Control plane only mobile device network access authentication

A system for securely connecting a mobile device to a wireless network with control plane only authentication, comprising:

• a mobile device comprising a wireless 802.11 radio interface;
• a WiFi network extensible access point;
• a Mobile Virtual Network Operator (MVNO) network authentication server configured to:
• receive a request from the mobile user device to access an MVNO network;
• determine whether the mobile device is associated with the MVNO network;
• based on the mobile device being determined to be associated with the MVNO network, transmit to the mobile device a request to confirm that an extensible authentication protocol transport layer security (EAP-TLS) can be used as an authentication protocol for authenticating the mobile device to the MVNO authentication server;
• in response to receiving a response from the mobile device confirming that EAP-TLS can be used as the authentication protocol between the mobile device and the MVNO network, transmit to the mobile device a request for a unique identifier for the mobile device;
• receive from the mobile device the unique identifier for the mobile device, wherein the received unique identifier comprises an encrypted International Mobile Subscriber Identity (IMSI) of the mobile device and a serial number for a certificate for a public key for the encrypted IMSI of the mobile device,
• retrieve the public key associated with received the serial number;
• decrypt the received IMSI with the retrieved public key;
• determine whether the decrypted IMSI is valid;
• if the decrypted IMSI is determined to be valid, determine whether the mobile device associated with the decrypted IMSI is authorized to access the MVNO network;
• and
• if the mobile device is determined to be authorized to access the MVNO network, transmit to the mobile device authorization to commence data plane transmission at the mobile device.

A server machine for securely connecting a mobile device to a wireless network with control plane only authentication, comprising:

• at least one processor;
• memory that stores instructions which, when executed by the at least one processor, are configured to:
• receive a request from a mobile user device to access an Mobile Virtual Network Operator (MVNO) network;
• determine whether the mobile device is associated with the MVNO network;
• based on the mobile device being determined to be associated with the MVNO network, transmit to the mobile device a request to confirm that an extensible authentication protocol transport layer security (EAP-TLS) can be used as an authentication protocol for authenticating the mobile device;
• in response to receiving a response from the mobile device confirming that EAP-TLS can be used as the authentication protocol between the mobile device and the MVNO network, transmit to the mobile device a request for a unique identifier for the mobile device;
• receive from the mobile device the unique identifier for the mobile device, wherein the received unique identifier comprises an encrypted International Mobile Subscriber Identity (IMSI) of the mobile device and a serial number for a certificate for a public key for the encrypted IMSI of the mobile device,
• retrieve the public key associated with received the serial number;
• decrypt the received IMSI with the retrieved public key;
• determine whether the decrypted IMSI is valid;
• if the decrypted IMSI is determined to be valid, determine whether the mobile device associated with the decrypted IMSI is authorized to access the MVNO network;
• and
• if the mobile device is determined to be authorized to access the MVNO network, transmit to the mobile device authorization to commence data plane transmission at the mobile device.