Patent Description:
With the advent of Internet access mobile communications technology, so also has evolved the presence of WiFi Internet access locations (i.e., hotspots provided by a network operator) where an Internet access mobile terminal may gain access to an Internet connection and Internet content. Such WiFi Internet access locations may comprise locations including but not limited to commercial services locations (i.e., restaurants, hotels, and other retail sales establishments), public services locations (i.e., airports, other transportation terminals, libraries, and government offices) and private locations (i.e., residences). These hotspots are also referred to as Open WiFi networks.

While ready mobile access to Internet service and Internet content is desirable within the context of the information technology art, ready mobile access to Internet service and Internet content is nonetheless not entirely without problems within the information technology art. In that regard, WiFi hotspots of an operator available to mobile terminals need to be managed by the operator in a way that is seamless to the mobile terminals especially when mobile terminals roam in a network comprising such WiFi hotspots. The greater the number of hotspots the more difficult it is for an operator to manage such a network.

Also, connecting devices, e.g. network devices or user equipments (e.g. a printer with WiFi connectivity) to a WiFi network with limited input and/or limited screens may be troublesome for the users.

Thus, desirable are apparatuses, methods and program product that provide for seamless connectivity within the context of mobile connectivity to a WiFi network, in such a way as to facilitate for the operator control of the access to the network as well as to facilitate for the mobile termina or user equipment to access to the network. Prior art document <CIT> describes the provisioning of network credentials to Internet of Things (IoT) devices.

It is an object of embodiments herein to solve the above problem by providing a network device, an access point, and methods thereof for facilitating connection to a WiFi network.

According to an aspect of embodiments herein, there is provided a method performed by a network device, the method comprising: detecting an access point provided with a service set identifier (SSID); connecting to said access point using said SSID; performing an authentication process towards an authentication and control server for verifying a unique certificate of the network device, which is paired with a corresponding certificate in said server; and in case the authentication process is successful, generating a unique identification information for enabling a user equipment to scan said unique identification information.

According to another aspect of embodiments herein, there is provided a method performed by an (WiFi) access point, the method comprising: connecting to a network device using an SSID, of the access point; enabling the network device to perform, via the access point, an authentication process towards an authentication and control server for verifying a unique certificate of the network device, which is paired with a corresponding certificate in said server; and in case the authentication process is successful, connecting to a user equipment, upon the user equipment scanning a unique identification information of the network device.

According to yet another aspect of embodiments herein, there is provided an network device comprising a processor and a memory containing instructions executable by said network device, wherein the network device is configured to: detect an access point provided with an SSID; connect to said access point using said SSID; perform an authentication process towards an authentication and control server for verifying a unique certificate of the device, which is paired with a corresponding certificate in said server; and in case the authentication process is successful, generate a unique identification information for enabling a user equipment to scan said unique identification information.

According to yet another aspect of embodiments herein, there is provided an access point comprising a processor and a memory containing instructions executable by said access point wherein the access point is configured to: connect to a network device using an SSID of the access point; enable the network device to perform, via the access point, an authentication process towards an authentication and control server for verifying a unique certificate of the network device, which is paired with a corresponding certificate in said server; and in case the authentication process is successful, connect to a user equipment, upon the user equipment scanning a unique identification information of the network device.

There is also provided a computer program comprising instructions which when executed on at least one processor of the network device according to embodiments herein, cause the at least one processor to carry out the method according to any one of pending claims <NUM>-<NUM>. Also, a carrier containing the computer program of is provided, wherein the carrier is one of a computer readable storage medium; an electronic signal, optical signal, or a radio signal.

There is also provided a computer program comprising instructions which when executed on at least one processor of the access point according to embodiments herein, cause the at least one processor to carry out the method according to any one of pending claims <NUM>-<NUM>. Also, a carrier containing the computer program of is provided, wherein the carrier is one of a computer readable storage medium; an electronic signal, optical signal, or a radio signal.

An advantage with embodiments herein is to facilitate connection to a WiFi network by means of the network device and the access point, respectively. This allows network devices to connect to the access point as soon as they are turned on. An identification information such as a QR (Quick Response) code or a barcode is generated on a screen of the network device for a user scan (by means of a user equipment such as a smart phone) to claim the network device and to access to the WiFi access network.

In the following, a detailed description of the exemplary embodiments is described in conjunction with the drawings, in several scenarios to enable easier understanding of the solution(s) described herein.

The Extensible Authentication Protocol (EAP) is a protocol for wireless networks that expands on authentication methods used by Point-to-Point Protocol (PPP), a protocol often used when connecting a computer or a network device to the Internet. EAP may support multiple authentication mechanisms, such as token cards, smart cards, certificates, one-time passwords, and public key encryption authentication. EAP also runs directly over data link layer such as IEEE <NUM> (WiFi).

This authentication type provides a high level of security in a wireless network. By using EAP to interact with an EAP-compatible RADIUS (Remote Authentication Dial-In User Service) server, an access point helps a wireless device or a network device or a user equipment (UE) and the RADIUS server to perform mutual authentication and derive e.g. a certificate or a key.

Referring to <FIG> there is illustrated a simplified signalling diagram illustrating the principles of the method according to some exemplary embodiments herein. The figure shows a network device <NUM>, which could be a printer with WiFi capabilities or a TV with WiFi capabilities or in general, a user equipment with WiFi capabilities. The figure also depicts an access point <NUM> which is a WiFi access point or a residential gateway (RGW), an authentication (Auth. ) and control (Ctrl. ) server <NUM> and a user equipment <NUM>, such as a smart phone or in general a user's mobile terminal.

As shown, assume that the network device <NUM> is turned on. As mentioned above, the network device <NUM> is equipped with WiFi capability. When the network device <NUM> is on, it detects an access point <NUM> or a RGW. The access point <NUM> is already provided with an SSID and hence the network device <NUM> detects the SSID of the access point <NUM> and attempts to connects to it using the SSID. The network device <NUM> then performs an authentication process towards an the authentication and control server <NUM> for verifying a unique certificate of the network device <NUM>, which is paired with a corresponding certificate in said server <NUM>. The unique certificate may be stored in the firmware/boot-up software of the device <NUM> and is then paired with a corresponding certificate in the server <NUM> in order for the WiFi connection to be granted. The hardware supplier of the network device <NUM> may register the device and their unique certificate to the system, through a back-office portal. Once the device is distributed and turned on, it pairs the stored unique certificate and is thereby granted WiFi access. So in case the authentication process is successful, the network device <NUM> generates a unique identification information (such as a QR code or a barcode or the like) for enabling the user of the user equipment to scan the identification information. The identification information may be displayed on a screen (e.g. a small liquid crystal display (LCD) screen) of the network device <NUM> to be used for the users application to connect to the device to upload credentials. Hence, the user equipment <NUM> may be provided with an application to enable it to connect the server <NUM>. After the scanning of the identification information, the device and the user's app are paired by means of the server <NUM>.

According to an embodiment, the SSID of the access point <NUM> may be a reserved SSID for enabling the network device <NUM> to connect tot the access point <NUM>. The network device <NUM> may request a new SSID and a password from the authentication and control server <NUM> and upon receiving the new SSID and the password, the network device <NUM> may reboot or restart and then connect to the access point <NUM> using the new SSID. The user equipment <NUM>, by means of the application, may update the setting of the network device <NUM>.

Referring to <FIG>, there is illustrated another diagram involving the apparatuses shown in <FIG>, for facilitating connection to a WiFi network according to an exemplar embodiment. Assume that a user bought a network device <NUM> such as a printer provided with an LCD screen. The user by means of a user equipment <NUM> may claim the network device <NUM>. The network device <NUM> detects an access point or (operator) RGW <NUM> provided with a service set identifier (SSID) and then connects to the RGW <NUM> using the SSID and performs an authentication process towards an authentication and control server <NUM> for verifying a unique certificate of the network device <NUM>, which is paired with a corresponding certificate in said server <NUM>. The server <NUM> may be connected to an operator network <NUM> or to a server <NUM> of the operator network which includes a manufacturer list. As an example, a manufacturer (MF) of the network device <NUM>. The server <NUM> may send credentials to allow the device <NUM> to connect. As previously described, in case the authentication process is successful, the network device <NUM> generates a unique identification information (e.g. a QR code as shown) for enabling the user equipment <NUM> to scan said unique identification information. It should be mentioned that server <NUM> and server <NUM> may be integrated devices or separate devices. <FIG> shows the exemplary scenario where the servers <NUM> and <NUM> are separate entities, which is not necessarily the case. Additional details performed by the different apparatuses have already been described and need not be repeated.

Referring to <FIG> there is illustrated another diagram involving the apparatuses of <FIG> for facilitating connection to a WiFi network. However, in this scenario, the network device <NUM> connects to the network using a secure private network. The path is secure all the way from the network device <NUM> itself (using e.g. WiFi isolation) and tunneled all the way to the manufacture's network. By WiFi isolation of an AP is meant a feature in the WiFi AP <NUM> that allows a user to lock down the WiFi network. This feature also allows and restricts clients connected to the WiFi network. The tunnelling and protection of the WiFi network is advantageous since it makes it hard for anyone to tamper with the device(s), which may be the case in today's unsure home networks where devices may be modified by malware and hackers. Hence, to avoid these issues, the connection between the network device <NUM> and the server of the network operator or of the manufacturer is protected using a virtual private network (VPN) tunnel. This way the flow is controlled between the user equipment <NUM> and the server of the operator or of the manufacturer <NUM>. The start point of the VPN tunnel starts in the private network of the user, and the end point of the VPN tunnels ends in the operator or MF (cloud) network. As mentioned earlier, the path is secured all the way from the network device <NUM> and tunneled all the way to the operator or MF network server <NUM>.

Referring to <FIG>, there is illustrated a flowchart of a method performed by a network device <NUM> according to an exemplary embodiment as previously described. The method comprises:.

Details about how authentication is performed have already been described. According to an embodiment, the SSID is a reserved SSID for enabling the network device to connect to the access point.

According to another embodiment, the method further comprises, requesting, by the network device, a new SSID and a password from the authentication and control server; and upon receiving the new SSID and the password, rebooting and connecting to the access point using the new SSID. The unique certificate of the device may be registered in a server of the network operator.

To perform the method or procedure steps/actions described above, a network device <NUM> is provided as depicted in <FIG>.

The network device <NUM> comprises a processing circuit or a processing module or a processor or means 101A, network circuitry 101F for enabling WiFi connectivity; a receiver circuit or receiver module 101B; a transmitter circuit or transmitter circuit 101C; a memory module 101D and a transceiver circuit or transceiver module 101E which may include the transmitter circuit 101C and the receiver circuit 101B. The network device <NUM> may also be provided with a screen or display (e.g. LCD) (not shown) as previously mentioned.

The network device <NUM> may be a printer, a TV, a scanner, etc. a fax machine, just to mention some examples.

The processing module/circuit 101A includes a processor, microprocessor, an application specific integrated circuit (ASIC), field programmable gate array (FPGA), or the like, and may be referred to as the "processor 101A. " The processor 101A controls the operation of the network device <NUM> and its components. Memory (circuit or module) 101D includes a random access memory (RAM), a read only memory (ROM), and/or another type of memory to store data and instructions that may be used by processor 101A. In general, it will be understood that the network device <NUM> in one or more embodiments includes fixed or programmed circuitry that is configured to carry out the operations in any of the embodiments disclosed herein.

In at least one such example, the network device <NUM> includes a microprocessor, microcontroller, DSP, ASIC, FPGA, or other processing circuitry that is configured to execute computer program instructions from a computer program stored in a non-transitory computer-readable medium that is in, or is accessible to the processing circuitry. Here, "non-transitory" does not necessarily mean permanent or unchanging storage, and may include storage in working or volatile memory, but the term does connote storage of at least some persistence. The execution of the program instructions specially adapts or configures the processing circuitry to carry out the network device <NUM> operations disclosed herein. Further, it will be appreciated that the network device <NUM> may comprise additional components not shown in <FIG>.

As previously described, the network device <NUM> is configured to detect an access point provided with an SSID; connect to said access point using said SSID; perform an authentication process towards an authentication and control server for verifying a unique certificate of the device, which is paired with a corresponding certificate in said server; and in case the authentication process is successful, generate a unique identification information for enabling a user equipment to scan said unique identification information. The network device <NUM> may further be configured to request a new SSID and a password from the authentication and control server; and upon receiving the new SSID and the password, to reboot and connect to the access point using the new SSID.

There is also provided a computer program comprising instructions which when executed on at least one processor of the network device <NUM> according to embodiments herein, cause the at least one processor to carry out the method describe above. Also a carrier containing the computer program is provided, wherein the carrier is one of a computer readable storage medium; an electronic signal, optical signal, or a radio signal.

Referring to <FIG> there is illustrated a flowchart of a method performed by a an access point <NUM> or a RGW according to an exemplary embodiment as previously described. The method comprises:.

According to an embodiment, the method further comprises, receiving from the network device <NUM>, a request requesting a new SSID and a password from the authentication and control server; and upon receiving the new SSID and the password, and forwarding to the network device <NUM>, rebooting and connecting to the network device <NUM> using the new SSID. Additional actions performed by the access point have already been described.

To perform the method or procedure steps/actions described above, an access point (or RGW) <NUM> is provided as depicted in <FIG>.

The access point <NUM> comprises a processing circuit or a processing module or a processor or means 102A, network circuitry 102F for enabling WiFi connectivity; a receiver circuit or receiver module 102B; a transmitter circuit or transmitter circuit 102C; a memory module 102D and a transceiver circuit or transceiver module 102E which may include the transmitter circuit 102C and the receiver circuit 102B. The access point <NUM> generally provided with an antenna circuitry integrated or external for enabling communication with other devices.

The processing module/circuit 102A includes a processor, microprocessor, an application specific integrated circuit (ASIC), field programmable gate array (FPGA), or the like, and may be referred to as the "processor 102A. " The processor 101A controls the operation of the access point <NUM> and its components. Memory (circuit or module) 102D includes a random access memory (RAM), a read only memory (ROM), and/or another type of memory to store data and instructions that may be used by processor 102A. In general, it will be understood that the access point <NUM> in one or more embodiments includes fixed or programmed circuitry that is configured to carry out the operations in any of the embodiments disclosed herein.

In at least one such example, the access point <NUM> includes a microprocessor, microcontroller, DSP, ASIC, FPGA, or other processing circuitry that is configured to execute computer program instructions from a computer program stored in a non-transitory computer-readable medium that is in, or is accessible to the processing circuitry. Here, "non-transitory" does not necessarily mean permanent or unchanging storage, and may include storage in working or volatile memory, but the term does connote storage of at least some persistence. The execution of the program instructions specially adapts or configures the processing circuitry to carry out the access point operations disclosed herein. Further, it will be appreciated that the access point <NUM> may comprise additional components not shown in <FIG>.

The access point <NUM> is configured to: connect to a network device <NUM> using a service set identifier ( SSID) of the access point <NUM>; enable the network device <NUM> to perform, via the access point <NUM>, an authentication process towards an authentication and control server for verifying a unique certificate of the network device, which is paired with a corresponding certificate in said server; and in case the authentication process is successful, to connect to a user equipment, upon the user equipment scanning a unique identification information of the network device.

As previously described, the access point <NUM> is configured to receive from the network device <NUM>, a request requesting a new SSID and a password from the authentication and control server; and upon receiving the new SSID and the password, and forwarding to the network device <NUM>, to reboot and to connect to the network device using the new SSID. Additional actions performed by the access point <NUM> have already been described and need not be repeated again.

There is also provided a computer program comprising instructions which when executed on at least one processor of the access point <NUM> according to embodiments herein, cause the at least one processor to carry out the method describe above. Also a carrier containing the computer program is provided, wherein the carrier is one of a computer readable storage medium; an electronic signal, optical signal, or a radio signal.

An advantage with embodiments herein is to facilitate connection to a WiFi network by means of the network device and the access point, respectively. This allows network devices to connect to the access point as soon as they are turned on. An identification information such as a QR code or a barcode is generated on a screen of the network device for a user to scan (by means of a user equipment such as a smart phone) to claim the network device and to access to the WiFi access network.

Claim 1:
A method performed by a network device (<NUM>), the method comprising:
- detecting (<NUM>) an access point (<NUM>) provided with a service set identifier, SSID;
- connecting (<NUM>) to said access point (<NUM>) using said SSID; wherein the SSID is a reserved SSID for enabling the network device (<NUM>) to connect to the access point (<NUM>);
- performing (<NUM>) an authentication process towards an authentication and control server (<NUM>) for verifying a unique certificate of the network device (<NUM>), which is paired with a corresponding certificate in said server (<NUM>);
- in case the authentication process is successful, generating (<NUM>) a unique identification information for enabling a user equipment (<NUM>) to scan said unique identification information; and
- requesting a new SSID and a password from the authentication and control server (<NUM>) and upon receiving the new SSID and the password, rebooting and connecting to the access point (<NUM>) using the new SSID.