Patent ID: 8307414
Filing Date: 2012-11-06
Classification: G06F,H04L,H04W

Abstract:
1. A method for controlling Internet access of a mobile device using a communication system which includes a plurality of access points connected to the Internet and to a plurality of mobile devices, the method comprising the steps of: a) performing a certificate-based authentication between an access point, performing the authentication, and a mobile device seeking access to the Internet, wherein the mobile device is disposed in the coverage area of the access point; a1) receiving at the access point a certificate transmitted from the mobile device over a wireless link to the access point, wherein the certificate includes at least a mobile device identifier, a public key of the mobile device or a public key of a user of the mobile device, a timestamp indicating a lifetime of the certificate and a CRL segment identifier identifying a CRL segment of a certificate revocation list (CRL); a2) verifying the certificate by the access point; a3) determining by the access point, based on the CRL segment identifier, whether the certificate of the mobile device has been revoked prior to expiration of the lifetime, wherein the CRL segment is associated with a physical area of the mobile device and at least a portion of the certificate revocation list is stored at least temporarily at the access point; and a4) granting the mobile device access to the Internet if the certificate has been verified successfully in the verifying step and the certificate has not been revoked prior to the expiration of the lifetime; b) dividing a physical area into a plurality of geographical zones, each geographical zone represented by a separate CRL segment to define a plurality of groups respectively by the plurality of geographical zones, wherein each group comprises respective ones of said plurality of access points and respective ones of said plurality of mobile devices; c) segmenting the CRL into a plurality of CRL segments and associating a unique CRL segment identifier with each CRL segment, wherein each CRL segment represents a separate group of the plurality of groups; d) storing for each group the same CRL segment on each access point of the respective group and storing for each group the same CRL segment identifier associated with the respective group on each mobile device of the respective group; e) receiving at the access point the CRL segment identifier of the mobile device and determining by the access point, based on the CRL segment identifier received from the mobile device, whether the access point belongs to the same group as the mobile device; e1) if the access point and the mobile device are determined in step e) to be in the same group, then basing the determination made at step a3) on the CRL segment stored on the access point; and e2) if the access point and the mobile device are determined in step e) to not be in the same group, then requesting, by the access point, the CRL segment represented by the CRL segment identifier received from the mobile device and basing the determination made at step a3) on the requested CRL segment.