How does 3G to Wi-Fi handoff work, and is it really secure?
One question I’ve been trying to get AT&T to answer for some time is how its auto-authentication scheme works. Auto-authentication, which the mobile operator announced about a year ago, offloads user traffic from AT&T’s 3G network to one of its Wi-Fi hotspots when coverage is available.
AT&T’s new spring smartphones
I’m curious about this, because I’ve run across skeptics who worry that the initial “handshake” between client device and AP might not be secure. I have finally eked out a recent reply, which, though it leaves a few lingering follow-up questions, is at least a partial explanation. The following response was sent to me by the spokesperson without attribution to any particular individual at AT&T:
“With auto-authentication, any AT&T smartphone that has our AT&T Wi-Fi software client will automatically identify an AT&T Wi-Fi U.S. Hot Spot when you walk within the hotspot range. On some devices, for initial Wi-Fi configuration, there is ‘zero-click’ auto-authentication, meaning the user does not need to take any action to seamlessly connect to the AT&T Wi-Fi Hot Spot. On other devices, you must manually say that you want to connect to the AT&T Hot Spot the first time, and then the device will automatically connect the next time you’re in range.
“Once your device recognizes an AT&T Wi-Fi Hot Spot, there’s a ‘protocol handshake’ between the device and the access point to complete the network authentication. First, the protocol sends a secure, unreadable username and password developed from your device’s SIM chip. This information is user-specific. That information is then transmitted to the venue’s access point network controller. The network controller decodes it and checks the user credentials against an AT&T customer profile database to verify that the user is an AT&T customer who qualifies for AT&T Wi-Fi access included with their 3G unlimited data plan. Once the user is confirmed, the network controller allows the device to connect directly to the Internet.
“This all happens seamlessly and quickly for the customer.
“AT&T Wi-Fi service does support VPN. So once a user is connected, they can connect through their VPN for optimum security.”
I’ll present a wireless security analyst’s take on this explanation next time. Meanwhile, what’s yours?
