Patent ID: 8327143

Claim:
A method of a client device authenticating a wireless access point comprising: obtaining, by the client device from a certificate authority, a certificate for each of a plurality of publically accessible wireless access points (APs), each certificate identifying one of the wireless APs and a public key for the AP, wherein a certificate is obtained by the client device for a first AP of the plurality of APs before the client device communicates with the first AP; generating a challenge by encrypting a random number based on the public key for the first AP; sending the challenge from the client device to the first AP of the plurality of APs, wherein the first AP has a private key securely stored in a hardware security module of the first AP, wherein the stored private key corresponds to the public key for the first AP; receiving a response by the client device from the first AP, the response being generated by the first AP based on the challenge and the private key for the first AP; and comparing, by the client device, the received response to the random number used in generating the challenge, wherein authentication of the first AP is established based on a match between the random number and the received response.