Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
  • H04L9/3226—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using a predetermined code, e.g. password, passphrase or PIN
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
  • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
  • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
  • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
  • H04L9/3271—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials using challenge-response
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/06—Authentication
  • H04W12/068—Authentication using credential vaults, e.g. password manager applications or one time password [OTP] applications
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L2209/00—Additional information or applications relating to cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00
  • H04L2209/80—Wireless

Definitions

• the present invention generally relates to accessing communication networks. More particularly, the invention relates to the automatic access of wireless communication networks.
• the exemplary method comprises receiving a credential request from a digital device over a network device, identifying a network record based on at least some information within the credential request, retrieving a network credential from a plurality of network credentials based on the network record, and transmitting a credential request response containing the network credential from the plurality of network credentials to the digital device.
• the method may further comprise decrypting the credential request, authenticating the credential request, and encrypting the credential request response. Further, the method may also comprise retrieving an encryption key based on the digital device.
• the credential request may be received over a standard protocol of the network device.
• the standard protocol may be DNS.
• the credential request may comprise a location identifier.
• the method may further comprise receiving a confirmed access response from the digital device.
• An exemplary system for providing network credentials may comprise a credential request module and a credential request response module .
• the credential request module may be configured to receive a credential request from a digital device over a network device.
• the credential request response module may be configured to identify a network record based on at least some information within the credential request, retrieve a network credential from a plurality of network credentials based on the network record, and transmit a credential request response containing the network credential to the digital device.
• An exemplary computer readable medium may have embodied thereon a program.
• the program may be executable by a processor for performing a method for providing network credentials.
• the method may comprise receiving a credential request from a digital device over a network device, identifying a network record based on at least some information within the credential request, retrieving a network credential from a plurality of network credentials based on the network record, and transmitting a credential request response containing the network credential from the plurality of network credentials to the digital device.
• FIG. 1 is a diagram of an environment in which embodiments of the present invention may be practiced.
• FIG. 2 is a block diagram of an exemplary credential server.
• FIG. 3 is a flow diagram of an exemplary process for providing network access to the digital device.
• FIG. 4 is a block diagram of an exemplary credential request.
• FIG. 5 is a block diagram of an exemplary credential request response.
• FIG. 6 is a flow diagram of the exemplary method for providing network credentials.
• FIG. 7 is another flow diagram of the exemplary method for providing network credentials.
• FIG. 8 is a flow diagram of an exemplary method for receiving and storing network credentials.
• FIG. 9 is a block diagram of an exemplary credential server.
• a credential server receives a request for network credentials from a digital device at a hotspot.
• the request may be formatted as a standard protocol which is relayed from the hotspot to the credential server.
• the credential server may identify a network record based on at least some information contained within the request and transmit network credentials associated with the network record to the digital device.
• the digital device may receive the network credentials and provide them to network device in order to obtain network access.
• FIG. 1 illustrates a diagram of an environment 100 in which embodiments of the present invention may be practiced.
• a user with a digital device 102 enters a hotspot.
• the digital device 102 may automatically transmit a credential request as a standard protocol over a network device 104.
• the credential request may be forwarded to a credential server 116 which, based on the information contained within the credential request, transmits a credential request response back to the digital device 102.
• the credential request response contains network credentials which the digital device 102 may provide to the network device 104, the authentication server 108, or the access controller 112 to obtain access to the communication network 114.
• a hotspot comprises the network device 104, the authentication server 108, the DNS server 110, and the access controller 112 which are coupled to the local area network 106 (e.g., a "walled garden").
• the network device 104 may comprise an access point which allows the digital device 102 to communicate with the authentication server 108, the DNS server 110, and the access controller 112 over the local area network 106.
• the digital device 102 may comprise a laptop, mobile phone, camera, personal digital assistant, or any other computing device.
• the authentication server 108 is a server that requires network credentials from the digital device 102 before allowing the digital device 102 access the communication network 114.
• the DNS server 110 provides DNS services over the local area network 106 and may relay requests to other DNS servers (not shown) across the communication network 114.
• the access controller 112 is an access device such as a router or bridge that can allow communication between devices operationally coupled to the network device 104 with devices coupled to the communication network 114.
• the hotspot in FIG. 1 depicts separate servers coupled to the local area network 106, those skilled in the art will appreciate that there may be any number of devices (e.g., servers, digital devices, access controllers, and network devices) coupled to the local area network 106.
• the local area network 106 is optional.
• the authentication server 108, the DNS server 110, and the access controller 112 are coupled directly to the network device 104.
• the authentication server 108, the DNS server 110, and the access controller 112 may be combined within one or more servers or one or more digital devices.
• FIG. 1 depicts wireless access, the digital device 102 may be coupled to the network device 104 wirelessly or over wires (e.g., such as lObaseT).
• the authentication server 108 may require the digital device 102 to provide one or more network credentials for access to the hotspot.
• the network credential may comprise, for example, a username and password for an account associated with the hotspot.
• network credentials other than a user name and password may be utilized.
• the digital device 102 may dynamically acquire the network credentials from the credential server 116.
• the digital device 102 may send a credential request comprising an identity of the digital device 102 (or the user of the digital device 102) and details about the network device 104 (e.g., name of the network device 104 or Wi-Fi service provider) to the credential server 116.
• the network device 104 may provide an IP address to which DNS queries may be submitted, for example, via DHCP (Dynamic Host Configuration Protocol).
• the credential request may be formatted as a standard protocol.
• the credential request may be formatted as a DNS request.
• the credential request may be a text record request (e.g., TXT), which comprises a standard record type such that the network infrastructure (e.g., the access controller 112) will not block the request. More details regarding the process for acquiring network credentials are provided in co- pending U.S. Patent Application No. , entitled "System and Method for
• the credential request is received by the DNS server 110 which may forward the credential request to the credential server 116 for the network credential.
• the credential server 116 may perform a lookup to determine the proper network credential(s) to send back to the DNS server 110 which forwards the network credential back to the requesting digital device 102.
• the proper network credential(s) are sent from the credential server 116 to the digital device 102 over the same path as the transmission of the credential request.
• the credential request may be forwarded through any number of servers, including but not limited to DNS servers, prior to being received by the credential server 116.
• the credential request is forwarded directly from the network device 104 to the credential server 116.
• a credential request response from the credential server 116 may comprise the username, password, and/or login procedure information.
• the login procedural information may comprise, for example, HTML form element names, a submission URL, or a submission protocol.
• the network credential response may be encrypted by the credential server 116 using an encryption key associated with the digital device 102 prior to transmission back to the digital device 102.
• the digital device 102 may submit the network credential (retrieved from the network credential response) to the network device 104 in an authentication response.
• the authentication response may be forwarded to an authentication server 108 for verification.
• the authentication server 108 may comprise an AAA server or RADIUS server. More details regarding the process for obtaining network access are provided in co-pending U.S. Patent
• FIG. 1 is exemplary. Alternative embodiments may comprise more, less, or functionally equivalent components and still be within the scope of present embodiments.
• the functions of the various servers e.g., DNS server 110, credential server 116, and authentication server 108, may be combined into one or two servers. That if, for example, the authentication server 108 and the DNS server 110 may comprise the same server, or the functionality of the authentication server 108, the DNS server 110, and the access controller 112 may be combined into a single device.
• the credential server 116 comprises an authentication module 200, a network module 202, a credential request module 204, a credential request response module 206, an encryption/decryption module 208, a network record storage 210, and an encryption key storage 212.
• a module may comprise, individually or in combination, software, hardware, firmware, or circuitry.
• the authentication module 200 may be configured to authenticate the credential request and provide security to the credential request response.
• the digital device 102 may encrypt or digitally sign the credential request using an encryption key (e.g., a shared encryption key or an encryption key that is a part of a key pair).
• the authentication module 200 may authenticate the credential request by decrypting the credential request with the proper encryption key retrieved from the encryption key storage 212.
• the digital device 102 generates a hash of the credential request and stores the hash within an encrypted portion of the credential request.
• the authentication module 200 may decrypt the credential request, generate hash of the credential request response, and compare the generated hash to the hash contained within the credential request for authentication.
• the digital device 102 may generate a nonce (i.e., a random value) and store the nonce within a portion of the credential request that is digitally signed.
• the authentication module 200 may decrypt the digital signature to authenticate the credential request and retrieve the nonce.
• the credential request response module 206 when the credential request response module 206 generates the credential request response (described hereafter), the authentication module 200 may include the nonce within the credential request response.
• the authentication module 200 or the encryption/decryption module 208 may then encrypt the credential request response.
• the digital device 102 may retrieve the nonce from the credential request response and compare the nonce to the nonce that was transmitted within the credential request for further authentication.
• the network module 202 may be configured to receive the credential request and transmit the credential request response over the communication network 114.
• the credential request module 204 may receive the credential request from the network module 202.
• the credential request may be a standard protocol.
• the credential request is a UDP protocol (e.g., DNS).
• the credential request module 204 may retrieve the DDID and the SSID from the credential request.
• the DDID may identify the digital device 102, the user of the digital device 102, and/or the user associated with a network record.
• the SSID may identify the hotspot or the service provider (i.e., operator) of the hotspot.
• the credential request module 204 or the credential request response module 206 may identify a network record based on the DDID and the SSID.
• a network record is a record associated (either directly or indirectly (e.g., a relational database)) with the DDID and the SSID.
• a network record contains network credentials necessary to provide network access to a digital device 102 associated with the DDID at the hotspot associated with the SSID.
• Network records may be stored within the network record storage 210.
• the credential request response module 206 may generate the credential request response.
• the credential request response module 206 receives the network credential associated with the DDID and SSID from the network record.
• the network credential may comprise a credit card number.
• the digital device 102 receives the network credential, retrieves the credit card number, and provides the credit card number to the authentication server 108.
• the authentication server 108 may then charge a fee to a credit card associated with the credit card number or use the information to confirm the identity of the user prior to granting network access.
• the network credentials may comprise login procedural information.
• the credentials include a username and password which are to be provided within a form (e.g., an authentication form) retrieved from the authentication server 108 by the digital device 102.
• the login procedural information may instruct the digital device 102 to populate specific fields within the form with the network credentials before submitting the completed form to the authentication server 108.
• a form e.g., an authentication form
• the login procedural information may instruct the digital device 102 to populate specific fields within the form with the network credentials before submitting the completed form to the authentication server 108.
• the credential request response module 206 or the encryption/decryption module 208 may encrypt the credential request response with an encryption key associated with the DDID or the credential request.
• the credential server 116 stores one or more shared encryption keys. Each shared encryption key may be shared by at least one digital device 102.
• the credential request response module 206 may encrypt the credential request response with the shared encryption key associated with the digital device 102 (e.g., the shared encryption key may be associated with the DDID).
• the credential request response module 206 or the encryption/decryption module 208 may also encrypt the credential request with an encryption key that is part of a key pair. There may be many ways in which the encryption/decryption module 208 encrypts the credential request.
• the encryption/decryption module 208 may decrypt the credential request and encrypt the credential request response. As previously discussed, the encryption/decryption module 208 may decrypt the digital signature of the credential request. In one example, the encryption/decryption module 208 decrypts the digital signature based on an encryption key that is associated with the DDID contained within the credential request. The encryption/decryption module 208 may also encrypt the credential request response. In one example, the encryption/decryption module 208 encrypts the credential request response based on an encryption key associated with the DDID (e.g., a shared encryption key or an encryption key that is part of a key pair).
• an encryption key associated with the DDID e.g., a shared encryption key or an encryption key that is part of a key pair.
• the encryption/decryption module 208 may encrypt the network records contained within the network record storage 210 and manage the encryption key storage 212.
• the encryption/decryption module 208 may also establish secure communications (e.g., via SSL and HTTPS) with a digital device when storing network credentials. This process is further described in FIG. 7.
• the encryption/decryption module 208 may be optional.
• the network record storage 210 and the encryption key storage 212 may store network records and encryption keys, respectively.
• the network record storage 210 and the encryption key storage 212 may comprise one or more databases.
• the network record storage 210 may store network records.
• a network record may comprise a DDID, SSID, and network credentials.
• the network record may also comprise a username and password for the user to access, alter, update, or store network records within the credential server 116.
• the network record may also allow multiple digital devices 102 to use the same network credentials.
• the user may own multiple digital devices 102. Multiple DDIDs, each DDID associated with a different digital device 102, may be included in the same network record.
• multiple devices may be associated with one or more network records, and the one or more network records arc associated with a user. As a result, the user may retrieve the network credentials for a hotspot using any number of digital devices 102.
• the network records and/or the information contained therein may be stored and organized (e.g., in different data structures, databases, records, organizing schemes, and/or methodologies).
• FIG. 3 is a flow diagram of an exemplary process for providing network access to the digital device 102.
• the digital device 102 may scan for the local area network 106 in step 300.
• the network device 104 may provide network configuration information in step 302.
• the network configuration information may comprise one or more IP addresses for access to the DNS server 110.
• a credential request is generated by the digital device 102. Subsequently, the credential request may be sent to the DNS server 110 in step 306 using one of the IP addresses previously received from the network device 104.
• the credential server 116 is identified by the DNS server 110 in step 308.
• the DNS server 110 forwards the credential request to the credential server 116.
• the credential request is forwarded to another DNS server on the communication network 114 (e.g., over port 53) which may then forward the credential request to the credential server 116.
• the credential request is forwarded, either directly or indirectly through one or more other DNS servers on the communication network 114, to the credential server 116 in step 310.
• the credential server 116 identifies the network credential needed based on the credential request in step 312.
• the credential request may comprise an identifier (i.e., the DDID) for the digital device 102 as well as an identifier for the hotspot SSID (e.g., the service provider such as an operator).
• the identifiers may be compared against a table (e.g., network record) of such identifiers by the credential request module 204 or the credential request response module 206 to determine the proper network credential.
• a credential request response is then generated by the credential request response module 206 in step 314 and relayed back to the DNS server 110 in step 316.
• the DNS server 110 forwards the credential request response back to the digital device in step 318.
• the digital device 102 may then retrieve the network credentials from the credential request response in step 320.
• the network credential may then be provided to the network device 104 in step 322.
• the network device 104 Upon verifying the network credentials, the network device 104 provides network access to the digital device 102 in step 324.
• the credential request module 204 may generate the credential request 400.
• the credential request 400 may be a DNS string having a structure that comprises a location identifier 402, a sequence identifier 404, a signature 406, the DDlD 408, a service set identifier (SSID) 410, and a version identifier 412.
• the optional location identifier 402 may indicate a physical or geographic location of the digital device 102, the network device 104, the authentication server 108, or the access controller 112. In various embodiments, the location identifier 402 may be used by the credential server 116 to track the usage of hotspots, users of the digital device 102, as well as the digital device 102.
• the sequence identifier 404 may comprise any number or set of numbers used to correspond to a subsequent request to the credential server 116 to determine if the login is successful. That is, the sequence identifier 404 provides a correlation mechanism by which verification of the login process may be made by the credential server 116.
• the signature 406 comprises a cryptographic signature (i.e., digital signature) that is utilized to prevent spoofing.
• the signature 406 of the request from digital device 102 is verified by the credential server 116. If the signature 406 is not valid, then the request is rejected by the credential server 116.
• the DDID 408 comprises an identifier of the digital device 102.
• the DDlD 408 may comprise a MAC address or any other identifier of the digital device 102.
• the SSID 410 comprises an identifier of the network access point or Wi-Fi service provider.
• the SSID 410 may comprise the name of the service provider or the name of the venue operating the network device 104.
• the version identifier 412 may identify the protocol or format of the credential request 400.
• a digital device 102 may generate the credential request 400 and organize the data in a number of different formats. Each different format may be associated with a different version identifier.
• the components of the credential request response module 206 may be updated, reconfigured, or altered over time, which may affect the structure of the credential request 400.
• the credential server 116 may receive a plurality of credential requests 400 which are formatted differently. The credential server 116 may access the required information from each credential request based on the respective version identifier.
• FIC. 5 is a block diagram of an exemplary credential request response.
• the credential request response module 206 may generate the credential request response 500.
• the credential request response 500 may comprise encrypted text 502.
• the encrypted text may comprise an optional nonce 504 and credential information 506.
• the credential information may comprise key/value pairs 508 through 510.
• the credential request response may be formatted as a DNS response comprising encrypted text 502.
• the encrypted text 502 includes the network credentials (e.g., username, password, and login procedure information).
• the credential request response 500 is depicted as including encrypted text 502, the text within the credential request response 500 need not be encrypted.
• the encrypted text 502 may comprise the nonce.
• the nonce as previously discussed, may be retrieved from the credential request. Once the credential request response 500 is received by the digital device 102, the digital device 102 may compare the nonce within the credential request response 500 to the nonce transmitted within the credential request for authentication. Although the nonce is depicted as within the credential request response 500 in FIG. 5, the nonce is optional.
• the credential information 506 may comprise a username, password, login procedure information, or a combination of these.
• the credential information 506 may comprise key/value pairs 508 through 510. Any number of key/value pairs may be within the credential information 506.
• the key/value pairs may represent the credential information to be received and translated by the digital device 102.
• the credential information 506 is depicted as key/value pairs for exemplary purposes only; the credential information may be within any format not necessarily limited to key /value pairs.
• FIG. 6 is a flow diagram of the exemplary method for providing network credentials.
• the credential server 116 receives the credential request from the digital device 102.
• the credential server 116 decrypts and authenticates the digital signature with an encryption key.
• the credential server 116 may then identify a network record based on the DDID and the SSID contained within the network record in step 604.
• the credential request response module 206 retrieves one or more network records associated with the DDID within the credential request.
• the credential request response module 206 then identifies at least one network credential associated with the SSID within the retrieved network record(s).
• the credential request response module 206 retrieves the identified network credential(s) from the selected network record.
• the credential request response module 206 identifies a username and password that the user of the digital device 102 must provide to the authentication server 108 to obtain network access.
• the credential request response module 206 generates the credential request response comprising the network credentials (e.g., username, password) to the digital device 102 in step 608.
• the credential request response module 206 may identify login procedural information as part of the network credentials.
• the credential request response module 206 may retrieve the login procedural information from the network record (e.g., the same network record containing a password associated with the SSID).
• the login procedural information may contain a form identifier and instructions (e.g., parameters) for the digital device 102 to follow to obtain network access.
• the digital device 102 retrieves the form identifier and instructions from the network credential within the credential request response.
• the digital device 102 may identify forms received from the authentication server 108 and input data based on the form identifier and instructions.
• the digital device 102 provides information to the authentication server 108 to obtain network access based on the login procedural information included within the credential request response.
• the process of providing information to the authentication server 108 is further described in U.S. patent application No. entitled “Systems and Methods for Obtaining Network Access", filed September 6, 2007.
• FIG. 7 is another flow diagram of the exemplary method for providing network credentials.
• the digital device 102 may search and find an available wireless network via the network device 104. While connecting to the hotspot, the digital device 102 may receive network configuration information in step 702. Network configuration information may comprise an identifier for the network device 104, or the DNS server 110. In one example, the digital device 102 receives a DNS server IP address (e.g., for the DNS server 110) during the connection process.
• a DNS server IP address e.g., for the DNS server 110
• the digital device 102 generates the credential request.
• the credential request may comprise a sequence identifier, DDID, and SSID.
• the digital device 102 optionally generates a nonce and digitally signs the credential request with an encryption key.
• the digital device 102 transmits the credential request as a standard protocol in step 708.
• the network device 104 may receive and forward the credential request to the communication network 114.
• the network device 104 may provide the credential request to the DNS server 110 which may forward the credential request to the credential server 116.
• the credential request module 204 of the credential server 116 receives the credential request.
• the credential request module 204 may retrieve an encryption key associated with the DDID within the credential server from the encryption key storage 212.
• the credential request module 204 may then decrypt the digital signature of the credential request for authentication.
• the credential request module 204 may further retrieve the nonce and a sequence identifier from the credential request.
• the credential request response module 206 of the credential server 116 may then retrieve a network record associated with the DDID and the SSlD from the network record storage 210.
• the credential request response module 206 retrieves network credentials from the network record and generates the credential request response.
• the credential request response may comprise the network credentials and the nonce.
• the encryption/decryption module 208 may encrypt the credential request response with an encryption key associated with the DDID retrieved from the encryption key storage 212.
• the credential request response is formatted as a standard protocol (e.g., DNS).
• the digital device 102 receives the credential request response.
• the digital device 102 subsequently authenticates the credential request response in step 712.
• the digital device 102 decrypts the credential request response with the same encryption key used to digitally sign the credential request.
• the digital device 102 may further retrieve the nonce within the credential request response and compare the nonce to the nonce transmitted within the credential request for further authentication. Tf the credential request response is found to be authentic, the digital device 102 retrieves the network credentials from the credential request response in step 714.
• the digital device 102 identifies the authentication requirements associated with network access. In various embodiments, the digital device 102 determines the correct information and network credentials to provide to the authentication server 108. In one example, the digital device 102 retrieves one or more network access pages from the authentication server 108. The digital device 102 may access the correct network access page from the authentication server and automatically make selections. In one example, the digital device 102 may automatically activate selections (e.g., activate buttons within the network access page, check boxes, and select radio buttons).
• selections e.g., activate buttons within the network access page, check boxes, and select radio buttons.
• the credential request response module 206 may provide instructions to the digital device 102 for the automatic selections within a network access page.
• a network access page may comprise one or more web pages, one or more tags, or a combination of both retrieved from the authentication server 108.
• software within the digital device 102 may automatically check all selection boxes within a network access page. The digital device 102 may then uncheck select boxes based on the login procedure information. Those skilled in the art will appreciate that there may be many methods with which selections may automatically be made.
• the digital device 102 receives XML tags from the authentication server 108. The digital device 102 may provide information based on the XML tags and instructions within the login procedural information to the authentication server 108 to obtain network access.
• the digital device 102 provides the network credential to the network device 104 to obtain network access to the communication network 114.
• the credential request response module 206 retrieves one or more forms from the authentication server 108, populates the forms with one or more network credentials, and provides the completed forms to the authentication server 108.
• the credential request response module 206 provides the network credentials as needed to the authentication server 108. Once the network credentials are received by the authentication server 108, the authentication server 108 may allow communication between the digital device 102 and the communication network 114. In one example, the authentication server 108 commands the access controller 112 to allow the digital device 102 access to the communication network 114.
• the digital device 102 may subsequently test network connectivity to confirm network access.
• the digital device 102 transmits a request to the credential server 116 to determine if the communication network 114 is available.
• the query or command contains the sequence identifier previously submitted within the credential request. If network access is successful, the credential server 116 may receive the request and retrieve the sequence identifier. The credential server 116 may then confirm that network access was successful. .
• FIG. 8 is a flow diagram of an exemplary method for receiving and storing network credentials.
• users may create and store network records within the credential server 116.
• the credential server 116 may comprise a credential storage module (not depicted) that provides a graphical user interface (GUI) that allows users to create, store, update, remove, and modify network records.
• the credential server 116 provides the user with a network credential request form.
• the credential server 116 provides the network credential request form to a user as one or more web pages over the Internet.
• the network credential request form is configured to receive the service provider's name (e.g., operator's name) and/or SSlD and network credentials.
• the service provider's name may comprise the name of the entity that operates the hotspot, one or more components related to the hotspot (e.g., the network device 104), or the infrastructure of the local area network 106.
• the service provider's name comprises the name of an organization that manages one or more hotspots for another service provider. In one example, a coffee shop and bookstore may both use a third-party manager to manage the hotspots, even if the hotspots have different service providers.
• the network credential request form may be configured to receive the third-party manager's name.
• the service provider's name comprises the name of an organization that resells access to a hotspot network (e.g., an aggregator).
• the network credential request form may also receive the SSID as a network service selection.
• the network credential request form comprises a pull down menu of different service providers and/or hotspots that the user may select. For example, a user may select "Starbucks" or "San Francisco International Airport" as a hotspot. The user may be given further options to such as geographic locations of the hotspot. The user may also select the service provider. For example, the user may select "T-Mobile" as a service provider. The network credential request form may then allow the user to select among one or more various hotspots associated with T-Mobile. The selection(s) may then be stored as a network record. Alternately, a network service identifier associated with the selection(s) is generated as the SSID.
• the network credential request form may receive the network credential from the user. For example, the user may enter a username, password, passcode as network credentials within the network credential request form.
• the network credential request form determines the type of network credentials required. For example, the network credential request form identifies the information required to access a network at a hotspot at the San Francisco International Airport previously selected by the user. The network credential request form then generates fields or selections to allow the user to enter only the information necessary (e.g., username, password) to obtain network access at the hotspot.
• the credential server 116 may also require the user to register prior to receiving the network credential request form. During registration, the user may be required to agree to terms of service and enter customer information. Customer information comprises a username and a password to access the credential server 116 to store network credentials. Optionally, the customer information may comprise the user's address, contact information, and payment options for the user to vise services offered by the credential server 116.
• the credential server 116 receives the customer information and network service selections over the network credential request form.
• the credential server may retrieve the network credential.
• the credential server 116 receives the customer information.
• the credential server 116 associates the network credential with the customer information, network service selection and network credential (s) in step 810 to create a network record.
• the network record is then stored in step 812.
• the user may manually access the credential server 116 via the Internet.
• the user may download and install network credential software on the digital device 102.
• the network credential software may identify and send the DDID of the digital device 102 to the credential server 116.
• the network credential software may be pre-installed on the digital device 102.
• the network credential software may identify and send the DDID of the digital device 102 to the credential server.
• the user may input the SSID (e.g., identify the service provider or hotspots) into the network credential software.
• the user may also input the network credentials within the network credential software.
• the network credential software may upload the information to the credential server 116 which stores the information within a network record.
• the network credential software may be downloaded from the credential server 116.
• FIG. 9 is a block diagram of an exemplary digital device.
• the credential server 116 comprises a processor 900, a memory system 902, a storage system 904, an I/O interface 906, a communication network interface 908, and a display interface 910.
• the processor 900 is configured to execute executable instructions (e.g., programs).
• the processor 900 comprises circuitry or any processor capable of ⁇ >rocessing the executable instructions.
• the memory system 902 is any memory configured to store data. Some examples of the memory system 902 are storage devices, such as RAM or ROM. The memory system 902 can comprise the ram cache. In various embodiments, data is stored within the memory system 902. The data within the memory system 902 may be cleared or ultimately transferred to the storage system 904.
• the storage system 904 is any storage configured to retrieve and store data. Some examples of the storage system 904 are flash drives, hard drives, optical drives, and/or magnetic tape.
• the credential server 116 includes a memory system 902 in the form of RAM and a storage system 904 in the form of flash data. Both the memory system 902 and the storage system 904 comprise computer readable media which may store instructions or programs that are executable by a computer processor including the processor 900.
• the optional input/output (I/O) interface 906 is any device that receives input from the user and output data.
• the optional display interface 910 is any device that is configured to output graphics and data to a display.
• the display interface 910 is a graphics adapter. It will be appreciated that not all digital devices 102 comprise either the I/O interface 906 or the display interface 910.
• the communication network interface (com. network interface) 908 can be coupled to a network (e.g., the local area network 106 and communication network 114) via the link 912.
• the communication network interface 908 may support communication over an Ethernet connection, a serial connection, a parallel connection, or an ATA connection, for example.
• the communication network interface 908 may also support wireless communication (e.g., 802.11 a/b/g/n, WiMax). It will be apparent to those skilled in the art that the communication network interface 908 can support many wired and wireless standards.
• the above-described functions and components can be comprised of instructions that are stored on a storage medium.
• the instructions can be retrieved and executed by a processor.
• Some examples of instructions are software, program code, and firmware.
• Some examples of storage medium are memory devices, tape, disks, integrated circuits, and servers.
• the instructions are operational when executed by the processor to direct the processor to operate in accord with embodiments of the present invention. Those skilled in the art are familiar with instructions, processor(s), and storage medium.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Security & Cryptography (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Computer Hardware Design (AREA)
• Computing Systems (AREA)
• General Engineering & Computer Science (AREA)
• Mobile Radio Communication Systems (AREA)
• Data Exchanges In Wide-Area Networks (AREA)
• Storage Device Security (AREA)

Applications Claiming Priority (2)

Publications (2)

Family

ID=39157841

Family Applications (3)

Family Applications After (2)

Country Status (3)

Cited By (1)

Families Citing this family (11)

Citations (3)

Family Cites Families (12)

• 2007
  • 2007-09-06 WO PCT/US2007/019463 patent/WO2008030526A2/en active Application Filing
  • 2007-09-06 EP EP07837822A patent/EP2062129A4/de not_active Withdrawn
  • 2007-09-06 WO PCT/US2007/019464 patent/WO2008030527A2/en active Application Filing
  • 2007-09-06 WO PCT/US2007/019462 patent/WO2008030525A2/en active Application Filing
  • 2007-09-06 JP JP2009527411A patent/JP5276592B2/ja not_active Expired - Fee Related
  • 2007-09-06 EP EP07837823A patent/EP2062130A4/de not_active Withdrawn
  • 2007-09-06 JP JP2009527412A patent/JP5276593B2/ja not_active Expired - Fee Related
  • 2007-09-06 JP JP2009527410A patent/JP5368307B2/ja not_active Expired - Fee Related
  • 2007-09-06 EP EP07837824A patent/EP2060050A4/de not_active Withdrawn

Patent Citations (3)

Non-Patent Citations (2)

Also Published As

Similar Documents

Legal Events