi enabled devices and networks. There is also no standardized data model to specify credentials and policy parameters for subscription to enable seamless connection and traffic offload for such WiFi enabled devices. There is also no standardized procedure for updating such subscriptions, including updating the policy parameters and credentials of such subscriptions.

Thus, there is a general need for a method and subscription servers for secure online signing with a common data model for hotspot networks. What is also required is a common data model that enables traffic offload as well as seamless connectivity for hotspot 2.0 networks.

1 illustrates an operating environment of network components for provisioning secure online signatures and credentials in accordance with some embodiments.
2A is a graphical representation of a subscription management object (MO) for hotspot 2.0 provisioning in accordance with some embodiments.
2B-2G illustrate the state, occurrence, format, and minimum access type for the components of the subscription MO of FIG. 2A in accordance with some embodiments.
3 is a functional block diagram of a mobile device in accordance with some embodiments.
4 illustrates a message exchanged as part of a procedure for updating a subscription in accordance with some embodiments.
5 is a functional block diagram of a subscription server in accordance with some embodiments.

The following description and the drawings sufficiently describe specific embodiments to enable those skilled in the art to practice. Other embodiments may include structural, logical, electrical, process, and other changes. Portions and features of some embodiments may be included in or replaced with parts and features of other embodiments. Embodiments described in the claims include all possible equivalents of those embodiments.

1 illustrates an operating environment of network components for provisioning of credentials and secure online signatures in accordance with some embodiments. Mobile device 102 can be a WiFi enabled device configured to perform various operations described herein for secure online signing and provisioning and to be associated with WiFi hotspot 104. WiFi hotspot 104 may provide Internet access over a wireless local area network (WLAN) to a router that is connected to a link to an Internet service provider (SP). WiFi hotspot 104 may be part of a WiFi network and may be connected to a network 105 such as the Internet, inter alia, a certification authority 120, a subscription server 106, an active portal 108, an authentication registration server 110. And other various network components, which may include a registrar 122. In some embodiments, subscription server 106 may be a server configured to exchange messages according to the Simple Object Access Protocol (SOAP) extensible markup language (XML) technique, although the scope of the embodiments is not limited in this regard. . The WiFi hotspot 104 may operate as a WiFi access point (AP). Mobile device 102 can include a SOAP processing component 125 that is configured to implement SOAP-XML techniques and perform the various operations described herein. Similarly, subscription server 106 may include a SOAP processing component 135 configured to implement SOAP-XML techniques as described in more detail below.

In some embodiments, WiFi hotspot 104 may include an access controller (AC) 124 to serve as a management entity for WiFi hotspot 104. The access controller 124 can manage several access points of the WiFi network and can act as a gateway for the WLAN access network to provide access to other networks, such as the Internet. Access controller 124 may perform various operations described herein to allow mobile device access to a WiFi network.

According to embodiments, mobile device 102 may be configured for provisioning secure online signatures and provisioning for WiFi hotspots. In some embodiments, mobile device 102 can be configured for secure online signing and provisioning for WiFi hotspots using SOAP-XML techniques. In such embodiments, mobile device 102 and subscription server 106 may exchange request and response messages configured according to a protocol such as SOAP.

The secure online signing and provisioning process described herein uses a SOAP-XML technique as a transport in a secure manner so that users can establish a subscription with a service provider and apply operator policies and credentials to a client device, such as mobile device 102. Make it available for download. This may allow cellular-type network service providers who may already be implementing SOAP-XML techniques in their back-end core network to use the same servers and installed components to extend the functionality for servicing the WiFi network.

Some embodiments provide a standardized process for secure online signing and provisioning credentials. Credentials may include username / password credentials, authentication-based credentials, and subscriber-information module (SIM) type credentials. The standardization process for secure online signing and provisioning credentials can be applicable to almost any IEEE 802.11-based network, making the process applicable to both open and secure networks. For example, a secure WiFi network may implement security in accordance with a robust-secure network (RSN) protocol. Such a network can be considered an RSN network (ie, a secure network that allows the creation of robust secure network associations (RSNAs)). In some embodiments, provisioning secure online signatures and credentials can be performed automatically without user interaction.

According to embodiments, mobile device 102 may be configured for secure online signing and provisioning for a WiFi hotspot 2.0 network. In these embodiments, mobile device 102 may be configured to authenticate with the WiFi network via WiFi hotspot 104 using Extensible Authentication Protocol (EAP) technique. As part of the authentication, a RADIUS ACCESS-ACCEPT message is sent from the authentication, authorization, and accounting (AAA) server 126 to allow mobile device 102 access to the WiFi network and establish a WiFi connection with the mobile device 102. Received by hotspot 104. Mobile device 102 may perform an initial SOAP exchange with subscription server 106 over a Wi-Fi connection established to request provisioning of credentials for request subscription establishment. The initial SOAP exchange may include a mobile device that authenticates the subscription server 106. The mobile device can also establish a subscription with the service provider for Wi-Fi network access, to provision the credentials for the subscription, and to generate a subscription MO for the provisioned credentials. Information). Mobile device 102 may also perform a final SOAP exchange with subscription server 106 over the Wi-Fi network to receive the subscription MO.

In these embodiments, in response to receiving the RADIUS ACCESS-ACCEPT message, the Wi-Fi hotspot 104 is configured to send an EAP-success message to the mobile device 102 indicating successful authentication. In some embodiments, authentication of the subscription server 106 as well as association with the Wi-Fi hotspot 104, initial and final SOAP exchanges, can be performed without user input (ie, automatically). In some embodiments, the exchange of information with the subscription server 106 for establishing a subscription may also be performed without user input in accordance with the required information. In some embodiments, usage may be caused for user input.

In some embodiments, the initial SOAP exchange may include providing at least some device capability information of the mobile device 102 and indicating a reason for the request (eg, provisioning a credential or establishing a subscription). have. If the reason for the request is provisioning of the credentials, the subscription server 106 may indicate the type of credentials to be provisioned.

In some embodiments, the initial and final SOAP exchanges comprise messages constructed according to a SOAP technique that uses a secure hypertext transfer protocol (ie, HTTPS) as the application layer protocol for transmission. The messages can be organized according to the XML message format. HTTPS can include a combination of SSL / TLS (Secure-Socket Layer Transport-Layer Security) protocol and HTTP to provide secure and encrypted communication.

In some embodiments, the RADIUS ACCESS-ACCEPT message can include access restrictions to be enforced by the Wi-Fi hotspot 104. Access is limited to restrict the mobile device 102's access to the Wi-Fi network for provisioning and subscription establishment and updating of credentials. The Wi-Fi hotspot 104 defines mobile device 102 by the capability of first and final SOAP exchanges and information exchange with a service provider for either provisioning of a credential, subscription establishment or subscription update. It can be configured to enforce access restrictions.

After receiving the subscription MO, the mobile device may be configured to disassociate with the Wi-Fi hotspot 104 after the last SOAP exchange and reassociate with the Wi-Fi hotspot 104 to reestablish the Wi-Fi connection. In the case of reassociation, mobile device 102 can be configured to use the EAP technique and can provide provisioned credentials to AAA server 126 via a reestablished Wi-Fi connection. The RADIUS ACCESS-ACCEPT message may be received at the Wi-Fi hotspot 104 from the AAA server 126 to authorize the mobile device 102 to access the Wi-Fi network in accordance with the user's subscription. In some embodiments, reassociating with disconnecting may be performed without any user interaction. Wi-Fi hotspot 104 is configured to implement the access restrictions indicated in the RADIUS ACCESS-ACCEPT message associated with the user's subscription.

In some embodiments, as part of the initial SOAP exchange with subscription server 106, subscription server 106 determines the type of credentials to be provisioned for mobile device 102 and indicates the type of credentials to be provisioned. Can be configured. The type of credentials to be provisioned may include one of a certificate based credential, a username / password credential, or a subscription-information module SIM type credential. Provisioning of the credentials may include exchanging SOAP configured messages as described in more detail below. The type of credentials to be provisioned can be determined by the operator or service provider. Operator policies can be used to determine the type of credentials to provision and use for authentication.

According to embodiments, mobile device 102 may be configured with registrar information, such as a uniform or universal resource locator (URL) of registrar 122. Registrar 122 includes service provider entries, which may include a service provider fully qualified domain name (FQDN), a service provider friendly name, and a service provider online signup root trust. can do. Registrar 122 may provide a cryptographic binding between the service provider domain name and other data. Registrar 122 is used by mobile device 102 to establish a trust relationship between mobile device 102 and an online signature server, such as subscription server 106. When mobile device 102 initiates an online signature, it can query registrar 122 for metadata of the online signature server and verify the authenticity of the online signature service provider. Mobile device 102 can also download registry information in advance, store it locally, and use it when it initiates the secure online signing and provisioning process disclosed herein. If mobile device 102 is a dual-mode mobile device (eg, has both cellular network capability and Wi-Fi network capability), mobile device 102 may also retrieve online signature server information and It may be configured to query the registrar 122 in real time using a cellular network connection to verify reliability.

According to embodiments, the mobile device 102 is associated with a Wi-Fi hotspot 104 of the Wi-Fi network and via the Wi-Fi hotspot 104 to receive a digital certificate of the subscription server 106. It may be configured to establish a TLS session with 106. According to embodiments, mobile device 102 may exchange information with active portal 108 via a secure HTTP connection established to provision a subscription for Wi-Fi network access and generate a subscription MO. The subscription MO is based on the type of credentials (e.g. username / password, SIM-type or authentication-based) provisioned for automatic connectivity to specific Wi-Fi networks, which may include hotspot 2.0 networks. Can include criteria for.

For username / password credentials, the subscription MO may include a username and password. For SIM-type credentials, the subscription MO may include at least some basic information about the SIM-type credentials. In the case of authentication-based credentials, the subscription MO may include information for accessing the authentication-based credentials.

While many embodiments are disclosed herein for secure online signing and provisioning for Wi-Fi hotspot 2.0 networks, the scope of the present invention is not limited in this respect. Other embodiments may be applied to secure online signing and provisioning for other types of networks, which may include other WLANs and cellular-type networks.

According to some embodiments, certification authority 120 may be a Hotspot 2.0 Certificate Authority (CA) (ie, a Root Trust) and may be configured to issue certificates that may include hotspot 2.0 certificates. . Registrar 122 may be where a company or organization is registered as a Hotspot 2.0 service provider. Registrar 122 may include an already registered FQDN and / or a selected friendly name. The FQDN owner can be identified in the publicly available "WHOIS" database. Registrar 122 may exercise rules for registration that may allow denial of the requested friendly name, if inappropriate. Registrar 122 may maintain a database of registered service providers according to their friendly names and remove invalid entries.

According to embodiments, mobile device 102 may obtain one or more hotspot 2.0 root certificate (s) from certificate authority 120, where the root certificate identifies the FQDN of the server, which is HTTPS based for online signing. It can indicate that it can be used for provisioning authentication and credentials. The hotspot 2.0 service provider may provision a subscription server 106 with certificates from the certification authority 120 and may provision appropriate policy settings for the online subscription server 106. These embodiments are described in more detail below.

AAA server 126 is a Dynamic Host Configuration Protocol (DHCP) server 127 for dynamic assignment of network elements, eg, IP addresses, and Domain Name Translation (DNS), which performs domain name translation as well as other networking operations. Server 128).

In some embodiments, Wi-Fi hotspot 104 may be a Wi-Fi hotspot 2.0 that operates according to a hotspot 2.0 evolution specification, such as the Wi-Fi Alliance's hotspot 2.0 evolution specification. The mobile device 102 can be a hotspot 2.0 enabled device and the subscription information can include pre-provisioned subscription information for automatic connection to the Wi-Fi hotspot 2.0. A Wi-Fi network may be a wireless network that may include a Wi-Fi hotspot configured to operate in accordance with one of the IEEE 802.11 standards (and amendments to it) for a WLAN.

The Wi-Fi network may use a collision avoidance technique such as carrier-sense multiple access with collision avoidance (CSMA / CA) in which upstream and downstream communications use the same frequency channels according to a time division multiplexing process. Some Wi-Fi networks may use orthogonal frequency division multiplexing (OFDM). On the other hand, cellular networks, such as 4G Long Term Evolution (LTE) networks and WiMAX networks, implement orthogonal frequency division multiple access (OFDMA) technology. Third generation (3G) cellular networks may use code-division multiple access (CDMA) technology. In some embodiments, mobile device 102 can be a dual mode device having a physical layer circuit configured for communicating with both Wi-Fi and cellular networks.

2A is a graphical representation of a subscription MO 200 for hotspot 2.0 provisioning in accordance with some embodiments. A subscription server, such as subscription 106 (FIG. 1), may be configured to create and store subscription MO 200. The subscription MO 200 includes a plurality of nodes, including a subscription container node 201 that can function as a container for subscription. The subscription container node 201 may include an optional name leaf node 202 that may include a name for the associated subscription and a subscription node 241.

Subscription node 241 defines the subscription that has been provisioned by the Wi-Fi service provider for the service. The subscription node 241 includes for each subscription a home operator node 242 that specifies at least home operation information for an associated subscription, and a credential node 246 that may include credentials for an associated subscription. Can be. Subscription node 241 may optionally include a policy node 244 that identifies an operator policy for an associated subscription, and a subscription management node 245 that identifies subscription management parameters for an associated subscription.

Subscription MO 200 may be a subscription provisioning MO. According to these embodiments, subscription server 106 may be configured to provision a mobile device, such as mobile device 102 (FIG. 1), with subscription MO 200. When provisioned with a subscription MO, the mobile device 102 selects the Wi-Fi hotspot 2.0 104 of the Wi-Fi network according to the subscription information of the subscription MO 200 and uses the mobile device 102 for use in subscribing to it. It can be configured to create an instance of the subscription MO (200) within). The subscription MO 200 may be in the form of a data structure and may be added to the device management tree of the mobile device 102.

In FIG. 2, the symbol “?” Indicates that the occurrence of an associated element may be zero or one. Zero occurrences mean that the element is optional. The symbol "+" indicates that there may be more than one occurrence of an associated element (ie, an element is required). The subscription MO 200 may include subscription and policy specific parameters that support subscription with the service providers. The subscription MO 200 may be defined according to the Open Mobile Alliance (OMA) device management tree and specification, but this is not a requirement because it may also be defined according to the SOAP-XML protocol. According to these embodiments, the network creating and updating the subscription MO 200 to provision the mobile device 102 may communicate via either OMA-DM or SOAP-XML protocols. Mobile device 102 can be a Wi-Fi hotspot 2.0 capable device and can use HTTPS as the transport mechanism while connecting to the subscription servers of the service provider. Mobile device 102 can use provisioned subscription MO 200 to select and authenticate a network according to identifiers, policies, credentials, and associated metadata contained therein. In some embodiments, the identifier for subscription MO 200 may be in the form of “urn: wfa: mo: hotspot2dot0-subscription: 1.0”.

According to some embodiments, subscription node 241 functions as a placeholder for subscription instance information for one or more subscriptions. The subscription node 241 may include a subscription server URI leaf node 251 that specifies a uniform resource identifier (URI) of the subscription server. In some embodiments, subscription server URI leaf node 251 may be formatted according to RFC3986. Mobile device 102 can be configured to send subscription confirmation commands to subscription server 106 to update subscription specific information as described in more detail below.

According to some embodiments, home operator node 242 may include network ID node 252 for network identification related information. The network ID node 252 may include one or more leaf nodes 254, 255 that specify the Wi-Fi network name of the Wi-Fi network to which the subscription is applicable. The Wi-Fi network name can be specified according to the Wi-Fi standard. In some embodiments, network ID node 252 may be a placeholder for network ID related information, and container node 253 may be a container for network identifiers of each service provider's home network. For example, leaf node 254 may specify a Wi-Fi network name formatted according to IEEE 802.11-2007. For example, leaf node 255 may specify an IEEE 802.11u homogeneous extended service set (ESS) identifier of a Wi-Fi network formatted according to IEEE 802.11u, although the scope of the embodiments is similar to this. It is not limited in this regard.

According to some embodiments, home operator node 242 is leaf node 256 specifying a friendly name of a home operator for an associated subscription, home operator in a predetermined format (eg, formatted according to RFC1035). A leaf node 257 that specifies the FQDN of the region, and a region leaf node 258 that specifies the region of the home operator in a predetermined format (eg, formatted according to RFC4282). The home operator node 242 also includes organizational identifiers identifying the home service provider in a predetermined format (eg, in accordance with IEEE 802.11u), and the URI and update interval parameter 264 of the home service provider for receiving updates. It may include a leaf node 259 including an update node 263, which may include). In these embodiments, update node 263 is an optional internal node that is a placeholder for home operator related information. The update interval parameter 264 may be an interval value regarding the time that the mobile device 102 must connect to the subscription server 106 to update the subscription information when the account was created. In some embodiments, a value of zero can be used to indicate that subscription management update is not used. The update interval parameter 264 may be units corresponding to time.

The URI of the home operator service provider may be included in leaf node 265 to specify the URI of the home operator's server formatted according to RFC3986. Mobile device 102 can be configured to send home operator information verification commands to a home operator server. The friendly name of the home operator service provider may be a human language name selected by the home operator service provider.

According to some embodiments, home operator node 242 may include a roaming consortium OI (which may include organizational identifiers identifying any roaming consortiums whose service provider is a member (eg, in accordance with IEEE 802.11u)). organizational identifiers) node 260 may optionally be included. In these embodiments, node 260 is an optional internal node that serves as a placeholder for a list of organizational identifiers identifying roaming consortiums in which the service provider is a member. Container node 261 is an optional internal node that is a container for a list of organization identifiers, and leaf node 262 may include the organization identifier of the roaming consortium.

According to some embodiments, policy node 244 may include a roaming partner priority list, an operator blacklist node 276 that may include an operator blacklist that lists operator friendly names undesirable by the home operator, and a policy. Roaming partner list node 271 that identifies a policy server node 279 that identifies a server. Roaming partner list node 271 may include an internal container node 272 that identifies the desired operator in the roaming partner priority list. Roaming partner list node 271 may include a leaf node 273 that specifies an operator's FQDN in a priority list that may be formatted according to RFC1035. The roaming partner list node 271 can also include a leaf node 274 that is an operator organizational identifier for the service provider in the roaming partner priority list. Leaf node 275 may specify an operator's priority in the priority list. In some embodiments, the lower the value of priority, the higher the preference. The format of priority may be an 8-bit unsigned integer, but the scope of embodiments is not limited in this regard.

In some embodiments, operator blacklist node 276 may include an internal container node 277 that includes an operator blacklist, which is a list of operator friendly names that are not preferred by the home operator. This internal container node 277 can serve as a container for operator friendly names in the operator blacklist. Leaf node 278 may specify the FQDN of the blacklisted operator. The FQDN may be formatted according to RFC1035. In some embodiments, subscription MO 200 may allow a user to manually select a network on an operator blacklist.

According to some embodiments, policy server node 279 is a leaf node 283 that specifies the URI of a policy server in a predetermined format (eg, formatted according to RFC 3986), and an update interval for policy updates. It may include a leaf node 280 specifying the. In these embodiments, leaf node 280 may specify how often mobile device 102 should check policy server 106 for policy updates. In some embodiments, the format of the update interval can be a 32-bit unsigned integer, the value of which can be specified in minutes. In some embodiments, OMA DM procedures can be used to update a policy.

In some embodiments, policy server node 279 may include a leaf node 281 that specifies how the operator uses to update the policy. Some example values for leaf node 281 may include 'ClientInitiated' or 'ServerInitiatedHTTPPush'. If the value is ClientInitiated, there is a CheckInterval. In some embodiments, policy server node 279 may include a leaf node 282 that specifies the hotspots for which the policy is allowed to be updated. Possible values include 'HomeOperator', 'RoamingPartner', or 'Unrestricted'. In some embodiments, policy server node 279 may include a leaf node 284 that specifies a client account of the DM server. In some embodiments, the DMAcc management object may be specified according to the OMA-DM standardized object specification (eg, OMADMSTDOBJ). In some embodiments, mobile device 102 may be configured to send policy confirmation commands to the URI of the policy server identified at leaf node 283.

According to some embodiments, credential node 246 may include at least one username-password internal node 232 that acts as a container for username and password values of the credential, for a username. Username leaf node 233, and password leaf node 234 for passwords. Credential node 246 may also include a digital certificate internal node 236, which serves as a container for certificate-based credentials. Credential node 246 is authentication-type leaf node 237 specifying authentication type, authentication-issuer leaf node 238 specifying certificate issuer, and serial-number leaf node 239 specifying serial number of authentication. ) May be included. In these embodiments, the credential node 246 may include a date leaf node 221 which may include a parameter specifying the date and time (eg, UTC) when the subscription account was created. The date and time may have the format YYYY-MM-DDTHH: MM: SSZ, where YYYY is a year of 4 digits, MM is a month of 2 digits with a value of 1 to 12, and DD is of 1 to 31 Value is 2 digits of a day, HH is the time of day in units of 24 hours with a value of 0 to 23, MM is a minute with a value of 0 to 59, and SS is a minute with a value of 0 to 59 Seconds. One example of a creation date is "2011-01-30T08: 31: 14Z".

In some embodiments, the credential node 246 may also include an expiration date leaf node 222 that includes a parameter specifying a date and time (eg, UTC) when the credential will expire. This is an optional attribute and if it does not exist there may be no predetermined expiration time and date. The format of the expiration date may be the same as the creation date.

In some embodiments, the username leaf node 233 may specify a username formatted according to a network access identifier (NAI) compliant with RFC-4282. Note that the region is not included in this parameter because it is provided to the region leaf node 258 discussed above.

In some embodiments, the username-password internal node 232 may include a machine-managed leaf node 235 that may include an optional parameter specifying whether the password is machine-managed. . This is an optional attribute that, when not present, indicates that the password is not machine managed. In some embodiments, the value of leaf node 235 may be a Boolean indicating that the password is machine-managed and that the mobile device 102 will be configured to prevent the user from changing the value of the password. .

In some embodiments, although the scope of the embodiments is not limited in this respect, authentication-type leaf node 237 specifies an authentication type and may be a value selected from IEEE 802.1ar or "x509v3" authentication types. In some embodiments, certificate-issuer leaf node 238 may specify a common name of the RDN, which may be a generator name in the certificate.

In some embodiments, credential node 246 may include a creation date leaf node 230 that specifies the date and time at which the credential was generated. Credential node 246 may also include an expiration date leaf node 231 that specifies the expiration date and time of the credential.

In some embodiments, subscription management node 245 is a creation date leaf node 221 specifying the date and time the subscription was created, an expiration date leaf node 222 specifying the date and time the subscription expired, and It may include an optional usage-limit node 224 that specifies cumulative usage statistics limits for this subscription. In some embodiments, the date and time of both creation date leaf node 221 and expiration date leaf node 222 may be formatted as YYYY-MM-DDTHH: MM: SSZ. Although the scope of an embodiment is not limited thereto, the expiration date leaf node 222 is optional, and if not present, there may be no predetermined expiration time and date.

In some embodiments, subscription management node 245 may also include subscription-type leaf node 223, which may include an optional parameter that specifies the type of subscription associated with the account. Some example values for subscription-type leaf node 223 may include "Platinum", "Gold", "Silver", "Bronze", or other vendor specific values.

The usage limit node 224 may include a start date leaf node 225 that may include a parameter specifying a date and time at which usage statistics accumulation begins. The start date leaf node 225 may have the same format as the creation date leaf node 221. Usage limit node 224 may also include an optional data limit leaf node 226 that specifies data limits (eg, in megabytes) that accumulate during a defined reset interval, if present. If the value of this parameter is zero or does not exist, there may be unlimited data usage for this account. When this limit is reached, the home service provider may be configured to charge a higher fee or to disassociate mobile device 102 from the network, for example.

The usage limit node 224 may also include a time limit leaf node 227 that specifies, in minutes, the time limit that accumulates during the defined reset interval. If the value of this parameter is zero or does not exist, there may be unlimited time usage for this account. When this limit is reached, the home service provider may be configured to charge a higher fee or to disassociate mobile device 102 from the network, for example. The usage limit node 224 can include a reset-interval leaf node 228 that can include a parameter that specifies a value for usage. A value of zero can be used to indicate that resetting usage is not periodic (e.g. one time limit for pay as you go service). A nonzero value may specify the usage reset interval (eg, in seconds).

In some embodiments, subscription MO 200 may also include an optional vendor extension (Ext) node 203 that stores vendor specific information about subscription MO 200. The optional vendor extension node 203 is an internal node (as shown) where vendor specific information for the subscription MO is located. The vendor may be an application vendor, a device vendor, an access point (AP) vendor, or the like. Vendor extensions may be identified by vendor specific name under optional vendor extension node 203. In some embodiments, the tree structure under optional vendor extension node 203 is undefined and may be configured to include one or more non-standard subtrees.

In some embodiments, at least some nodes of subscription MO 200 are encoded according to a multi-byte character encoding format. In some embodiments, the multi-byte character encoding format may be UTF-8, which refers to an 8-bit universal character set (UCS) conversion format that uses multibyte character encoding for Unicode. Other multibyte character encoding formats may also be suitable.

2B-2G illustrate the status, occurrence, format, and minimum access types for the components of the subscription MO of FIG. 2A in accordance with some embodiments. The status field may indicate whether a component is required or optional. The occurrence field may indicate zero, one, zero or one, or one or more indicating the number of occurrences of the component. The format field may indicate whether the component is a character (CHR) format, a Boolean, or a leaf node (NODE) or an internal (INT) node.

3 illustrates a mobile device in accordance with some embodiments. Mobile device 300 may be suitable for use as mobile device 102 (FIG. 1) and is configured to perform the various operations discussed herein for secure online registration and credential provisioning, as well as subscription establishment and updating. Can be.

Mobile device 300 can include physical layer circuitry 302 configured to wirelessly communicate with Wi-Fi hotspots, such as Wi-Fi hotspot 104, using one or more antennas 301. Mobile device 300 can also include processing circuitry 304 that can be configured to perform the operations described herein. Mobile device 300 also includes, among other things, data storage elements such as memory 306 for storing subscription MOs such as subscription information MO 200 (FIG. 2A), as well as other elements of the managed object tree. can do. Processing circuit 304 may include, for example, a SOAP processing element for performing the various SOAP techniques described herein. Mobile device 300 may also include MAC layer circuitry for media access control to perform other operations, and other functional elements such as touch screen 308.

In some embodiments, mobile device 300 can be configured to associate with a Wi-Fi network via a Wi-Fi hotspot using an EAP technique. Mobile device 300 may also be configured to perform an initial SOAP exchange with subscription server 106 (FIG. 1) over the established Wi-Fi connection to request provisioning of the credentials for subscription establishment. The initial SOAP exchange can include the mobile device 300 authenticating the subscription server 106. Mobile device 300 may also establish a subscription to the service provider for Wi-Fi network access and exchange information with subscription server 106 to create an instance of subscription MO 200 for the provisioned credentials. Can be configured. Mobile device 300 may also be configured to perform a final SOAP exchange with the subscription server over the Wi-Fi network to receive subscription MO 200.

In the case of a single mode mobile device, the physical layer circuitry 302 may be configured to communicate with a Wi-Fi network. In dual mode embodiments, physical layer circuitry 302 may be configured to communicate with both a cellular network and a Wi-Fi network. In dual mode embodiments, mobile device 300 may include both a Wi-Fi transceiver and one or more cellular network transceivers. In dual mode embodiments, mobile device 300 may also be configured to offload traffic from a cellular network to available Wi-Fi networks, although the scope of the embodiments is not limited in this regard.

Mobile device 300 may be a personal digital assistant (PDA), laptop or portable computer with wireless communication capability, web tablet, wireless telephone, smartphone, wireless headset, pager, instant messaging device, digital camera, access point, television, medical Or a portable wireless communication device such as a health device, entertainment device, or other device capable of receiving and / or transmitting information wirelessly.

Antennas 301 may include one or more directional or omni-directional antennas, including, for example, dipole antennas, monopole antennas, patch antennas, loop antennas, microstrip antennas or other types of antennas suitable for transmission of RF signals. . In some embodiments, instead of two or more antennas, one antenna having a plurality of apertures may be used. In such embodiments, each aperture may be considered an individual antenna. In some multiple-input multiple-output (MIMO) embodiments, the antennas 301 are different from the spatial diversity that may be caused between each of the antennas 301 and the antennas of another communication device or station. It can be effectively separated to take advantage of channel characteristics.

Although mobile device 300 is illustrated as having several individual functional elements, one or more of the functional elements may be combined, and software such as processing elements including a digital signal processor (DSP) and / or other hardware elements. It can be implemented by combinations of elements constituted by. For example, some elements include at least one or more microprocessors, DSPs, application specific integrated circuits (ASICs), radio frequency integrated circuits (RFICs), and combinations of various hardware and logic circuits to perform at least the functions described herein. can do. In some embodiments, functional elements of mobile device 300 may refer to one or more processes operating on one or more processing elements.

In some embodiments, mobile device 300 may include one or more of a keyboard, a display, a nonvolatile memory port, a plurality of antennas, a graphics processor, an application processor, a speaker, and other mobile device components. The display may be a liquid crystal display (LCD) and may include a touch screen, such as touch screen 308.

4 illustrates messages exchanged as part of a procedure for updating subscription information in accordance with some embodiments. At the end of the EAP authentication sequence of operation 402, if the service provider determines that the subscription should be updated, the AAA server of the service provider receives an access acceptance message 403 with a URL redirection to the authenticator (ie, subscription server 106). ) Can be sent. The authenticator may instruct the Wi-Fi hotspot 104 to send a vendor specific action frame 404 to the mobile station 102 indicating the need for an update of its subscription.

In other embodiments, subscription update may be initiated by other techniques (ie, a technique other than receiving the action frame 404). For example, limiting connectivity may indicate to mobile station 102 that a subscription may need to be updated.

In operation 404, the mobile device can initiate a TLS connection to the subscription server 106. If mobile device 102 has a username and password credentials, server-side authentication may be performed. Mobile device 102 can use the Online Certificate Status Protocol (OCSP) in the TLS connection to verify that the authentication of subscription server 106 has not been revoked. If authentication has been revoked, mobile device 102 may be configured to abort the subscription update process. If mobile device 102 cannot initiate a TLS connection to subscription server 106, mobile device 102 may abort the subscription update process. In some embodiments, mobile device 102 may be configured to prevent updating the subscription using (unsafe) HTTP and to use only secure HTTP (ie, HTTPS) for updating the subscription, although The range is not limited in this respect.

In operation 408, the mobile device 102 may be configured to send an ospPostDevData message to the subscription server 106 in accordance with the SOAP technique. The message may be configured to include device information and device details such as the OMA-DM protocol DevInfo and DevDetail. The value for the request reason field may be set to subscription update.

At operation 410, subscription server 106 may request HTTP authentication using a digest method. The digest method may be performed according to the procedures of RFC 5216. Mobile device 102 can provide a username and password digest to the server. If the HTTP authentication is not successful, subscription update may not be possible and the mobile device 102 may be configured to abort the process and notify the user appropriately.

In operation 412, the subscription server 106 may send an ospPostDevDataResponse to the mobile device 102 in accordance with the SOAP technique. The response may include XML data for one or more internal nodes of subscription MO 200 (FIG. 2A). Mobile device 102 can be configured to replace one or more internal nodes of the subscription MO with the updated credentials received in the message. To indicate that the subscription update process is complete, the ospStatus in the ospPostDevDataResponse may be set to "Update Complete".

At operation 414, the mobile device can release the TLS session that was established at operation 404 and disassociate with the Wi-Fi network. Thereafter, mobile device 102 can be re-associated using the updated credentials during the subscription update process.

5 is a functional block diagram of a subscription server in accordance with some embodiments. The subscription server 500 may be suitable for use as the subscription server 106, but other configurations may also be suitable. Subscription server 500 may include a network interface 502 for communicating over one or more networks, such as the Internet, processing circuit 504 including one or more processors for performing the operations described herein, and memory 506. Contains storage elements. According to embodiments, subscription server 500 may be configured to generate subscription MOs, such as subscription MO 200 (FIG. 2A) for provisioning mobile devices described herein.

Embodiments may be implemented in one or a combination of hardware, firmware, and software. Embodiments may also be implemented with instructions stored on a computer readable storage device, which instructions may be read and executed by at least one processor to perform the operations described herein. The computer readable storage device can include any non-transitory mechanism for storing information in a form readable by a machine (eg, a computer). For example, computer readable storage devices may include ROM, RAM, magnetic disk storage media, optical storage media, flash memory devices, and other storage devices and media. In some embodiments, mobile device 102 and subscription server 106 may include one or more processors and may consist of instructions stored in a computer readable storage device. In some embodiments, the non-transitory computer readable storage medium is one to perform operations for causing the mobile device to select and subscribe to a Wi-Fi hotspot 2.0 of the Wi-Fi network according to the subscription information of the subscription MO 200. Stores instructions including a subscription MO 200 executed by the above processors.

37 C.F.R., which requires a summary that will allow the reader to identify the nature and gist of the technical disclosure. A summary is provided to comply with paragraph 1.72 (b). It is presented on the condition that it is not used to limit or interpret the scope or meaning of the claims. The following claims are hereby incorporated into the detailed description, with each claim standing on its own as a separate embodiment.

102: mobile device
104: WiFi hotspot
105: network
106: subscription server
108: active portal
110: certificate registration server
120: certification authority
122: registrar
124: access controller

Claims (22)

A subscription server configured to create and store a subscription management object (MO),
The subscription MO includes a plurality of nodes including a subscription node defining a subscription provisioned for a service by a service provider, wherein the subscription node comprises at least:
A home operator node specifying home operation information for the associated subscription; And
A subscription server comprising a credentials node containing credentials for the associated subscription. The method of claim 1,
The subscription MO is a subscription provisioning MO,
The subscription server is further configured to provision the subscription MO to a mobile device,
When the subscription MO is provisioned, the mobile device is configured to create an instance of the subscription MO within the mobile device for use in selecting and subscribing to a wireless hotspot of a wireless network according to the subscription information of the subscription MO. Affiliate server. The method of claim 2,
The subscription node serves as a placeholder for subscription instance information for one or more subscriptions,
The subscription node includes a subscription server URI leaf node that specifies a uniform resource identifier (URI) of the subscription server. The method of claim 1,
The home operator node includes a network ID node for network identity related information, and the network ID node includes one or more leaf nodes each specifying a wireless network name of a wireless network to which the subscription is applicable. 5. The method of claim 4,
The home operator node,
A leaf node specifying a friendly name of a home operator for the associated subscription;
A leaf node specifying a fully qualified domain name (FQDN) of the home operator in a predetermined format;
An area leaf node specifying a realm of the home operator in a predetermined format;
A leaf node comprising organizational identifiers identifying a home service provider in a predetermined formation; And
A subscription server comprising an update node comprising a URI and an update interval parameter of the home service provider for receiving updates. The method of claim 5,
The home operator node optionally includes a roaming consortium organization identifier node comprising organization identifiers (OIs) identifying any roaming consortiums to which the service provider is a member. The method of claim 1,
The subscription MO,
A policy node identifying an operator policy for the associated subscription; And
A subscription management node identifying subscription management parameters for the associated subscription
Subscription server, optionally including. The method of claim 7, wherein
The policy node,
A roaming partner list node identifying a roaming partner priority list;
An operator blacklist node comprising an operator blacklist listing operator friendly names not preferred by the home operator; And
Policy Server node identifying the Policy Server
Subscription server comprising a. 9. The method of claim 8,
The policy server node,
A leaf node specifying a URI of the policy server in a predetermined format; And
Leaf node specifying the update interval for policy updates
Subscription server comprising a. The method of claim 7, wherein
The subscription management node,
A creation date leaf node specifying a date and time at which the subscription was created;
An expiration date leaf node specifying an expiration date and time for the subscription; And
An optional usage limit node specifying cumulative usage statistics limits for the subscription
Subscription server comprising a. The method of claim 1,
The credential node,
A username-password internal node that acts as a container for username and password values of the credential, and includes a username leaf node for the username, and a password leaf node for the password; And
A digital certificate internal that acts as a container for certificate-based credentials and includes a certificate type leaf node specifying a certificate type, a certificate issuer leaf node specifying a certificate issuer, and a serial number leaf node specifying a certificate's serial number. Node
Subscription server comprising at least one of. The method of claim 1,
The subscription MO includes an optional vendor extension node for storing vendor specific information about the subscription MO. The method of claim 1,
At least some of the nodes of the subscription MO are encoded according to a multi-byte character encoding format. A mobile device comprising a memory storing a subscription management object (MO) and one or more processors configured to perform operations for hotspot connectivity in accordance with subscription information of the subscription MO,
The subscription MO includes a plurality of nodes including a subscription node defining a subscription provisioned for service by a service provider, the subscription node comprising at least:
A home operator node specifying home operation information for an associated subscription; And
And a credential node containing the credential for the associated subscription. 15. The method of claim 14,
The subscription MO,
A policy node identifying an operator policy for the associated subscription; And
Optionally including a subscription management node identifying subscription management parameters for the associated subscription,
The policy node,
A roaming partner list node identifying a roaming partner priority list;
An operator blacklist node comprising an operator blacklist listing operator friendly names not preferred by the home operator; And
Contains a Policy Server node that identifies the Policy Server.
The subscription management node,
A creation date leaf node specifying a date and time at which the subscription was created;
An expiration date leaf node specifying an expiration date and time for the subscription; And
An optional usage limit node specifying cumulative usage statistics limits for the subscription
≪ / RTI > 16. The method of claim 15,
The mobile device comprising:
Configured to associate with a wireless network via a wireless hotspot using Extensible Authentication Protocol (EAP) techniques—as part of the association, allowing the mobile device to access the wireless network and establish a wireless connection with the mobile device To receive, by the wireless hotspot, a RADIUS ACCESS-ACCEPT message from an AAA server;
Perform an initial Simple Object Access Protocol (SOAP) exchange with a subscription server over a wireless connection established to request provisioning of a credential or to establish a subscription, wherein the initial SOAP exchange allows the mobile device to authenticate the subscription server. Including;-;
Establish a subscription with a service provider for wireless network access, provision credentials for the subscription, and exchange information with the subscription server to create an instance of the subscription MO for the provisioned credentials;
And perform a final SOAP exchange with the subscription server over the wireless network to receive the subscription MO. 17. The method of claim 16,
Once the subscription MO is provisioned, the mobile device is configured to create an instance of the subscription MO within the mobile device for use in selecting and subscribing to a wireless hotspot of a wireless network according to the subscription information of the subscription MO. . 18. The method of claim 17,
The subscription node serves as a placeholder for subscription instance information for one or more subscriptions,
The subscription node comprises a subscription server URI leaf node specifying a URI of the subscription server,
The home operator node includes a network ID node for network identity related information and the network ID node includes one or more leaf nodes each specifying a wireless network name of a wireless network to which the subscription is applicable;
The policy server node,
A leaf node specifying the URI of the policy server in a predetermined format; And
A mobile device comprising a leaf node specifying an update interval for policy updates. 18. The method of claim 17,
The credential node,
A username-password internal node that acts as a container for username and password values of the credential and includes a username leaf node for the username and a password leaf node for the password; And
A digital certificate internal node that acts as a container for certificate-based credentials and includes a certificate type leaf node that specifies the certificate type, a certificate issuer leaf node that specifies the certificate issuer, and a serial number leaf node that specifies the serial number of the certificate.
A mobile device comprising at least one of the. A non-transitory computer readable storage medium for storing instructions to be executed by one or more processors to select a hotspot of a wireless network according to subscription information of a subscription management object (MO) and to subscribe to it.
The subscription MO includes a plurality of nodes including a subscription node that defines a subscription provisioned for service by a wireless network service provider, wherein the subscription node comprises at least:
A home operator node specifying home operation information for the associated subscription and
A credential node containing the credential for the associated subscription,
Optionally,
A policy node identifying an operator policy for the associated subscription; And
A non-transitory computer readable storage medium comprising a subscription management node identifying subscription management parameters for the associated subscription. 21. The method of claim 20,
The subscription node serves as a placeholder for subscription instance information for one or more subscriptions,
The subscription node comprises a subscription server URI leaf node specifying a URI of a subscription server,
The home operator node includes a network ID node for network identity related information, the network ID node includes one or more leaf nodes each specifying a wireless network name of the wireless network to which the subscription is applicable,
The Policy Server node is
A leaf node specifying a URI of the policy server in a predetermined format; And
A non-transitory computer readable storage medium comprising a leaf node specifying an update interval for policy updates. The method of claim 21,
The credential node,
A username-password internal node that acts as a container for username and password values of the credential and includes a username leaf node for the username and a password leaf node for the password; And
A digital certificate internal node that acts as a container for certificate-based credentials and includes a certificate type leaf node that specifies the certificate type, a certificate issuer leaf node that specifies the certificate issuer, and a serial number leaf node that specifies the serial number of the certificate.
A non-transitory computer readable storage medium comprising at least one of the following.

Images