An Overview of Devicescape Connect

An Overview of Devicescape Connect



Introduction

Wi-Fi has proven to be an incredibly successful technology, with hundreds of millions
of Wi-Fi laptops shipped, millions of home and corporate networks deployed, and
hundreds of thousands of hotspots put into operation. But now Wi-Fi is entering a
new era of growth – one where billions of new and innovative Wi-Fi-enabled devices
will make their way into consumers’ hands. Merrill Lynch forecasts that over one
billion new Wi-Fi devices will be in use by the end of 20091. The majority of these
devices won’t be laptops, though. Instead, we’ll see the rise of many new types of
wireless devices, including dual-mode handsets, portable game systems, personal
media players, and an array of other innovative wireless gadgets. These service-
enabled devices use Wi-Fi to gain a convenient and fast connection to the network in
order to provide a range of services for the end-user.

As consumer electronics products targeted at a mass market audience, these devices
must be easy to use and access content and applications across the Internet with the
absolute minimum of intervention by their users. Moreover, to maximize
convenience and value, the devices should be able to gain access at a very wide
range of locations.

It is with these requirements in mind that Devicescape operates the Devicescape
Connect service. Devicescape Connect enables wireless devices to automatically
connect to Wi-Fi hotspots and personal networks at home and in friends’ homes.
Whenever a device comes within range of a Wi-Fi network to which it has access
rights, it will automatically connect itself to that network – without any user
interaction. The experience is much like using a cell phone.

With Devicescape Connect, users avoid the hassles of Wi-Fi technology. There’s no
need to configure wireless settings, start-up a browser just to login, or tediously
enter usernames, passwords and security keys with a keypad, stylus or scroll wheel.
Users experience simple and fast wireless connectivity wherever they go.

For manufacturers of Wi-Fi devices, Devicescape Connect enables the creation of
products with ready-to-go connectivity for a worldwide array of hotspots, as well as
easy connectivity in users’ homes and offices. With effortless connectivity, customer
satisfaction goes up, support calls and returns go down, and a manufacturer’s overall
brand is enhanced. Device vendors also gain an increased flexibility to partner and
co-market with wireless service providers. Vendors need not negotiate separate
business relationships with each service provider they wish to support in their device,
nor do they need to specially engineer their device for each provider’s network.

For wireless service providers, Devicescape Connect opens up revenue streams from
a vast new market of billions of connected devices. Service providers can expand
their services beyond laptops to the burgeoning wave of Wi-Fi phones, game
systems, media players, cameras and other devices. Mobile operators can more
easily utilize Wi-Fi to deliver rich media services while offloading traffic from their
cellular network. Service providers can craft new types of service plans that
segment their markets on the basis of device type and application. Providers
additionally gain the flexibility to support devices from many vendors on their

1 WiFi – The Second Coming, Merrill Lynch.

---

networks without having to craft complicated integration deals with each
manufacturer. And, as with manufacturers, Devicescape Connect will improve the
experience of their subscribers and lower the cost of support.

The Devicescape Connect Technology

The Devicescape Connect service is implemented with three primary components: a
small software client running on mobile wireless devices; a web-based service that
assists devices in connecting to Wi-Fi networks;
and a consumer portal website where users
manage their devices and networks. The Connect
Supported Device Clients
client can be integrated directly into a device by

the manufacturer or installed onto a variety of
Devicescape provides installable
clients for a range of popular
device platforms. Both the web service and the
devices including:
portal are hosted on a collection of highly-available

and secure Devicescape servers.
Nokia N and E series phones
Nokia internet tablets
Windows Mobile phones and PDAs
Devicescape Connect provides access to two
Windows XP and Vista computers
fundamental types of Wi-Fi networks: public Wi-Fi
Apple Mac OS X computers
networks and personal Wi-Fi networks. Public Wi-
Apple iPhone and iPod Touch
Fi networks include commercial hotspots (e.g., T-

These clients can be downloaded
Mobile), free or fee-bearing municipal networks
from the Devicescape website or
(e.g., Google WiFi in Mountain View, CA), free
distributed
by
partners.
hotspots,
and
community
networks
(e.g.,
Additionally, device manufacturers
University of Berkeley, CA). Many of these
and
developers
can
integrate,
extend and embed Devicescape
networks require the user to present a username
into applications and new devices
and password in order to gain access, while some
with the Devicescape Client SDK.
only require the acceptance of terms and
conditions, and others are completely open.
Personal Wi-Fi networks encompass the networks
deployed by individuals in their homes or in small businesses. These networks may
be secured with WEP or WPA encryption technology, or be open. The manner in
which the Devicescape Connect service provides access is described separately below
for each type of network.


Connecting to Public Wi-Fi Networks

Wi-Fi networks are proliferating throughout public spaces, with premium commercial
networks in high value locations like airports and hotels and an increasingly
fragmented long tail of small networks scattered across the urban landscape. Most
public Wi-Fi networks are designed for users of notebook computers, and involve a
sign-in process where the user enters a username and password via a web browser
on a “splash page” presented by the network operator. Devicescape Connect is
designed to completely automate the process of connecting to these networks,
avoiding the complexity and usability challenges which impact the value of the device
and service.

The Connect client software and the Devicescape web service work together to
enable a user’s mobile device to automatically login to public Wi-Fi networks. As
illustrated in Figure 1 below, whenever a device running the Connect client comes
within range of a public Wi-Fi network, the device first detects the presence of the
network, associates with the local access point (AP), and gets an IP address. This
initial set of actions triggers the Connect client to see if the network is openly
An Overview of the Devicescape Connect Service
2

---

accessible without a login. If so, which may be the case in certain open hotspots,
the client’s notifies the user that a connection is available and takes no further
action. But if not, as is usually the case, the client then sends a message to the
Devicescape web service (step 1 in Figure 1). The message contains the identity of
the network (both its SSID and BSSID) and the unique identifier for the device.

The Devicescape web service receives this message and uses the contents to look up
the access credentials (username & password) necessary to login to the public
network. Since each public network service provider has a unique set of pages for
their web login portals, the web service must also retrieve instructions on how to
navigate these pages and submit the access credentials.



Figure 1. Authentication of the device with Devicescape and Network Operator

The credentials to access the network must be provided to Devicescape, and this can
be done in several ways. The device owner can supply these to Devicescape via the
consumer portal, or directly on the device at first. This allows dynamic access “on
the fly” and extends integration to devices with extremely limited UIs. There are
also scenarios where the credentials can be supplied without the user’s involvement
or knowledge, allowing – for example - service providers to transparently grant
access to their networks for a set of users and devices. This is described further in
later sections of this document.

Once the access credentials and navigation instructions have been retrieved, this
information is inserted into a return message sent back to the device (step 2 in
Figure 1). The device receives the message, extracts the access information, and
An Overview of the Devicescape Connect Service
3

---

uses this information to login to the public network. The Connect client can navigate
a wide variety of hotspot portal page schemes in order to locate the username and
password entry fields and properly post the user’s credentials. The Connect client
can also parse WISPr-compliant login portals.

Actual authentication of the device is done with the service provider’s standard
Authentication, Authorization, and Accounting (AAA) infrastructure (step 3 in Figure
1). Crucially, no browser is needed on the device to facilitate the login: Devices
without browsers can now access all supported public networks. Additionally,
devices which happen to have browsers will also
enjoy easy and transparent access, without any
need for user interaction. This allows users faster
Automated Roaming

access to their internet application of choice, such
Web-based
authentication
for
as email or online gaming, without the additional
access while roaming is a major
steps of launching a browser to log in.
source of user frustration. Users

are
confronted
by
unfamiliar
networks and login pages with
Using a patent pending mechanism, the Connect
partner selections deep in the
client is able to communicate with the Devicescape
menu structure or even in different
web service prior to authentication using standard
languages. This leads to service
networking protocols. Service providers do not
value reduction, missed revenue
opportunities,
and
increased
need to re-configure their software or hardware,
support costs.
white-list the Devicescape servers or Connect-

enabled devices, nor deploy any additional
Devicescape
alleviates
these
technology to enable this communication.
problems
by
automating
the
process of connecting to a network

operator’s roaming partners. The
It’s important to emphasize that communication
Devicescape service maintains a
between the client and web service takes place
list of roaming relationships and
prior to authentication on the public network. This
understands which networks to
associate with and how to perform
enables access credentials and captive portal
roaming
authentication.

This
webpage navigation instructions to be maintained
allows quick and seamless access
entirely by our secure web service and supplied on
to any roaming network for which
demand to the device. This allows an extremely
the user’s accounts are valid, even
as roaming relationships evolve.
small device footprint despite the large number of
networks supported. It enables new networks to
be immediately added to the collection already
accessible by any given device, providing flexibility and adding value without
expensive and high risk mass device updates. Moreover, if the login web pages or
procedures for a network change, new instructions are made available to devices as
soon as the web service is updated. With this server-based approach there’s no
need to roll-out expensive and complicated firmware updates to handle new and
modified networks.


Connecting to Personal Wi-Fi Networks

In addition to enabling easy access to public Wi-Fi networks, the Devicescape
Connect service makes it simple for a Wi-Fi device user to setup their device to
access secure private networks such as their home Wi-Fi or small business network.
Most Wi-Fi devices contain client applications which allow secure networks to be
joined, but this often a source of complexity and confusion for the user, and
increased development and support costs for device manufacturers and service
providers. The Devicescape website provides a friendly and consistent way for users
to add information for these “personal networks” and have all their devices
provisioned for automated access. Moreover, this approach enables transparent
An Overview of the Devicescape Connect Service
4

---

setup of user’s devices - perhaps by a service provider - and allows for simplified and
secured sharing of the user’s network with additional users.

As shown in Figure 2 below, using the Devicescape website a user can enter profile
information for their personal networks. These networks may include their home
network or other personal networks for which they know the SSID and the WEP or
WPA/WPA2 Personal security key (if any).


Devicescape
Servers
Wi-Fi
1. User adds their personal
Router
Wi-Fi networks via
Devicescape website
3. Device automatically
2. Device is provisioned over-
connects to personal
the-air with personal network
networks
profiles

Figure 2. A user adds personal networks – such as their home Wi-Fi - to their Devicescape
account. Any devices registered to the account are provisioned with the network profile data,
enabling them to connect automatically.

Once a user has added one or more personal networks via the Devicescape website,
the profiles for these personal networks are provisioned over-the-air into the user’s
device. Each time the device gains a network connection, the Devicescape client will
check with the Devicescape web service to determine whether new network profiles
need to be provisioned. This network synchronization allows new personal networks
to be added and propagated to the user’s devices, as well as authorization to be
revoked.

Note that these personal networks do not require credentials. There is no need for
the device to contact the Devicescape web service when it seeks to connect to one of
these networks. Instead the device must locally have sufficient information to fully
connect and authenticate itself. In the event that a device detects both a personal
network and a public network, the personal network is always given higher priority.

An Overview of the Devicescape Connect Service
5

---

Easy and Secure Sharing of Personal Wi-Fi Networks

Using a feature called “Wi-Fi Buddies”, a user can also grant trusted individuals like
friends and family members access to their personal Wi-Fi network. The typical
application of Wi-Fi Buddies is to allow the sharing of a home network with others,
while avoiding the complexity and security issues of directly giving network keys to
other individuals. Using Wi-Fi Buddies, users can be added and revoked to a private
network without ever having direct access to sensitive information.

Wi-Fi Buddies works in a similar fashion to common social networking and instant
messaging services: the user provides email addresses and writes a short optional
note to the invitees using a simple form on the Devicescape website. Email
invitations are sent by Devicescape to these friends and if accepted their devices are
provisioned automatically to use the inviter’s network. Some invitees may not yet
be Devicescape members, so these individuals are first led through a few steps to
establish a Devicescape account. Then, their devices are provisioned with the
inviter’s shared network profiles. The security key associated with an inviter’s
shared network is kept hidden from their friends, and the inviter can disable access
to their personal network at any time.


Devicescape
2. Devicescape sends email
3. Existing users can accept
Servers
invitations to buddies
invitations immediately. New
users can sign up to accept
1. At Devicescape website,
user invites buddies by
providing email addresses
4. Buddy devices are
provisioned over the air with
inviting user’s shared network
security keys
5. Later, buddy’s devices are
able to connect automatically
to user’s shared networks


A user can also ask one of their friends to grant him or her access to their personal
Wi-Fi network. Again using the Devicescape website, the user makes a request to
gain access to the personal Wi-Fi network of a friend. The Devicescape web service
sends an email request to the friend. If the friend accepts the request, then the
originating user’s devices are provisioned with the friend’s personal network profile.
If the requested friend is not yet a member of Devicescape, then they are led
through the simple registration process and the steps to add their personal network.

An Overview of the Devicescape Connect Service
6

---

While Wi-Fi Buddies is commonly used to grant access to a single home network,
Devicescape provisioning system is quite flexible. The user can choose to enter
several personal networks, and pick and choose which networks will be shared across
their buddy list. Again, it is very simple to add and remove buddies, as well as share
and unshared networks, with the appropriate provisioning updates taking place as
users devices connect.

Leveraging Open Wi-Fi Networks

The preceding sections described the functionality of Devicescape to automate access
to public networks and secure private networks. While these represent the typical
scenario in mainstream public locations, and in our homes and workplace, we often
encounter a sizable number of completely open Wi-Fi networks. Here we use the
term “open” to mean those Wi-Fi locations where there is neither a security key for
the access point nor an authentication mechanism – such as usernames and
passwords – to grant full access. Instead, the network is completely open for
network access.

Open networks can be setup for a number of reasons: a small business like a coffee
shop may use it to attract and retain customers; a library may offer access as a
public service; or a local authority may provide it for their citizens and staff. Users
may also leave their home networks completely open, intentionally or not.

Devicescape can take advantage of these open networks as a way for users to
expand the locations where they can gain access. Although it is conceptually simple
to utilize open networks, in practice the process involves a tedious manual process of
trial and error. Users must set their devices to scan for networks, and then try to
associate with an open access point they might discover. Unfortunately the access
point may be setup with MAC address filtering and refuse association, or may provide
the device with an IP address but not be connected to the wider network and capable
of providing access. This process of searching and exploring needs patience, good
technical understanding and the full attention of the user through a frustrating
process. In contrast, the Devicescape client will scan for networks and
systematically associate with and probe open networks to verify a true network
connection. In the case of multiple open networks, Devicescape will keep trying until
access is found. Once a network connection is verified, Devicescape will alert the
user with a message or short audio notification.

While open networks are commonplace, it is often difficult to distinguish intentionally
and unintentional availability. In recognition of this issue the Devicescape client
allows users to switch automated open network access on or off. When off, the
client will only automate access to personal networks and hotspots selected in the
users Devicescape account.


Instant Access and the Registration Process

In order to provide seamless network access, Devicescape relies on the interaction of
the Connect client with the Devicescape service. The service must be able to
recognize a device uniquely, in order to retrieve credentials for the device user and
allow automated access to the appropriate networks. While many of the examples
shown in previous sections highlight usage once the service has been setup with
network accounts and personal networks, Devicescape can also add value straight
An Overview of the Devicescape Connect Service
7

---

“out of the box” before the user is even aware of the service or has established an
account.

To accomplish this, Devicescape employs an initial “anonymous registration” process
with a new device which gives the user immediate access to free and open networks.
Later, the user can add account credentials for networks directly on the device at
login-time, expanding coverage without having to create an account or visit the
website. Finally, the user is able to “sign up” at the website to access a set of
additional features – converting the anonymous account into a full account already
populated with device information and any network selections. This approach makes
for immediate usability and a gradual learning curve.

The steps are outlined below in Figure 3. The first time a user connects their device
to the Internet the Connect client will contact the Devicescape service. This initial
connection can be made via an open Wi-Fi network or some other connection
technology such as cellular data on a dual mode phone or a USB connection to a PC
that is itself connected to the Internet. The Devicescape service assigns a
universally unique device identifier (UUID) to the new device and creates an
anonymous user account to which the device is associated.

At this point, the device can be provisioned by the web service with its basic
configuration. These can include access defaults, such as whether the device should
automatically connect with open networks, and being setup to connect with free
networks known to the Devicescape service. Devicescape is also able to setup
devices automatically on behalf of a device manufacturer or service provider, to
allow for pre-negotiated access rights for a particular user or class of device (e.g.,
when a particular device is desired to connect automatically according to a business
agreement between the manufacturer and the network operator). This allows the
device to gain substantial network access with little or no effort on the part of the
user.
An Overview of the Devicescape Connect Service
8

---

Step 1:
User connects device to the
Internet via an open
wireless connection or any
Devicescape
other means.
Servers
Connect client contacts
Devicescape service.
Device with
Devicescape
Connect Agent
Step 2:
Devicescape service
assigns UUID to new
device, creates anonymous
Devicescape
user account, and registers
Servers
device to account.
Device is provisioned with
initial configuration and list
of networks to enable
immediate access
Step 3:
Device is logged in
automatically to free and
open networks.
Devicescape
Servers
User can enter credentials
for a network they want to
Enter account for AcmeWiFi
use directly on the device.
Joe_
These are used to login and
Username:
Password:
then stored on the server to
automate future access.
OK
Cancel
Step 4:
To access additional
features and services, user
can sign up for a named
account at the website.
Devicescape
Servers
The server generates a PIN
which is displayed on the
device. The user completes
` Home
the registration process by
Personal
providing this PIN to the
Computer
website.

Figure 3. Instant Access makes the device immediately useful.



An Overview of the Devicescape Connect Service
9

---

PIN Codes and Named Accounts

While Instant Access allows for broad coverage on the device, several attractive
capabilities are enabled only when the user establishes a named account. Named
accounts allow multiple devices to be consolidated and managed together, and offer
features like personal networks and Wi-Fi Buddies. The device client allows a user to
“sign up” in two different ways in order to handle devices with different UI
capabilities. Simpler devices can display a registration message including a five
letter “PIN code” and directions to the Devicescape website. More sophisticated
devices with web browsing capability can also
display a link with the PIN code embedded, and
immediately take the user to a mobile landing
Identity and Security
page.


A critical part of this device
registration
procedure
is
the
In either case, the process is essentially the same,
sharing of a license key, the UUID,
with the PIN code generated by the Devicescape
and an AES encryption key between
server and delivered to the device. The PIN code
the device and the Devicescape
establishes the specific association between the
service.

device and the user’s account. At the website, the
The license key ensures that the
user can create an account – whereby the
Connect client has been properly
anonymous account is converted to a named
licensed. The UUID is used in all
account – or simply login to their existing account.
subsequent
communications
between the device and web
In the case of logging into an existing account, all
service, and ensures that the
the information relating to the new device,
appropriate
credentials
are
including any usage and network credentials
delivered reliably to a device. The
associated with it are merged into the user’s
encryption key is used to robustly
encrypt
all
communications
account. This process allows multiple devices to
between the device and the web
be registered into a user’s account and managed
service.
together.

It should be noted that the registration process is essentially the same if the Connect
client is downloaded and installed into a device, or comes embedded in a
manufacturer’s wireless device. Registration can also be performed behind the
scenes via web services, allowing Devicescape to be integrated into a device
manufacturer’s or service provider’s existing registration processes.

As shown in Figure 4, once a device is registered it appears in a user’s Devicescape
account. The user can suspend and reactivate delivery of the Connect service to the
device, or permanently delete the device from their account. In the event a user’s
device is lost, stolen or sold, they can quickly disable it’s network services to prevent
their service plans from being abused.


An Overview of the Devicescape Connect Service
10

---