JP5276593B2 - System and method for obtaining network credentials - Google Patents

Description

  The present invention relates generally to access to communication networks. More particularly, the present invention relates to automatic access of wireless communication networks.

  The increased use of networks to access information has resulted in greater reliance on communication networks for diverse activities. This dependency comes with a bulge of expectations that network access will be ubiquitous. Network access for mobile users has been particularly enhanced by improvements in wireless technology. Various cellular (eg, GSM, CDMA, and the like), Wi-Fi (ie, IEEE 802.11), WiMAX (ie, IEEE 802.16), and other technologies have potential Enabled a wide range of access options for intelligent network users. Many wireless access points or “hot spots” are accessible only in a local geographic area, and in some cases are narrowed to a specific business or other address. In addition, strategically located hotspots can provide public or private network access for diverse groups of people.

  Hotspot owners or managers often require passwords and the like to allow user access. As a result, multiple hotspot users may have to store, store, or otherwise manage multiple passwords. Many users store their passwords on the laptop computer that they use to access the hotspot. However, not all devices capable of accessing hotspots are laptop computers, and now mobile phones, personal digital assistants (PDAs), and many other devices have wireless access capabilities. Unfortunately, users often cannot easily enter a password on the device or store the password in the device. For example, some devices capable of wireless access may not have a keyboard. Even when the device includes a keyboard, the keyboard is often small and limited in functionality, especially for users with limited fingertip dexterity.

  When a user stores a password on a laptop computer, the user must first approach the laptop computer and store the correct password in the computer. When changing the password, the user is required to update the password in the computer. In addition, storing a username and password in the device presents a security issue if the device is lost or stolen.

  In addition, users are typically required to enter passwords, usernames, and to navigate web sites to gain network access. This process is time consuming and the user may enter incorrect information and is forced to re-enter data.

  When users manually enter passwords, they do not try to remember too many difficult passwords. As a result, simple password access and unencrypted access are susceptible to hacking, which may compromise the user's network access, hotspots, and / or the user's personal information. Furthermore, if a user's simple password is hacked or simply guessed, the user's network access may be stolen.

  Exemplary methods and systems for obtaining network credentials for network access are described. This exemplary method includes receiving network configuration information from a network device on a communication network, generating a credential request, sending the credential request to a credential server, and using the network device's standard protocol. And receiving the credential request response and providing the network credential from the credential request response to the network device for accessing the communication network.

  Further, the method can include encrypting the credential request, decrypting the credential request response (plain culture), and digitally signing the credential request. The standard protocol may be the DNS over user datagram protocol (UDP). Further, the credential request can include a location identifier that can be based on at least some of a digital device identifier (DDID) and network configuration information.

  The credential request response can include a command that does not cause the credential request response to be cached. Providing credentials from a credential request response can include analyzing the network access page and writing form information in the network access page.

  An exemplary system for obtaining a network credential can include a network module, a credential request module, a credential engine, and a network access engine. The network module can be configured to receive network configuration information from network devices on the communication network and to send a credential request to the credential server via the network device standard protocol. The credential request module can be configured to generate a credential request. The credential engine can be configured to receive a credential request response. The network access engine can be configured to provide network credentials from the credential request response to the network device for accessing the communication network.

  An exemplary computer readable medium may have a program recorded thereon. The program may be executable by a processor to perform a method for obtaining network credentials. The method receives network configuration information from a network device on a communication network, generates a credential request, and sends the credential request to the credential server via the network device standard protocol. Receiving the credential request response and providing the network credential from the credential request response to the network device for accessing the communication network.

1 is a schematic diagram of an environment in which embodiments of the present invention may be implemented. 1 is a block diagram of an exemplary digital device. 2 is a flowchart of an exemplary process for providing network access to a digital device. FIG. 3 is a block diagram of an exemplary credential request. 2 is a flowchart of an exemplary method for obtaining network credentials. 6 is a flowchart of another exemplary method for obtaining network credentials. 1 is a block diagram of an exemplary digital device.

  Embodiments of the present invention provide systems and methods for obtaining network credentials. In the exemplary embodiment, a digital device is associated with the user. An access controller (eg, associated with a hotspot access point) authenticates or otherwise uses network hotspots to use digital hotspots to access a communications network (E.g. username and password) After the negotiation of the connection between the digital device and the network device, but before the credentials are provided, the digital device uses a standard protocol to send the credentials request to the network device. Can be sent. The credential server receives the credential request and identifies the correct credential to access the communication network. The credential server can return the network credential along with the credential request response to the digital device, which subsequently provides the network credential to gain access to the communication network. In one embodiment, the communication network includes the Internet.

  FIG. 1 illustrates a schematic diagram of an environment 100 in which embodiments of the present invention may be implemented. In the exemplary embodiment, a user enters a hotspot with digital device 102. The digital device 102 can automatically send a credential request as a standard protocol via the network device 104. The credential request may be forwarded to the credential server 116, which sends a credential request response to the digital device 102 based on the information included in the credential request. Will be returned. The credential request response includes a network credential that the digital device 102 can provide to the network device 104, the authentication server 108, or the access controller 112 to gain access to the communication network 114. .

  In various embodiments, the hotspot includes a network device 104, an authentication server 108, a DNS server 110, and an access controller 112, which are coupled to a local area network 106 (eg, “Walled Garden”). Is done. Network device 104 can include an access point that enables digital device 102 to communicate with authentication server 108, DNS server 110, and access controller 112 via local area network 106. Digital device 102 may include a laptop, mobile phone, camera, personal digital assistant, or any other computing device. The authentication server 108 is a server that requests network credentials from the digital device 102 before allowing the digital device 102 to access communications over the communication network 114. The network credentials can include username, password, and login procedure information. The DNS server 110 can provide DNS services across the local area network 106 and relay requests across the communication network 114 to other DNS servers (not shown). Access controller 112 is an access device, such as a router or bridge, that can enable communication between devices functionally coupled to network device 104 and devices coupled to communication network 114.

  Although the hotspots in FIG. 1 illustrate separate servers coupled to the local area network 106, those skilled in the art will recognize any number of devices (eg, servers) coupled to the local area network 106. Will recognize that digital devices, access controllers, and network devices) can exist. In some embodiments, a local area network 106 is optional. In one example, authentication server 108, DNS server 110, and access controller 112 are directly coupled to network device 104. In various implementations, the authentication server 108, DNS server 110, and access controller 112 may be coupled into one or more servers or one or more digital devices. In addition, although FIG. 1 illustrates wireless access, the digital device 102 may be coupled to the network device 104 via wireless or wired (such as ten base tee (10baseT)).

  To access the communication network 114, the authentication server 108 may request the digital device 102 to provide one or more network credentials for access to the hotspot. The network credentials can include, for example, a username and password for an account associated with the hotspot. In alternative embodiments, network credentials other than username and password may be utilized.

  According to an exemplary embodiment, digital device 102 can dynamically obtain network credentials from credential server 116. The digital device 102 is the identity of the digital device 102 (or the user of the digital device 102) and details about the network device 104 (eg, the name of the network device 104 or the Wi-Fi service provider). Can be sent to the credential server 116.

  In one example, when the digital device 102 enters a hotspot, the network device 104 may provide a destination IP address that can submit a DNS query via, for example, DHCP (Dynamic Host Configuration Protocol). Can be provided. The credential request can be formatted as a standard protocol. In one example, the credential request can be formatted as a DNS request. The credential request can be a text record request (eg, TXT) that includes a standard record type so that the network infrastructure (eg, access controller 112) does not block the request.

  In some implementations, a credential request is received by DNS server 110, which can forward the credential request to credential server 116 for network credentials. In the exemplary embodiment, the credential server 116 can perform a lookup to determine the proper network credential (s) and send it back to the DNS server 110, which Transfer and return the network credentials to the requesting digital device 102. In various embodiments, the proper network credential (s) is transmitted from the credential server 116 to the digital device 102 via the same path as the transmission of the credential request.

  More details regarding the process for determining and providing network credentials in the credential server 116 can be found in the “System and Method for Applications” filed on September 6, 2007, which is incorporated herein by reference. Co-pending U.S. Patent Application No. __________________________________ System, _____, _______________________ Provisioning Although only one DNS server 110 is illustrated in FIG. 1, before a credential request is received by the credential server 116, it may be passed through any number of servers, including but not limited to a DNS server. May be transferred. In other embodiments, the credential request is forwarded directly from the network device 104 to the credential server 116.

  In some implementations, the credential request response from the credential server 116 can include a username, password, and / or login procedure information. The login procedure information can include, for example, an HTML form element name, a submission URL, or a submission protocol. In some embodiments, the network credential response is encrypted by the credential server 116 using the encryption key associated with the digital device 102 before being sent back to the digital device 102. Sometimes.

  After the digital device 102 receives the network credential response, the digital device 102 can submit the network credential (obtained from the network credential response) to the network device 104 in the authentication response. . In the exemplary implementation, the authentication response may be forwarded to the authentication server 108 for verification. In some implementations, the authentication server 108 can include an AAA server or a RADIUS server. A more detailed description of the process for obtaining network access can be found in “System and Method for Obtaining Network Access” filed on September 6, 2007, which is incorporated herein by reference. System and Method for Observing Network Access) is provided in co-pending U.S. Patent Application No. __.

  It should be noted that FIG. 1 is exemplary. Alternative embodiments may include more, fewer, or functionally equivalent components, but are within the scope of this embodiment. For example, as discussed above, the functions of various servers (eg, DNS server 110, credential server 116, and authentication server 108) may be combined into one or two servers. In other words, for example, if the authentication server 108 and the DNS server 110 can constitute the same server, the functionality of the authentication server 108, the DNS server 110, and the access controller 112 can be combined into a single device. .

  FIG. 2 is a block diagram of an exemplary digital device. The digital device 102 includes an authentication module 200, a network module 202, a credential request module 204, a credential engine 206, an encryption / decryption module 208, a DDID (digital data interface device) storage 210, and Includes a network access engine 212. Modules can include software, hardware, firmware, or circuitry, individually or in combination.

  The authentication module 200 can be configured to provide security for the credential request, authenticate the credential request response, and establish secure communication between the digital device 102 and the authentication server 108. In various embodiments, the authentication module 200 provides security to the credential request by digitally signing the credential request. In one example, the credential request is signed using an encryption key shared with the credential server 116.

  The authentication module 200 decrypts the credential request response received from the credential server 116 by using an encryption key (for example, a shared encryption key). Can be authenticated by. In some implementations, the encryption / decryption module 208 decrypts the credential request response.

  In various embodiments, the authentication module 200 can generate a random value (ie, a nonce value) and include that value in the credential request. When a credential request response is received, obtain a nonce from the credential request response and compare it with a random value included in the credential request response for additional authentication of the credential request response Can do.

  Network module 202 may be configured to perform operations to access communication network 114. In some implementations, the network module 202 can receive and transmit communications associated with access to the hotspot. In one example, the network module 202 negotiates an initial connection through the digital device 102 and the network device 104.

  In some implementations, the network module 202 can perform a search of the communication network 114. For example, the network module 214 can attempt to connect to the communication network 114 when the digital device 102 enters a hot spot. If digital device 102 cannot access communication network 114, it may be possible to implement the embodiments of the invention described herein.

  The credential request module 204 can generate and send a credential request. The credential request can be a standard protocol. In one example, the credential request is a UDP protocol.

  In various embodiments, the credential request module 204 obtains a network device identifier from the network device 104. In one example, the network device identifier is the service set identifier (SSID) of the network device. The network device identifier can then be included in the credential request. Alternatively, the credential request module 204 can identify the service provider from the network access page provided by the network device 104. The credential request module 204 can then provide the service provider identifier in the credential request.

  The network access page can include web pages or information (eg, XML tags) received from the authentication server 108. In response to the network access page, the digital device 102 can provide information (eg, network credentials or response) to the authentication server 108 to gain network access. In one example, the network access page includes a number of web pages received by the digital device 102 from the authentication server 108 and / or the network device 104. In another example, the network access page includes one or more tags or a combination of web pages and tags.

  The credential request module 204 can also include a digital device identifier (DDID) and / or a user identifier in the credential request. In various embodiments, the DDID can include a MAC address, a unique identifier, or any other identifier that identifies the digital device 102. The user identifier can be any identifier (eg, username or passcode) that identifies the owner or user of the digital device 102.

  The example credential engine 206 can receive a credential request response and obtain a network credential. In some embodiments, the credential request response is decrypted by the encryption / decryption module 208 and nonce authenticated by the authentication module 200.

  As discussed above, the obtained network credentials may contain login procedure information. In one example, the credentials include a username and password that are provided in a form obtained from the authentication server 108. In some embodiments, the login procedure information fills certain fields in the form with the correct credentials before submitting the completed form to the authentication server 108 to the credential engine 206. I can instruct you. Those skilled in the art will recognize that there are many ways to provide credentials to the authentication server 108. The process of providing credentials to the authentication server is entitled “Systems and Methods for Obtaining Network Access” filed on September 6, 2007, and is entitled “Systems and Methods for Obtaining Network Access”. Are further discussed in co-pending US Patent Application No. ___.

  The encryption / decryption module 208 is configured to encrypt or decrypt communications transmitted / received by the digital device 102. In some implementations, the credential request response may be encrypted by the credential server 116. In these implementations, the encryption / decryption module 208 will decrypt the credential request response. In various embodiments, the encryption / decryption module 208 can establish secure communication between the digital device 102 and the authentication server 108. In one example, the encryption / decryption module 208 can establish secure communication between the digital device 102 and the authentication server 108 via SSL and https. It should be noted that the encryption / decryption module 208 may be optional according to some embodiments.

  The DDID storage 210 stores the DDID. The DDID may be obtained by the credential request module 204 from the DDID storage 210 when the credential request is generated. DDID storage 210 can be optional (eg, when DDID is the MAC address of digital device 102). The DDID storage 210 may also include a user identifier that identifies the owner or user of the digital device 102 or the owner of the account associated with the credential server 116. In some implementations, the user identifier includes the identifier of the user associated with the account on the credential server 116.

  The example network access engine 212 can be configured to receive an authentication request and provide an authentication response to the network device 104 to include network credentials.

  FIG. 3 is a flowchart of an exemplary process for providing network access to digital device 102. When the digital device 102 first enters the hot spot, the digital device 102 (eg, the network module 214) may perform a scan for the local area network 106 at step 300. As a result of the scan, the network device 104 can provide network configuration information at step 302. The network configuration information can include one or more IP addresses for accessing the DNS server 110.

  In step 304, a credential request is generated by the digital device 102. As discussed above in connection with FIG. 2, the credential request module 240 can generate a credential request. Subsequently, a credential request can be sent to the DNS server 110 at step 306 using one of the IP addresses previously received from the network device 104.

  Based on the credential request, the credential server 116 is identified by the DNS server 110 at step 308. The DNS server 110 forwards the credential request to the credential server 116. If the DNS server 110 cannot resolve the DNS request locally, the credential request is forwarded to another DNS server on the communication network 114, which then forwards the credential request to the credential server 116. can do. The credential request is forwarded to the credential server 116 in step 310, either directly or indirectly through one or more other DNS servers on the communication network 114.

  The credential server 116 identifies the required network credential at step 312 based on the credential request. For example, a credential request can include an identifier for a digital device 102 (ie, a DDID) as well as an identifier for a hot spot (eg, a service provider such as an operator). The identifier can be compared with a table of such identifiers at the credential server 116 to determine the proper network credentials. Thereafter, a credential request response is generated at step 314 and relayed to the DNS server 110 at step 316. The DNS server 110 forwards this credential request response to the digital device at step 318.

  The digital device 102 can then obtain network credentials from the credential request response at step 320. In the exemplary embodiment, the acquisition module 224 will analyze the credential request response and obtain the network credentials embedded therein.

  Thereafter, in step 322, network credentials can be provided to the network device 104. An exemplary method for providing network credentials to a network device (and subsequently to the authentication server 108) was filed on September 6, 2007, “Systems and Methods for Obtain”. In co-pending U.S. Patent Application No. ____________________________________ (Systems and Methods for Obtaining Network Access). Once the network credentials are verified, the network device 104 provides network access to the digital device 102 at step 324.

  Referring now to FIG. 4, an exemplary credential request 400 is shown in more detail. According to an exemplary implementation, request module 220 can generate credential request 400. In one embodiment, the credential request 400 is a DNS string having a structure that includes a location identifier 402, a sequence identifier 404, a signature 406, a DDID 408, a service set identifier (SSID) 410, and a version identifier 412. It can be.

  Optional location identifier 402 may indicate the physical or geographical location of digital device 102, network device 104, authentication server 108, or access controller 112. In various embodiments, the location identifier 402 may be used by the credential server 116 to track the digital device 102, including hot spot usage, users of the digital device 102, and the like.

  The sequence identifier 404 can include any number or set of numbers used to respond to subsequent requests to the credential server 116 to determine whether the login is successful. That is, the sequence identifier 404 provides a correlation mechanism whereby the login process can be verified by the credential server 116.

  In the exemplary embodiment, signature 406 includes a cryptographic signature that is used to prevent spoofing. The request signature 406 from the digital device 102 is verified by the credential server 116. If the signature 406 is not valid, the credential server 116 rejects the request.

  DDID 408 contains a unique identifier for digital device 102. For example, DDID 408 can include the MAC address of digital device 102 or any other universally unique identifier. In the exemplary embodiment, the DDID is retrieved from DDID storage 210.

  The SSID 410 contains the identifier of the network access point or Wi-Fi service provider. For example, the SSID 410 can include the name of the service provider or the location where the network device 104 operates.

  The version identifier 412 can identify the protocol or format of the credential request 400. For example, the digital device 102 can generate the credential request 400 and organize the data in a number of different formats. Each different format can be associated with a different version identifier. In some implementations, the components of the credential engine 206 and the network access engine 212 may be updated, reconfigured, or changed over time, which is the credential request 400. May affect the structure. As a result, the credential server 116 may receive multiple credential requests 400 that are formatted differently. The credential server 116 can access the necessary information from each credential request based on the respective version identifier.

  FIG. 5 is a flowchart of an exemplary method for obtaining network credentials. In step 502, the digital device 102 receives network configuration information. In one example, the network module 202 searches for and locates available wireless networks via the network device 104. Network module 202 negotiates a connection with network device 104. During the negotiation, the network module 202 may receive network configuration information. The network configuration information can include identifiers for the network device 104 and the DNS server 110. In one example, during the negotiation, the network module 202 receives a DNS server IP address (eg, for the DNS server 110). The network module 202 may also receive an identifier of a service provider associated with the authentication server 108 (eg, T-mobile).

  In step 504, the digital device 102 generates a credential request. In various embodiments, the credential request module 204 generates a credential request. The credential request can include a sequence identifier, DDID, and SSID. In various embodiments, the credential request module 204 generates a nonce and digitally signs the credential request with an encryption key.

  In step 506, the digital device 102 sends a credential request using a standard protocol. Network device 104 can receive the credential request and forward it to communication network 114. In various embodiments, network device 104 can provide a credential request to authentication server 108, DNS server 110, or access controller 112, which can also forward the credential request.

  The credential server 116 can receive a credential request. In various embodiments, the credential server 116 decrypts the digital signature using the encryption key and authenticates the digital signature. The credential server 116 can then identify the proper network credential based on the information included in the credential request. The network credential can be embedded in the credential request response and is sent back to the digital device 102.

  In step 508, the digital device 102 receives the credential request response and obtains network credentials. In one example, the credential engine 206 receives and authenticates the credential request response. If the credential request response is authenticated, a network credential is obtained from the credential request response.

  In step 510, the digital device 102 provides network credentials to the network device 104 to gain network access to the communication network 114. In one example, the credential engine 206 obtains one or more forms from the authentication server 108, fills the form with one or more credentials, and passes the completed form to the authentication server 108. provide. In another example, the credential engine 206 provides network credentials to the authentication server 108 when needed. Once the network credentials are received by the authentication server 108, the authentication server 108 can allow communication between the digital device 102 and the communication network 114. In one example, the authentication server 108 instructs the access controller 112 to allow communication.

  FIG. 6 is another flowchart of an exemplary method for obtaining network credentials. In step 602, the digital device 102 receives network configuration information. In step 604, the digital device 102 tests network connectivity. For example, after a connection is negotiated through the network device 104, the network module 202 can attempt to connect to the web site. In response, the authentication server 108 or the access controller 112 can redirect the attempted connection to a network access page requesting network credentials. In various embodiments, the credential request module 204 can identify a service provider associated with the authentication server 108 through a network access page.

  In step 606, the digital device 102 generates a credential request. In various embodiments, the credential request identifies a DDID and network access point (eg, network device 104, authentication server 108, or service provider) that identifies a user associated with the digital device 102. Includes SSID. The credential request can also include a sequence identifier and a version identifier.

  In step 608, the digital device 102 digitally signs the credential request. In various embodiments, a nonce is generated and included in the digital signature. In one example, the credential request is encrypted using an encryption key (eg, one of a pair of keys or an encryption key shared with the credential server 116).

  In step 610, the digital device 102 sends a credential request to the credential server 116 via a standard protocol. In one example, a credential request is sent to the DNS server 110 identified by the DNS server IP address received in the network configuration information. In some implementations, the DNS server 110 treats the credential request as a DNS request that cannot be resolved locally and forwards the credential request to another DNS server via the communication network 114. Finally, the credential server 116 can receive the forwarded credential request.

  The credential server 116 can authenticate the digital signature and obtain a nonce in the credential request. The credential server 116 then uses the DDID and SSID included in the credential server 116 to determine and retrieve the correct network credential from the records included in the credential server 116. It can be carried out. Subsequently, the credential server 116 generates a credential request response that includes the nonce and network credentials. The credential request response is encrypted using an encryption key (eg, an encryption key of a key pair or a shared encryption key). In various embodiments, the encrypted credential request response includes a nonce received from the digital device 102 in the credential request. A credential request response is then returned to the digital device 102.

  The credential server 116 can store the sequence identifier. In various implementations, the sequence identifier can be used to determine whether the digital device 102 has successfully gained access to the communication network 114. Further, the credential request response can include a command that makes the credential request response cache-free. In response to this cache-less command, the intermediate DNS server (that is, the DNS server that relays the credential request response between the credential server 116 and the digital device 102) does not cache the credential request response. . In some implementations, in response to this command, the digital device 102 may not perform a credential request response cache or DNS library update.

  The process by which the credential server 116 generates the credential request response is described in Systems and Methods for Obtaining Network Access filed on September 6, 2007. Is further discussed in co-pending US Patent Application No. ______

  In step 612, digital device 102 receives a credential request response from credential server 116. In step 614, the digital device 102 decrypts the credential request response. In one example, the digital device 102 decrypts the credential request response using the encryption key and obtains a nonce from the credential request response.

  In step 616, the digital device 102 authenticates the credential request response. In various embodiments, the digital device 102 determines authenticity based on the successful decryption of the credential request response. In some implementations, the nonce obtained from the credential request response is compared with the nonce generated and included in the credential request response to provide additional authentication of the credential request response.

  If the credential request response is authenticated, the digital device 102 obtains network credentials from the credential request response at step 618. In step 620, the digital device 102 identifies authentication requirements associated with network access.

  In various embodiments, the digital device 102 determines the correct information and network credentials and provides them to the authentication server 108. In one example, the digital device 102 retrieves one or more network access pages from the authentication server 108. The digital device 102 can access the correct network access page from the authentication server and make a selection automatically. In one example, the digital device 102 can automatically activate the selection (eg, activate buttons, check boxes, and selection radio buttons in the network access page). Automatic selection can be based on selection by a credential engine. For example, the credential engine can access a form library (not shown) that can provide executable instructions for identification and automatic selection of the form (s) retrieved from the authentication server. The credential engine may also activate the selection based on instructions included in the network credential obtained from the credential request response. One skilled in the art will recognize that there can be many ways in which the selection can be made automatically.

  In other embodiments, the digital device 102 can determine the proper information to send to the authentication server 108 without first obtaining a network access page. The determination of the proper information to send to the authentication server 108 can be based on instructions that identify the network device 104, the authentication server 108, or the service provider.

  In step 622, the digital device 102 provides network credentials for network access according to authentication requirements. In various implementations, the digital device 102 provides the authentication server 108 with a username, password, account number, or the like from network credentials. After the authentication server 108 authenticates the digital device 102, the authentication server 108 can instruct the access controller 112 to allow communication access between the digital device 102 and the communication network 114.

  In various embodiments, the network credentials include login procedure information that instructs the digital device 102 to simply activate the options in the network access page. In one example, the network access page may simply consist of service periods and conditions. In order for digital device 102 to gain network access, a single selection within the network access page must be activated (such as a “Submit” button or an indication that the user has agreed to a period and condition, etc. ). At least partially in accordance with the login procedure information, the digital device 102 can automatically make the correct selection and gain network access without further providing credentials such as a password or username. One skilled in the art will recognize that one or more selections can be made automatically based on login procedure information.

  Further, any combination of one or more usernames, one or more passwords, and one or more login procedure information may be included in the network credentials. In some implementations, the network credentials can include a username. In other implementations, the network credentials can include a password.

  In step 624, the digital device 102 tests network connectivity to confirm network access. In one example, the digital device 102 attempts to connect to a web site associated with the credential server 116 (eg, the credential server 116 can function as a web server). In some implementations, the query or command includes a sequence identifier that was previously submitted in the credential request. If the network access is successful, the credential server 116 can receive the query or command and obtain the sequence identifier. The credential server 116 can then confirm that the network access was successful.

  FIG. 7 is a block diagram of an exemplary digital device. Digital device 102 includes a processor 700, a memory system 702, a storage system 704, an I / O interface 706, a communication network interface 708, and a display interface 710. The processor 700 is configured to execute executable instructions (eg, programs). In some implementations, processor 700 includes circuitry or any processor capable of processing executable instructions.

  Memory system 702 is any memory configured to store data. Some examples of the memory system 702 are storage devices such as RAM or ROM. Memory system 702 can include a RAM cache. In various embodiments, data is stored in the memory system 702. Data in memory system 702 may be cleared or eventually transferred to storage system 704.

  The storage system 704 is any storage configured to obtain and store data. Some examples of storage system 704 are flash drives, hard drives, optical drives, and / or magnetic tape. In some embodiments, the digital device 102 includes a memory system 702 in the form of RAM and a storage system 704 in the form of flash data. Memory system 702 and storage system 704 together constitute a computer readable medium that can store instructions or programs executable by a computer processor, including processor 700.

  An optional input / output (I / O) interface 706 is any device that receives input from a user and outputs data. Optional display interface 710 is any device configured to output graphics and data to a display. In one example, the display interface 710 is a graphics adapter. As will be appreciated, not all digital devices 102 include either the I / O interface 806 or the display interface 810.

  Communication network interface (com network interface) 708 may be coupled to a network (eg, local area network 106 and communication network 114) via link 712. The communication network interface 708 can support communication via, for example, an Ethernet connection, a serial connection, a parallel connection, or an ATA connection. The communication network interface 708 can also support wireless communication (eg, 802.11a / b / g / n, WiMax). As will be apparent to those skilled in the art, the communication network interface 708 can support a number of wired and wireless standards.

  The functions and components described above can consist of instructions stored on a storage medium. Those instructions can be obtained and executed by a processor. Some examples of instructions are software, program code, and firmware. Some examples of storage media are memory devices, tapes, disks, integrated circuits, and servers. The instructions, when executed by a processor, serve to instruct the processor to operate in harmony with the embodiments of the present invention. Those skilled in the art are familiar with instructions, processor (s), and storage media.

  The present invention has been described above with reference to exemplary embodiments. It will be apparent to those skilled in the art that various modifications are possible and other embodiments can be used without departing from the broader scope of the invention. Accordingly, these and other variations on the exemplary embodiments are intended to be protected by the present invention.

102 digital device, 104 network device, 106 local area network, 108 authentication server, 110 DNS server, 112 access controller, 114 communication network, 116 credential server, 200 authentication module, 202 network module, 204 Credential Request Module, 206 Credential Engine, 208 Encryption / Decryption Module, 210 DDID Storage, 212 Network Access Engine.

Claims (19)

A method for obtaining network credentials,
Receiving at the digital device (102) network configuration information from a network device (104 ) on a communication network (114) ;
Generating a credential request at the digital device (102) ;
Sending the credential request in DNS protocol format form from a digital device (102) to a previous credential server of the network device (104) ;
Receiving at the digital device (102) a credential request response;
Providing network credentials from the credential request response to the network device for accessing the communication network by a digital device (102) ;
Including methods.   The method of claim 1, further comprising encrypting the credential request.   The method of claim 1, further comprising decrypting the credential request response.   The method of claim 1, further comprising digitally signing the credential request.   The method of claim 1, wherein the credential request includes a location identifier.   The method of claim 5, wherein the location identifier is based on at least some of the network configuration information.   The method of claim 1, wherein the credential request response includes a command that does not cause the credential request response to be cached.   The step of providing the credentials from the credential request response comprises analyzing a network access page and writing form information in the network access page. The method described.   The method of claim 1, wherein the credential request includes an identifier of a digital device (102). A digital device for obtaining network credentials,
To receive network configuration information from the network device (104 ) on the communication network (114) and send a credential request in DNS protocol format format to the credential server ahead of the network device (104). Configured network module (202) ,
A credential request module (204) configured to generate the credential request;
A credential engine (206) configured to receive a credential request response, and a network from the credential request response to the network device (104) to access the communication network (114) A network access engine (212) configured to provide credentials;
Including digital devices .   The digital device of claim 10, further comprising an encryption / decryption module (208) configured to encrypt the credential request.   The digital device of claim 10, further comprising an encryption / decryption module (208) configured to decrypt the credential request response.   The digital device of claim 12, further comprising an encryption / decryption module (208) configured to digitally sign the credential request.   The digital device of claim 10, wherein the credential request includes a location identifier.   The digital device of claim 14, wherein the location identifier is based on at least some of the network configuration information.   The digital device of claim 10, wherein the credential request response includes a command that does not cause the credential request response to be cached.   Providing the credential from the credential request response may include the network access engine configured to analyze a network access page and to fill form information in the network access page ( 212) The digital device of claim 10, comprising:   The digital device of claim 10, wherein the credential request includes a digital device identifier. A program that can be executed by the processor (700) , the execution of which is the following method of obtaining network credentials:
Receiving at the digital device (102) network configuration information from a network device (104 ) on a communication network (114) ;
Generating a credential request at the digital device (102) ;
Sending the credential request in DNS protocol format from the digital device (102) to the previous credential server of the network device (104) ;
Receiving at the digital device (102) a credential request response;
Providing network credentials from the credential request response to the network device for accessing the communication network by a digital device (102) ;
A computer-readable storage medium storing a program for implementing the method.

Images